Right to individual autonomy

(a) In general A covered entity may not, without the affirmative express consent of an individual, collect, process, maintain, or disclose the personal information of the individual to create, improve upon, maintain, process, or otherwise link the individual with an algorithm, model, or other means designed for behavioral personalization. (b) Consent (1) Consent required A covered entity shall obtain express affirmative consent from an individual before the entity provides a behaviorally personalized version of a product or service, and not less than every calendar year thereafter. (2) Denial of consent For a case in which consent is denied, the covered entity shall provide the product or service without behavioral personalization, except as provided in subsection (c). (c) Exceptions to providing product or service (1) Infeasibility For a case in which the offering of a substantially similar product or service without behavioral personalization is infeasible, a covered entity shall provide, to the greatest extent feasible, a core aspect or part of the product or service that can be offered without behavioral personalization. (2) Denial for inability to function For a case in which a core aspect or part of the product or service is not able to function in a substantially similar function without behavioral personalization, a covered entity may deny providing an individual use of such product or service if such individual does not consent to behavioral personalization as required in subsection (a). (d) Exception to behavioral processing Notwithstanding subsections (a) and (b), a covered entity may process personal information to create or operate behavioral personalization algorithms, models, or other mechanisms for the purpose of increasing the usability of the product or service provided by a covered entity that— (1) are built using aggregated personal information that is representative of all the personal information the covered entity maintains; and (2) have an output that is both uniform across the individuals that use the product or service and independent of a specific individual’s inherent or behavioral characteristics. (e) Usability The term usability as used in subsection (d) does not include optimizations or other alterations to the product or service that are made with the primary purpose of increasing the amount of time an individual engages with or uses the product or service, unless such increase benefits the individual. (f) Small businesses excluded This section does not apply to a small business.