SB 110

 26.511.31  101st Legislative Session  110
                                         2026 South Dakota Legislature
                                                  Senate Bill 110
                                                         SENATE ENGROSSED
 Introduced by: Senator Rohl
1 An Act to regulate how broadband internet access service providers use customer
2data.
3 BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF SOUTH DAKOTA:
4 Section 1. That a NEW SECTION be added to chapter 49-31:
5Terms used in this Act mean:
6     (1)      "Aggregate customer personal information dataset," a collection of data that
7relates to a group or category of customers, which is not linked or reasonably
8linkable to any individual person, household, or device, and from which individual
9customer identities and characteristics have been removed;
10     (2)      "Broadband internet access service," a mass-market retail service, by wire or radio,
11that provides the capability to transmit data to and receive data from all or
12substantially all internet endpoints, including any capabilities that are incidental to
13and enable the operation of the communications service, but excluding dial-up
14internet access service;
15     (3)      "Broadband internet access service provider," a person engaged in furnishing
16broadband internet access service;
17     (4)      "Customer," a current or former subscriber to, or applicant for, broadband internet
18access service;
19     (5)      "Customer personal information," the following data, which is collected by a
20broadband internet access service provider from or about a customer and is made
21available to the broadband internet access service provider by a customer solely
22by virtue of the service provider-customer relationship:
23(a)    Content of communications, and any part of the substance, purpose, or
24meaning of a communication or any other part of a communication that is
25highly     suggestive   of   the    substance,   purpose,   or    meaning  of      a
26communication, and which includes application payload;
                                                                                    Underscores indicate new language.
                                                                                  Overstrikes indicate deleted language.
 26.511.31  2  110
1(b)      Date of birth, age, ethnicity, gender, nationality, political beliefs, race,
2religion, or sexual orientation;
3(c)      Device identifiers;
4(d)      Financial information;
5(e)      Government-issued personal identification numbers;
6(f)      Health information;
7(g)      Information concerning a customer that is collected or made available and
8is maintained in a way that is linked or reasonably linkable to a customer
9or device;
10(h)      Information pertaining to children; and
11(i)      Name and billing information; and
12    (6)      "Opt-in consent," affirmative, express customer approval for the requested use,
13disclosure, sale, or access to the customer personal information after the customer
14is provided appropriate notification of the broadband service provider's practices
15under section 3 of this Act.
16 Section 2. That a NEW SECTION be added to chapter 49-31:
17A broadband internet access service provider may not use, disclose, sell, or permit
18    access to customer personal information, except as set forth in this Act.
19 Section 3. That a NEW SECTION be added to chapter 49-31:
20A broadband internet access service provider may use, disclose, sell, or permit
21    access to customer personal information, if the service provider obtains prior opt-in
22    consent from the customer, which the customer may revoke at any time.
23A service provider shall employ a mechanism for customers to grant, deny, or
24    withdraw consent that is:
25    (1)      Clear;
26    (2)      Comprehensible;
27    (3)      Conspicuous;
28    (4)      Easy to use;
29    (5)      Made available to the customer at no additional cost; and
30    (6)      Not misleading.
31A customer's grant, denial, or withdrawal of consent must be given effect promptly
32    and remain in effect until the customer revokes or limits the grant, denial, or withdrawal
33    of consent.
                                                                                Underscores indicate new language.
                                                                              Overstrikes indicate deleted language.
 26.511.31  3  110
1A service provider may not refuse to serve a customer who does not consent under
2    this section, and may not charge a customer a higher price or offer a customer a discount
3    or other benefit based on the customer's decision to provide or not provide consent.
