Changes to Existing Law

26.511.29 26.511.30 101st Legislative Session 110 2026 South Dakota Legislature Senate Bill 110 SENATE STATE AFFAIRS ENGROSSED Introduced by: Senator Rohl Underscores indicate new language. Overstrikes indicate deleted language. An Act to regulate how broadband internet access service providers use customer 1 data. 2 BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF SOUTH DAKOTA: 3 Section 1. That a NEW SECTION be added to chapter 49-31: 4 Terms used in this Act mean: 5 (1) "Aggregate customer personal information dataset," a collection of data that 6 relates to a group or category of customers, which is not linked or reasonably 7 linkable to any individual person, household, or device, and from which individual 8 customer identities and characteristics have been removed; 9 (2) "Broadband internet access service," a mass-market retail service, by wire or radio, 10 that provides the capability to transmit data to and receive data from all or 11 substantially all internet endpoints, including any capabilities that are incidental to 12 and enable the operation of the communications service, but excluding dial-up 13 internet access service; 14 (3) "Broadband internet access service provider," a person engaged in furnishing 15 broadband internet access service; 16 (4) "Customer," a current or former subscriber to, or applicant for, broadband internet 17 access service; 18 (5) "Customer personal information," the following data, which is collected by a 19 broadband internet access service provider from or about a customer and is made 20 available to the broadband internet access service provider by a customer solely 21 by virtue of the service provider-customer relationship: 22 (a) Content of communications, and any part of the substance, purpose, or 23 meaning of a communication or any other part of a communication that is 24 highly suggestive of the substance, purpose, or meaning of a 25 communication, and which includes application payload; 26 26.511.29 26.511.30 2 110 Underscores indicate new language. Overstrikes indicate deleted language. (b) Date of birth, age, ethnicity, gender, nationality, political beliefs, race, 1 religion, or sexual orientation; 2 (c) Device identifiers; 3 (d) Financial information; 4 (e) Geolocation information sufficient to identify the street name and 5 municipality of the user; 6 (f) Government-issued personal identification numbers; 7 (g) 5 (f) Health information; 8 (h) 6 (g) Information concerning a customer that is collected or made available and 9 7 is maintained in a way that is linked or reasonably linkable to a customer 10 8 or device; 11 (i) 9 (h) Information pertaining to children; 12 (j) Information that relates to the quantity, technical configuration, type, 13 destination, and location of use of the broadband internet access service; 14 (k) Mailing address, physical address, email address, and phone number; and 15 (l) 10 (i) Name and billing information; and 16 11 (6) "Opt-in consent," affirmative, express customer approval for the requested use, 17 12 disclosure, sale, or access to the customer personal information after the customer 18 13 is provided appropriate notification of the broadband service provider's practices 19 14 under section 3 of this Act. 20 15 Section 2. That a NEW SECTION be added to chapter 49-31: 21 16 A broadband internet access service provider may not use, disclose, sell, or permit 22 17 access to customer personal information, except as set forth in this Act. 23 18 Section 3. That a NEW SECTION be added to chapter 49-31: 24 19 A broadband internet access service provider may use, disclose, sell, or permit 25 20 access to customer personal information, if the service provider obtains prior opt-in 26 21 consent from the customer, which the customer may revoke at any time. 27 22 A service provider shall employ a mechanism for customers to grant, deny, or 28 23 withdraw consent that is: 29 24 (1) Clear; 30 25 (2) Comprehensible; 31 26 (3) Conspicuous; 32 27 (4) Easy to use; 33 26.511.29 3 110 Underscores indicate new language. Overstrikes indicate deleted language. 28 (5) Made available to the customer at no additional cost; 1 and 29 (6) Not misleading; and 2 (7) Persistently available through all methods the service provider gives customers for 3 account management. 4 misleading. 30 A customer's grant, denial, or withdrawal of consent must be given effect promptly 5 31 and remain in effect until the customer revokes or limits the grant, denial, or withdrawal 6 32 of consent. 7 33 26.511.30 3 110 Underscores indicate new language. Overstrikes indicate deleted language. A service provider may not refuse to serve a customer who does not consent under 8 1 this section, and may not charge a customer a higher price or offer a customer a discount 9 2 or other benefit based on the customer's decision to provide or not provide consent. 