(1) A consumer may at any time submit a request to a controller specifying the consumer rights the consumer wishes to exercise. With respect to the processing of personal data belonging to a known child, a parent or legal guardian of the child may exercise the consumer rights on behalf of the known child.

(2) A controller shall comply with an authenticated consumer request to exercise the right to:

(a) Confirm whether a controller is processing the consumer's personal data and to access the personal data;

(b) Correct inaccuracies in the consumer's personal data, taking into account the nature of the personal data and the purposes of the processing of the consumer's personal data;

(c) Delete personal data provided by or obtained about the consumer;

(d) If the data is available in a digital format and the processing is completed by automated means, obtain a copy of the consumer's personal data that the consumer previously provided to the controller in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another controller without hindrance; or

(e) Opt out of the processing of the personal data for purposes of:

(i) Targeted advertising;

(ii) The sale of personal data; or

(iii) Profiling in furtherance of a decision that produces a legal or similarly significant effect concerning the consumer.