(1) Except for purposes of the criminal penalty in Section 76-12-304, the personal identity of an individual is abused if:

1. (a)

   1. (i) content containing the personal identity of an individual is used for purposes of:

      1. (A) advertising products, merchandise, goods, or services;
      2. (B) fundraising;
      3. (C) solicitation of donations; or
      4. (D) purchases of products, merchandise, goods, or services;

   2. (ii) the use:

      1. (A) expresses or implies that the individual approves, endorses, has endorsed, or will endorse the specific subject matter;
      2. (B) creates a likelihood of confusion as to the participation, association, or connection of the individual; or
      3. (C) creates a false impression that the individual participated in or approved the use; and
   3. (iii) consent has not been obtained from the individual.
2. (b) the person knowingly distributes, sells, or licenses any technology, software, or tool whose intended primary purpose is the unauthorized creation or modification of content that includes an individual's personal identity for commercial purposes.

(3) The personal identity of an individual is not abused if the individual's personal data or publicly available information:

1. (a) was lawfully obtained;
2. (b) is used to preview, advertise, or promote the sale of a product, service, or subscription, including the sale of a product, service, or subscription of which the individual's personal data or publicly available information is or may be a part; and
3. (c) is not used in a way that expresses or implies that the individual approves, endorses, has endorsed, or will endorse the product, service, or subscription being previewed, advertised, or promoted.