10 3 Section 4. That a NEW SECTION be added to chapter 49-31: 11 4 A service provider may use, disclose, sell, or permit access to customer personal 12 5 information without customer approval: 13 6 (1) For the purpose of providing broadband internet access service from which the 14 7 information is derived or for purposes necessary for the provision of the service; 15 8 (2) To comply with legal process or other laws, court orders, or administrative orders; 16 9 (3) To initiate, render, bill for, and collect payment for broadband internet access 17 10 service; 18 11 (4) To protect the right or property of the broadband internet access service provider 19 12 or to protect customers and other service providers from fraudulent, abusive, or 20 13 unlawful use of or subscription to the service provider's broadband internet service 21 14 network; 22 15 (5) To provide, for purposes of responding to the customer's request for emergency 23 16 services, location information to: 24 17 (a) A hospital emergency or trauma care facility; 25 18 (b) An emergency medical service provider or emergency dispatch provider; 26 19 (c) A public safety, fire service, or law enforcement official; or 27 20 (d) A public safety answering point; 28 21 (6) To provide, for purposes of responding to the customer's request for emergency 29 22 services, location information to: 30 23 (a) The customer's legal guardian; 31 24 (b) A member of the customer's family; or 32 25 (c) An individual reasonably believed by the broadband internet service access 33 26 provider to be a close personal friend of the customer; or 34 26.511.29 4 110 Underscores indicate new language. Overstrikes indicate deleted language. 27 (7) To providers of information or database management services, solely for purposes 1 28 of assisting in the delivery of emergency services. 2 29 Section 5. That a NEW SECTION be added to chapter 49-31: 3 30 A service provider may not retain customer personal information for longer than 4 31 reasonably necessary to accomplish the purposes for which the information was collected, 5 32 unless the data is part of an aggregate customer personal information dataset. 6 33 26.511.30 4 110 Underscores indicate new language. Overstrikes indicate deleted language. Section 6. That a NEW SECTION be added to chapter 49-31: 7 1 A broadband internet access service provider may use, disclose, sell, or permit 8 2 access to customer personal information to advertise or market the service provider's 9 3 communications-related services to the customer, provided that: 10 4 (1) The broadband internet access service provider notifies the customer of the right 11 5 to opt out in accordance with the requirements set forth in section 3 of this Act; 12 6 and 13 7 (2) The customer may opt out of that use, disclosure, sale, or access at any time. 14 8 Section 7. That a NEW SECTION be added to chapter 49-31: 15 9 Nothing in this Act restricts broadband internet access service providers from: 16 10 (1) Generating an aggregate customer personal information dataset using customer 17 11 personal information; or 18 12 (2) Using, disclosing, selling, or permitting access to an aggregate customer personal 19 13 information dataset generated by the service provider. 20 14 Section 8. That a NEW SECTION be added to chapter 49-31: 21 15 A broadband internet access service provider shall implement and maintain 22 16 reasonable measures to protect customer personal information from unauthorized use, 23 17 disclosure, sale, access, destruction, or modification. 24 18 A broadband internet access service provider may employ any lawful security 25 19 measures to comply with the requirements set forth in this Act. 26 20 Providers that utilize reasonable measures to protect customer personal 21 information may not be liable for unauthorized access to customer personal information. 22 Section 9. That a NEW SECTION be added to chapter 49-31: 27 23 A broadband internet access service provider shall notify each customer of the 28 24 requirements of sections 1 to 8, inclusive, of this Act. 29 26.511.29 5 110 Underscores indicate new language. Overstrikes indicate deleted language. 25 The service provider shall make the notice subsequently and persistently available 1 through all methods the service provider gives customers for account management. 2 available. 26 The notice required by this section must also specify and describe: 3 27 (1) The types of customer personal information collected, how that information is used 4 28 by the service provider, and how long the service provider retains the data; 5 29 (2) The circumstances under which the service provider discloses, sells, or permits 6 30 access to the information that it collects; 7 and 31 26.511.30 5 110 Underscores indicate new language. Overstrikes indicate deleted language. (3) The categories of entities to which the service provider discloses, sells, or permits 8 access to customer personal information, and the purposes for which each category 9 of entity will use the information; and 10 (4) The customer's right to consent to the use of, disclosure of, sale of, or access to 11 1 the customer's personal information, and how that right may be exercised. 12 2 Section 10. That a NEW SECTION be added to chapter 49-31: 13 3 A broadband internet access service provider shall notify customers in advance of 14 4 any material change to the notice required under section 9 of this Act or to the manner in 15 5 which the service provider uses, discloses, sells, or permits access to customer personal 16 6 information. 17 7 A service provider shall yearly notify the customer that the customer may grant, 18 8 deny, or withdraw consent, at any time and in any manner in accordance with section 3 19 9 of this Act. 20 10 For purposes of this section, "material change" means a significant modification to 21 11 the terms, conditions, or capabilities of a service so as to fundamentally alter the original 22 12 scope of the service. 23 13 Section 11. That a NEW SECTION be added to chapter 49-31: 24 14 A broadband internet access service provider shall, upon a customer's affirmative 25 15 written request, disclose the customer personal information to any person designated by 26 16 the customer. 27 17 Section 12. That a NEW SECTION be added to chapter 49-31: 18 Broadband internet service providers that are small businesses pursuant to 13 19 C.F.R. § 121.201 (January 1, 2026) are exempt from sections 2 to 12, inclusive, of this 20 Act. 21

