South Dakota

HB 1053 (2025), age verification for websites containing material harmful to minors

Requires a covered platform, defined as a website whose regular course of trade or business is to create, host, or make available material harmful to minors, to implement reasonable age verification (state issued driver license or non-driver ID, bank account information, an age restricted debit or credit card, or another reliable method) and to prevent minors from accessing that material. Verifiers may not sell or retain identifying information. Search engines, internet service providers, and cloud providers are exempt.

Breach of system security, notification statute

Following discovery of a breach of system security, an information holder must disclose the breach to any affected South Dakota resident not later than 60 days from discovery, absent a law-enforcement delay. An information holder whose breach exceeds 250 South Dakota residents (not 250,000, correcting an initial WebSearch summary against the enrolled bill's own text) must also disclose the breach to the Attorney General by mail or electronic mail.

Personal information excludes information lawfully made available to the general public from government records; it folds in biometric data only in a narrow, conditional way, as one component of an employer-assigned identification number used for authentication, not as a freestanding sensitive category. The Attorney General may prosecute a failure to disclose as a deceptive act under SDCL sec. 37-24-6 and may separately bring an action for a civil penalty of up to $10,000 per day per violation.

South Dakota's general Deceptive Trade Practices and Consumer Protection chapter independently arms any person adversely affected by a sec. 37-24-6 violation with a private civil action for actual damages (SDCL sec. 37-24-31), and unlike the comparable enforcement clauses in Pennsylvania, South Carolina's Chapter 80, or West Virginia, this breach statute's enforcement section contains no exclusivity language naming the Attorney General as the sole enforcer.

Whether this deeming-plus-private-action chain actually arms a resident to sue over a notice violation is left here as an open, statute-supported question rather than a settled finding, since no case construing sec. 22-40-25 together with sec. 37-24-31 was found.

Genetic Data Privacy Act, enforcement

The Attorney General may petition a court to impose a civil penalty of up to $5,000 per violation of SDCL secs. 37-24-60 to 37-24-62.

This standalone enforcement provision does not cross-reference SDCL sec. 37-24-6, the general deceptive-act provision that the breach statute's own enforcement section deems a violation into, so the general Deceptive Trade Practices and Consumer Protection chapter's private right of action, SDCL sec. 37-24-31, which is keyed specifically to a sec. 37-24-6 violation, does not reach a Genetic Data Privacy Act violation. No damages-preservation clause exists either. This Act creates no private right of action.

Genetic Data Privacy Act, definitions, consent, and consumer rights

South Dakota's Genetic Data Privacy Act defines genetic data as data other than de-identified data, regardless of format, concerning a consumer's genetic characteristics, and applies only to a direct-to-consumer genetic testing company and its service providers, not to personal data generally.

A covered company must obtain a consumer's opt-in express consent for collection, and separately for disclosure, third-party transfer, research use, retention beyond the initial test, and marketing use, and must maintain a security program. A consumer may access their genetic data, delete their account and genetic data, and obtain destruction of their biological sample; revocation of consent must be honored, and a biological sample destroyed, within 30 days.

The Act never mentions biometric data anywhere in its text; genetic and biometric data are treated as distinct categories in South Dakota law, not interchangeably. Exemptions cover HIPAA-covered entities, medical screening, diagnosis or treatment, higher-education institutions, forensic laboratories, and human-subjects research.