(1) Except for purposes of the criminal penalty in Section 76-9-407, the personal identity of an individual is abused if:

1. (a) an advertisement is published in which the personal identity of that individual is used in a manner which expresses or implies that the individual approves, endorses, has endorsed, or will endorse the specific subject matter of the advertisement; and
2. (b) consent has not been obtained for such use from the individual, or if the individual is a minor, then consent of one of the minor's parents or consent of the minor's legally appointed guardian.

(3) The personal identity of an individual is not abused if the individual's personal data or publicly available information:

1. (a) was lawfully obtained;
2. (b) is used to preview, advertise, or promote the sale of a product, service, or subscription, including the sale of a product, service, or subscription of which the individual's personal data or publicly available information is or may be a part; and
3. (c) is not used in a way that expresses or implies that the individual approves, endorses, has endorsed, or will endorse the product, service, or subscription being previewed, advertised, or promoted.