Require written contracts with third parties for consumer data protection

Retain data when law enforcement requests preservation with active case

Extend data retention for additional 90-day periods when law enforcement shows good cause

Limit use of retained data to law enforcement production only

Extend consumer request response time when necessary with proper notice

Inform consumer when not taking action on their request

Notify consumer when charging fee or refusing manifestly unfounded requests

Bear burden of proving consumer requests are manifestly unfounded or excessive

Limit vehicle/vessel information sharing to warranty and recall purposes only

Comply with physical item production consent despite consumer opt-out when commercially reasonable

Notify consumers when acting under student grades deletion exception