4 Section 4. That a NEW SECTION be added to chapter 49-31:
5A service provider may use, disclose, sell, or permit access to customer personal
6    information without customer approval:
7    (1)      For the purpose of providing broadband internet access service from which the
8information is derived or for purposes necessary for the provision of the service;
9    (2)      To comply with legal process or other laws, court orders, or administrative orders;
10    (3)      To initiate, render, bill for, and collect payment for broadband internet access
11service;
12    (4)      To protect the right or property of the broadband internet access service provider
13or to protect customers and other service providers from fraudulent, abusive, or
14unlawful use of or subscription to the service provider's broadband internet service
15network;
16    (5)      To provide, for purposes of responding to the customer's request for emergency
17services, location information to:
18(a)    A hospital emergency or trauma care facility;
19(b)    An emergency medical service provider or emergency dispatch provider;
20(c)    A public safety, fire service, or law enforcement official; or
21(d)    A public safety answering point;
22    (6)      To provide, for purposes of responding to the customer's request for emergency
23services, location information to:
24(a)    The customer's legal guardian;
25(b)    A member of the customer's family; or
26(c)    An individual reasonably believed by the broadband internet service access
27provider to be a close personal friend of the customer; or
28    (7)      To providers of information or database management services, solely for purposes
29of assisting in the delivery of emergency services.
30 Section 5. That a NEW SECTION be added to chapter 49-31:
31A service provider may not retain customer personal information for longer than
32    reasonably necessary to accomplish the purposes for which the information was collected,
33    unless the data is part of an aggregate customer personal information dataset.
                                                                                 Underscores indicate new language.
                                                                               Overstrikes indicate deleted language.
 26.511.31  4  110
1 Section 6. That a NEW SECTION be added to chapter 49-31:
2A broadband internet access service provider may use, disclose, sell, or permit
3    access to customer personal information to advertise or market the service provider's
4    communications-related services to the customer, provided that:
5    (1)      The broadband internet access service provider notifies the customer of the right
6to opt out in accordance with the requirements set forth in section 3 of this Act;
7and
8    (2)      The customer may opt out of that use, disclosure, sale, or access at any time.
9 Section 7. That a NEW SECTION be added to chapter 49-31:
10Nothing in this Act restricts broadband internet access service providers from:
11    (1)      Generating an aggregate customer personal information dataset using customer
12personal information; or
13    (2)      Using, disclosing, selling, or permitting access to an aggregate customer personal
14information dataset generated by the service provider.
15 Section 8. That a NEW SECTION be added to chapter 49-31:
16A broadband internet access service provider shall implement and maintain
17    reasonable measures to protect customer personal information from unauthorized use,
18    disclosure, sale, access, destruction, or modification.
19A broadband internet access service provider may employ any lawful security
20    measures to comply with the requirements set forth in this Act.
21Providers that utilize reasonable measures to protect customer personal
22    information may not be liable for unauthorized access to customer personal information.
23 Section 9. That a NEW SECTION be added to chapter 49-31:
24A broadband internet access service provider shall notify each customer of the
25    requirements of sections 1 to 8, inclusive, of this Act.
26The service provider shall make the notice subsequently and persistently available.
27The notice required by this section must also specify and describe:
28    (1)      The types of customer personal information collected, how that information is used
29by the service provider, and how long the service provider retains the data;
30    (2)      The circumstances under which the service provider discloses, sells, or permits
31access to the information that it collects; and
                                                                              Underscores indicate new language.
                                                                            Overstrikes indicate deleted language.
 26.511.31  5  110
1    (3)      The customer's right to consent to the use of, disclosure of, sale of, or access to
2the customer's personal information, and how that right may be exercised.
3 Section 10. That a NEW SECTION be added to chapter 49-31:
4A broadband internet access service provider shall notify customers in advance of
5    any material change to the notice required under section 9 of this Act or to the manner in
6    which the service provider uses, discloses, sells, or permits access to customer personal
7    information.
8A service provider shall yearly notify the customer that the customer may grant,
9    deny, or withdraw consent, at any time and in any manner in accordance with section 3
10    of this Act.
11For purposes of this section, "material change" means a significant modification to
12    the terms, conditions, or capabilities of a service so as to fundamentally alter the original
13    scope of the service.
14 Section 11. That a NEW SECTION be added to chapter 49-31:
15A broadband internet access service provider shall, upon a customer's affirmative
16    written request, disclose the customer personal information to any person designated by
17    the customer.
                                                                               Underscores indicate new language.
                                                                             Overstrikes indicate deleted language.