Georgia legislation · 2025-2026 Regular Session
Georgia SB111: "Georgia Consumer Privacy Protection Act"; enact
Status: Signed into law, May 11, 2026
A BILL to be entitled an Act to amend Title 10 of the Official Code of Georgia Annotated, relating to commerce and trade, so as to enact the "Georgia Consumer Privacy Protection Act"; to protect the privacy of consumer personal data in this state; to provide for definitions; to provide for applicability; to provide for exemptions; to provide for responsibilities of processors and controllers; to provide for notice and disclosure; to provide for security practices to protect consumer personal data; to allow a controller to offer different goods or services under certain conditions; to provide for limitations; to provide for statutory construction; to provide for preemption of local regulation; to provide for related matters; to provide an effective date; to repeal conflicting laws; and for other purposes.
What the bill says
To amend Title 10 of the Official Code of Georgia Annotated, relating to commerce and trade, so as to enact the "Georgia Consumer Privacy Protection Act"; to protect the privacy of consumer personal data in this state; to provide for definitions; to provide for applicability; to provide for exemptions for certain entities, data, and uses of data; to provide for consumer rights regarding personal data; to provide for a consumer to exercise such rights by submitting a request to a controller; to provide for a controller to promptly respond to such requests…
From the introduced text:
A BILL TO BE ENTITLED To amend Title 10 of the Official Code of Georgia Annotated, relating to commerce and trade, so as to enact the "Georgia Consumer Privacy Protection Act"; to protect the privacy of consumer personal data in this state; to provide for definitions; to provide for applicability; to provide for exemptions for certain entities, data, and uses of data; to provide for consumer rights regarding personal data; to provide for a consumer to exercise such rights by submitting a request to a controller; to provide for a controller to promptly respond to such requests; to provide for exemptions; to provide for responsibilities of processors and controllers; to provide for notice and disclosure; to provide for security practices to protect consumer personal data; to allow a controller to offer different goods or services under certain conditions; to provide for limitations; to provide for statutory construction; to provide for enforcement and penalties; to provide an affirmative defense; to prohibit the disclosure of personal data of consumers to local governments unless pursuant to a subpoena or court order; to provide for preemption of local regulation; to provide for related matters; to provide an effective date; to repeal conflicting laws; and for other purposes. BE IT ENACTED BY THE GENERAL ASSEMBLY OF GEORGIA: S. B. LC 59 0079 SECTION 1. Title …