HB307 creates the “Internet Privacy and Safety Act,” a comprehensive consumer privacy law aimed at online services offered to people in New Mexico. It defines a wide range of terms related to personal data, sensitive personal data, biometric data, targeted advertising, profiling, dark patterns, privacy-protective feeds, and data brokerage. The bill applies to profit-making entities that offer online features, products, or services to New Mexico consumers and that determine how personal data is collected, used for targeted advertising, or brokered.
The bill would require covered entities to default to the highest privacy settings, provide clear privacy notices and user tools, and maintain reasonable data security practices. It also gives consumers rights to access, correct, delete, and port their personal data, and to stop certain collection and processing. The bill restricts profiling by default, limits processing to what is necessary for the requested service, requires notice when precise geolocation is collected, and bars dark patterns, undisclosed tracking, and processing sensitive data for targeted advertising, first-party advertising, or data brokerage. Special protections are included for minors, including privacy-protective default settings, limits on contact from unknown users, and nighttime notification restrictions when the platform knows the user is under 18.
HB307 would also require written data processing agreements between covered entities and service providers or third parties, including safeguards for subcontractors and transfers of data outside New Mexico. It prohibits retaliation against consumers who exercise privacy rights and bars contract terms that waive or undermine those rights. Enforcement would include injunctive relief, civil penalties of up to $2,500 per negligent violation and $7,500 per intentional violation per affected consumer, and a private right of action for consumers. The state Department of Justice would be tasked with rulemaking by April 1, 2026, and with annual reporting on how the state law compares with federal privacy and minor-protection requirements.
The bill’s impact on state law would be significant: it would create a new statewide privacy framework governing many online platforms and data practices, impose affirmative compliance duties on businesses, and expand consumer remedies. It also includes exemptions and limitations for federal-law compliance, government entities, certain security and law-enforcement activities, emergencies, and some business transfers, while preserving the bill’s core restrictions on commercial data use. The measure would likely affect social media platforms, app providers, advertisers, data brokers, and other online businesses operating in New Mexico.
Because there are no committee transcripts or recorded votes provided, the overall sentiment cannot be measured from debate or roll call history. Based on the bill text alone, the measure appears strongly consumer-protective and privacy-focused, with an emphasis on minors’ safety and limits on commercial surveillance. The main points of contention likely would be the breadth of the restrictions on targeted advertising, profiling, and data brokerage; the compliance burden on online businesses; the private right of action and civil penalties; and how the bill interacts with federal privacy and security laws.
HB307 would establish a new chapter of state privacy obligations for online service providers, requiring default high-privacy settings, consumer access/correction/deletion/portability rights, opt-in consent for targeted advertising and data brokerage, and special protections for minors and sensitive personal data. It would also impose contractual and security requirements on service providers and third parties, authorize civil penalties and private enforcement, and direct the Department of Justice to adopt implementing rules and report annually on federal-state alignment. The bill would primarily affect online platforms, advertisers, data brokers, and other profit-making entities that process New Mexico consumers’ personal data.
No committee discussion or vote history was provided, so there is no recorded legislative sentiment to summarize from debate or roll calls. From the bill text, the policy direction is clearly pro-privacy and pro-consumer, with especially strong protections for minors and limits on commercial data exploitation. The likely support base would be privacy advocates and consumer protection interests, while likely opposition would come from online platforms, advertisers, and data-driven businesses concerned about compliance costs and operational limits.
The most likely points of contention are the bill’s broad restrictions on profiling, targeted advertising, first-party advertising, and data brokerage; the requirement for opt-in consent rather than opt-out; and the private right of action paired with per-consumer civil penalties. Businesses may also object to the operational complexity of default privacy settings, minor-specific safeguards, data processing agreements, and obligations around precise geolocation and sensitive data. Another potential dispute is the bill’s interaction with federal law and whether its exemptions are sufficient or create ambiguity for regulated industries.