The Responsibilities of Businesses

1. Businesses should specifically and clearly inform consumers about how they collect and use personal information and how they can exercise their rights and choice.

2. Businesses should only collect consumers' personal information for specific, explicit, and legitimate disclosed purposes, and should not further collect, use, or disclose consumers' personal information for reasons incompatible with those purposes.

3. Businesses should collect consumers' personal information only to the extent that it is relevant and limited to what is necessary in relation to the purposes for which it is being collected, used, and shared.

4. Businesses should provide consumers or their authorized agents with easily accessible means to allow consumers and their children to obtain their personal information, to delete it, or correct it, and to opt-out of its sale and the sharing across business platforms, services, businesses and devices, and to limit the use of their sensitive personal information.

5. Businesses should not penalize consumers for exercising these rights.

6. Businesses should take reasonable precautions to protect consumers' personal information from a security breach.

7. Businesses should be held accountable when they violate consumers' privacy rights, and the penalties should be higher when the violation affects children.