Sends commercial email, in Michigan

MCL 445.2501, 445.2503, 445.2504, 445.2505, 445.2507, 445.2508 · Read the law's page

• Do not use a third party's internet domain name or e-mail address in identifying the point of origin or transmission path of a commercial e-mail without that third party's consent, misrepresent that information, or fail to include the information necessary to identify the point of origin.
• Once a recipient notifies you that they do not want to receive further unsolicited commercial e-mail, do not send that recipient further unsolicited commercial e-mail, directly or through a third party, and keep policies and records, updated at least every 14 business days, so that the recipient receives none from the date of the notice.
• Do not sell, give, distribute, or possess with intent to sell, give or distribute, software primarily designed, of only limited other commercially significant use, or marketed for falsifying commercial e-mail transmission or routing information.
• A commercial e-mail you intentionally send unsolicited through an e-mail service provider you knew or should have known is located in Michigan, or to an address you knew or should have known is held by a Michigan resident, must carry "ADV:" as the first four characters of the subject line, your legal name, correct street address, valid domain name and valid return e-mail address, and a toll-free number, return e-mail address or other easy electronic method the recipient can use to opt out, with a notice of it in print as large as most of the message; this labeling, identification and opt-out duty is not framed as a rule against falsity or deception.
• An e-mail sent with the recipient's express permission, to someone with whom you have a preexisting business or personal relationship, or received because the recipient opted into a system to receive promotional material is not unsolicited.

MCL 445.72a (Sec. 12a of Act 452 of 2004, added by 2006 PA 566) · Read the law's page

• Destroy, or arrange for the destruction of, any data containing personal information about an individual once that data is removed from the database and is not being retained elsewhere for a purpose state or federal law does not prohibit; retaining the data for an investigation, audit, or internal review does not violate this duty. Destroy the data by shredding, erasing, or otherwise modifying it so it cannot be read, deciphered, or reconstructed through generally available means.
• This binds a person (a private business or other legal entity) or an agency (a Michigan state government department, board, commission, office, authority, or unit, including a public university, but not a court) that maintains a database including personal information about multiple Michigan residents.
• You are considered compliant here if you are already subject to, and in compliance with, a federal law governing the disposal of records containing personal identifying information.
• A knowing violation is a misdemeanor punishable by a fine of up to $250 for each violation; this section creates no private right of action, though it preserves whatever other civil remedy state or federal law might otherwise provide.

2025 S.B. 360, proposed MCL 445.71a and 445.85c (secs. 11a and 20c), as passed by the Senate · Read the law's page

• As passed by the Senate, a person (any private entity) or agency (a Michigan state government unit) that owns, possesses, collects, or accesses personal information must implement and maintain reasonable security procedures: designate a security coordinator, identify internal and external risks, include appropriate safeguards addressing those risks, assess the safeguards' effectiveness, contractually require every service provider to maintain safeguards conforming to the NIST Cybersecurity Framework 2.0 or another industry-standard framework, and evaluate and adjust the procedures for changed circumstances.
• Reasonableness is judged by your size, the amount of personal information you own, possess, collect, or access, the type of activities for which you handle it, and the cost of the procedures relative to your resources. Conforming to the current NIST Cybersecurity Framework 2.0, or already being regulated by Michigan or the federal government and reasonably conforming to HIPAA, Gramm-Leach-Bliley Title V, the Federal Information Security Modernization Act of 2014, or HITECH, is deemed compliance.