Tennessee Senate Bill SB2100

Tennessee 2025-2026 Regular Session

• Introduced: 1/22/26

Caption

AN ACT to amend Tennessee Code Annotated, Title 47, Chapter 18, Part 33, relative to the Tennessee Information Protection Act.

Summary

SB2100 amends Tennessee’s Information Protection Act to expand the definition of a covered “controller” to include entities whose primary business is the commercial sale, licensing, or transfer of personal information, even if they do not have a direct consumer relationship. The bill also creates a new statewide registration and deletion framework for controllers subject to the Act. Under the bill, covered controllers must register annually with the Attorney General’s consumer protection division and pay a fee capped at the division’s reasonable costs. By July 1, 2027, the division must build a public webpage and an accessible deletion mechanism that lets consumers, or their authorized agents, submit a single authenticated request to delete personal information held by all covered controllers, exclude specific controllers, change prior requests after 45 days, and check request status. The mechanism must be free to consumers and usable by people with disabilities.

Impact

The bill would add new compliance obligations to the Tennessee Information Protection Act, including registration, fee payment, and mandatory participation in a state-run deletion system. It also creates the Information Protection Registry Fund in the state treasury to receive fees and other gifts or grants, with money dedicated to administering the registry and deletion mechanism. Controllers and their affiliates that fail to comply would face enforcement under the Act, including civil investigative demands, civil penalties, and other relief available to the Attorney General.

Sentiment

No committee transcripts or recorded votes were provided, so there is no direct evidence of debate or formal support/opposition in the available materials. Based on the bill text, the measure appears aimed at strengthening consumer privacy rights and making deletion requests easier to exercise across multiple data holders. The overall framing suggests a consumer-protection orientation rather than a punitive regulatory change, but the added compliance and fee requirements indicate likely interest from regulated businesses.

Contention

The main points of potential contention are the broadened scope of covered entities, the new annual registration requirement, and the obligation to use a centralized deletion mechanism. Businesses that buy, license, or trade personal data may object to being treated as controllers even without a direct consumer relationship, and controllers may also resist the administrative burden and costs of registration and deletion processing. Consumer advocates would likely support the bill’s expanded deletion rights and accessibility features, while industry stakeholders may focus on authentication standards, operational burdens, and the requirement to process requests across affiliates.