Mississippi Consumer Data Privacy Act; enact.
SB 2779 would create the Mississippi Consumer Data Privacy Act, establishing a statewide consumer privacy framework for certain for-profit businesses operating in Mississippi. The bill gives consumers the right to know what personal information a business collects, where it comes from, whether it is sold or shared, and to request deletion of that information. It also requires businesses to provide notice of these rights, offer at least two methods for submitting requests, respond within 45 days, and include a clear “Do Not Sell My Personal Information” link on their websites if they operate online.
The bill also limits the sale of personal information, especially for minors, and prohibits businesses from discriminating against consumers who exercise their privacy rights. It applies to businesses above specified thresholds, including those with more than $10 million in annual revenue, those handling data on at least 50,000 consumers/households/devices, or those deriving at least half of revenue from selling personal information. The Attorney General would be authorized to enforce the act, adopt regulations, and seek civil penalties, while consumers could also bring civil actions in certain circumstances, particularly for data breaches involving unauthorized access or disclosure of nonencrypted, nonredacted personal information.
SB 2779 would add a new chapter of Mississippi privacy law governing the collection, use, disclosure, sale, and deletion of personal information by covered businesses. It would impose affirmative disclosure, access, deletion, and opt-out obligations, create special protections for consumers under 16, and require businesses to maintain reasonable security practices. The bill also preempts local ordinances on the collection and sale of consumer personal information, making the state law the exclusive standard for these issues. If enacted, it would take effect July 1, 2025, with Attorney General rulemaking due by September 1, 2025.
Based on the bill text and the absence of recorded committee debate or votes, the overall sentiment appears to be policy-driven and consumer-protective rather than contentious in the available record. The legislation is framed as a response to growing concerns about identity theft, financial loss, and lack of consumer control over personal data. Because there are no transcripts or vote history provided, there is no documented public split or formal support/opposition in the materials supplied.
The main points of potential contention are the scope of covered businesses, the compliance burden on businesses, and the enforcement structure. Businesses subject to the act would need to build privacy request systems, website disclosures, deletion workflows, and opt-out mechanisms, while also facing consumer lawsuits and Attorney General penalties. Another likely issue is the breadth of the definition of personal information and the limits on data sales, especially the opt-in requirement for minors under 16 and the restrictions on third-party resale. The bill also preempts local regulation, which could be controversial for local governments or advocates of stronger local privacy rules.