26.511.30 26.511.31 101st Legislative Session 110 2026 South Dakota Legislature Senate Bill 110 SENATE STATE AFFAIRS ENGROSSED Introduced by: Senator Rohl Underscores indicate new language. Overstrikes indicate deleted language. An Act to regulate how broadband internet access service providers use customer 1 data. 2 BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF SOUTH DAKOTA: 3 Section 1. That a NEW SECTION be added to chapter 49-31: 4 Terms used in this Act mean: 5 (1) "Aggregate customer personal information dataset," a collection of data that 6 relates to a group or category of customers, which is not linked or reasonably 7 linkable to any individual person, household, or device, and from which individual 8 customer identities and characteristics have been removed; 9 (2) "Broadband internet access service," a mass-market retail service, by wire or radio, 10 that provides the capability to transmit data to and receive data from all or 11 substantially all internet endpoints, including any capabilities that are incidental to 12 and enable the operation of the communications service, but excluding dial-up 13 internet access service; 14 (3) "Broadband internet access service provider," a person engaged in furnishing 15 broadband internet access service; 16 (4) "Customer," a current or former subscriber to, or applicant for, broadband internet 17 access service; 18 (5) "Customer personal information," the following data, which is collected by a 19 broadband internet access service provider from or about a customer and is made 20 available to the broadband internet access service provider by a customer solely 21 by virtue of the service provider-customer relationship: 22 (a) Content of communications, and any part of the substance, purpose, or 23 meaning of a communication or any other part of a communication that is 24 highly suggestive of the substance, purpose, or meaning of a 25 communication, and which includes application payload; 26 26.511.30 26.511.31 2 110 Underscores indicate new language. Overstrikes indicate deleted language. (b) Date of birth, age, ethnicity, gender, nationality, political beliefs, race, 1 religion, or sexual orientation; 2 (c) Device identifiers; 3 (d) Financial information; 4 (e) Government-issued personal identification numbers; 5 (f) Health information; 6 (g) Information concerning a customer that is collected or made available and 7 is maintained in a way that is linked or reasonably linkable to a customer 8 or device; 9 (h) Information pertaining to children; and 10 (i) Name and billing information; and 11 (6) "Opt-in consent," affirmative, express customer approval for the requested use, 12 disclosure, sale, or access to the customer personal information after the customer 13 is provided appropriate notification of the broadband service provider's practices 14 under section 3 of this Act. 15 Section 2. That a NEW SECTION be added to chapter 49-31: 16 A broadband internet access service provider may not use, disclose, sell, or permit 17 access to customer personal information, except as set forth in this Act. 18 Section 3. That a NEW SECTION be added to chapter 49-31: 19 A broadband internet access service provider may use, disclose, sell, or permit 20 access to customer personal information, if the service provider obtains prior opt-in 21 consent from the customer, which the customer may revoke at any time. 22 A service provider shall employ a mechanism for customers to grant, deny, or 23 withdraw consent that is: 24 (1) Clear; 25 (2) Comprehensible; 26 (3) Conspicuous; 27 (4) Easy to use; 28 (5) Made available to the customer at no additional cost; and 29 (6) Not misleading. 30 A customer's grant, denial, or withdrawal of consent must be given effect promptly 31 and remain in effect until the customer revokes or limits the grant, denial, or withdrawal 32 of consent. 33 26.511.30 26.511.31 3 110 Underscores indicate new language. Overstrikes indicate deleted language. A service provider may not refuse to serve a customer who does not consent under 1 this section, and may not charge a customer a higher price or offer a customer a discount 2 or other benefit based on the customer's decision to provide or not provide consent. 