Effective 1-1-2026.

1. (b) The term does not include:

   1. (1) the disclosure of personal data to a processor that processes the personal data on behalf of the controller;

   2. (2) the disclosure of personal data to a third party for purposes of providing a product or service requested by:

      1. (A) the consumer; or

      2. (B) the parent of a child;

         to whom the personal data pertains;

   3. (3) the disclosure or transfer of personal data to an affiliate of the controller;

   4. (4) the disclosure of information that the consumer:

      1. (A) intentionally made available to the general public via a channel of mass media; and
      2. (B) did not restrict to a specific audience; or
   5. (5) the disclosure or transfer of personal data to a third party as an asset that is part of a proposed or actual merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the controller's assets.

Sec. 27. (a) "Sale of personal data" means the exchange of personal data for monetary consideration by a controller to a third party.

As added by P.L.94-2023, SEC.1.