3 Section 4. That a NEW SECTION be added to chapter 49-31: 4 A service provider may use, disclose, sell, or permit access to customer personal 5 information without customer approval: 6 (1) For the purpose of providing broadband internet access service from which the 7 information is derived or for purposes necessary for the provision of the service; 8 (2) To comply with legal process or other laws, court orders, or administrative orders; 9 (3) To initiate, render, bill for, and collect payment for broadband internet access 10 service; 11 (4) To protect the right or property of the broadband internet access service provider 12 or to protect customers and other service providers from fraudulent, abusive, or 13 unlawful use of or subscription to the service provider's broadband internet service 14 network; 15 (5) To provide, for purposes of responding to the customer's request for emergency 16 services, location information to: 17 (a) A hospital emergency or trauma care facility; 18 (b) An emergency medical service provider or emergency dispatch provider; 19 (c) A public safety, fire service, or law enforcement official; or 20 (d) A public safety answering point; 21 (6) To provide, for purposes of responding to the customer's request for emergency 22 services, location information to: 23 (a) The customer's legal guardian; 24 (b) A member of the customer's family; or 25 (c) An individual reasonably believed by the broadband internet service access 26 provider to be a close personal friend of the customer; or 27 (7) To providers of information or database management services, solely for purposes 28 of assisting in the delivery of emergency services. 29 Section 5. That a NEW SECTION be added to chapter 49-31: 30 A service provider may not retain customer personal information for longer than 31 reasonably necessary to accomplish the purposes for which the information was collected, 32 unless the data is part of an aggregate customer personal information dataset. 33 26.511.30 26.511.31 4 110 Underscores indicate new language. Overstrikes indicate deleted language. Section 6. That a NEW SECTION be added to chapter 49-31: 1 A broadband internet access service provider may use, disclose, sell, or permit 2 access to customer personal information to advertise or market the service provider's 3 communications-related services to the customer, provided that: 4 (1) The broadband internet access service provider notifies the customer of the right 5 to opt out in accordance with the requirements set forth in section 3 of this Act; 6 and 7 (2) The customer may opt out of that use, disclosure, sale, or access at any time. 8 Section 7. That a NEW SECTION be added to chapter 49-31: 9 Nothing in this Act restricts broadband internet access service providers from: 10 (1) Generating an aggregate customer personal information dataset using customer 11 personal information; or 12 (2) Using, disclosing, selling, or permitting access to an aggregate customer personal 13 information dataset generated by the service provider. 14 Section 8. That a NEW SECTION be added to chapter 49-31: 15 A broadband internet access service provider shall implement and maintain 16 reasonable measures to protect customer personal information from unauthorized use, 17 disclosure, sale, access, destruction, or modification. 18 A broadband internet access service provider may employ any lawful security 19 measures to comply with the requirements set forth in this Act. 20 Providers that utilize reasonable measures to protect customer personal 21 information may not be liable for unauthorized access to customer personal information. 22 Section 9. That a NEW SECTION be added to chapter 49-31: 23 A broadband internet access service provider shall notify each customer of the 24 requirements of sections 1 to 8, inclusive, of this Act. 25 The service provider shall make the notice subsequently and persistently available. 26 The notice required by this section must also specify and describe: 27 (1) The types of customer personal information collected, how that information is used 28 by the service provider, and how long the service provider retains the data; 29 (2) The circumstances under which the service provider discloses, sells, or permits 30 access to the information that it collects; and 31 26.511.30 26.511.31 5 110 Underscores indicate new language. Overstrikes indicate deleted language. (3) The customer's right to consent to the use of, disclosure of, sale of, or access to 1 the customer's personal information, and how that right may be exercised. 2 Section 10. That a NEW SECTION be added to chapter 49-31: 3 A broadband internet access service provider shall notify customers in advance of 4 any material change to the notice required under section 9 of this Act or to the manner in 5 which the service provider uses, discloses, sells, or permits access to customer personal 6 information. 7 A service provider shall yearly notify the customer that the customer may grant, 8 deny, or withdraw consent, at any time and in any manner in accordance with section 3 9 of this Act. 10 For purposes of this section, "material change" means a significant modification to 11 the terms, conditions, or capabilities of a service so as to fundamentally alter the original 12 scope of the service. 13 Section 11. That a NEW SECTION be added to chapter 49-31: 14 A broadband internet access service provider shall, upon a customer's affirmative 15 written request, disclose the customer personal information to any person designated by 16 the customer. 17 Section 12. That a NEW SECTION be added to chapter 49-31: 18 Broadband internet service providers that are small businesses pursuant to 13 19 C.F.R. § 121.201 (January 1, 2026) are exempt from sections 2 to 12, inclusive, of this 20 Act. 21