US-GA v2.0 Sign in

US-GA (US-GA) · Module W10 · Derived Confidence: Confirmed

US-GA: Consumer Protection & APP Fraud

← Full US-GA Dossier (14 modules) Open US-GA in Co-Pilot ↗ Request Bespoke Deeper Dive

#

Georgia lacked a comprehensive consumer privacy statute until Senate Bill 111 (Act 462) was signed May 11, 2026; consumer protection for payments previously rested on the sector-agnostic breach-notification statute (O.C.G.A. § 10-1-912, no fixed notice deadline), federal sectoral regimes (GLBA/HIPAA), and Attorney General enforcement of deceptive-practices and surcharge-disclosure rules. No dedicated APP-fraud reimbursement mandate (as under the UK's PSR) exists in Georgia; fraud recourse relies on federal Reg E/network chargeback mechanisms.

Standing sub-brief · as of 7 July 202699 words · last cycle 2026-09-28

Consumer Protection & APP Fraud

Georgia's sector-agnostic breach-notification statute, O.C.G.A. §10-1-912, requires notice "in the most expedient time possible without unreasonable delay," with no fixed deadline, and mandates nationwide consumer-reporting-agency notice where more than 10,000 residents are affected; no dedicated authorised-push-payment fraud reimbursement mandate exists in Georgia, leaving fraud recourse to federal Regulation E and card-network chargeback mechanisms.

Outlook

The new SB 111 privacy statute (see W1b) now sits alongside this older breach-notification framework, layering consumer-protection obligations without yet extending to a dedicated APP-fraud reimbursement scheme; that gap remains a distinguishing feature relative to jurisdictions with mandatory reimbursement regimes.

Periodic update · new data 2026-09-28

Consumer Protection & APP Fraud

House Bill 945, effective July 1, 2026, created a substantive consumer-protection regime for virtual-currency-kiosk operators in Georgia. Operators must display a mandatory fraud-irreversibility warning before transactions and are subject to an aggregated maximum daily transaction limit of $2,500 for new customers and $10,000 for existing customers. These caps function as a direct APP-fraud mitigation mechanism for a payment channel, cash-to-crypto kiosks, that has been repeatedly implicated in elder and vulnerable-victim fraud typologies nationally.

Georgia's approach is notable for the direct regional comparison it invites. In the same week Georgia's transaction-cap-and-warning model took effect, Tennessee adopted an outright statewide ban on crypto-ATM installation and use. The two states' same-week, opposite-direction responses to the same underlying fraud concern give the payments-regulation community a live natural experiment in whether disclosure-and-limits regulation or outright prohibition is the more effective consumer-protection instrument for this specific fraud vector.

The consumer-protection provisions sit within a nonbank payment-institution and e-money-instrument frame: virtual-currency kiosks function as a prepaid/e-money-adjacent cash-in point, and the daily transaction limits and fraud warnings apply to the operator regardless of whether the underlying money-transmission licence is held by a bank-affiliated or non-bank entity, though in practice Georgia's kiosk operator population is predominantly non-bank.

The practical test for Georgia's model will be whether the transaction caps and mandatory warnings measurably reduce elder-fraud losses through kiosk channels relative to Tennessee's prohibition-based approach, a comparison likely to draw attention from other states considering their own kiosk-specific consumer-protection frameworks over the coming year.

Sources and findings (5 unique sources · R-3/R-4)
  1. [W10-E1] T2 Derived: Confirmed draft_no_legal_forcehttps://www.recordinglaw.com/us-laws/data-privacy-laws/georgia-data-privacy-laws/ re-verified

    Georgia enacted its first comprehensive consumer data privacy law, Senate Bill 111 (Act 462), signed by Governor Kemp on May 11, 2026, giving residents rights to access, correct, delete and opt out of the sale/targeted-advertising use of their personal data, applicable to businesses meeting revenue and data-volume thresholds.

  2. [W10-E2] T1 Derived: Confirmed in_forcehttps://law.justia.com/codes/georgia/title-10/chapter-1/article-34/section-10-1-912/ re-verified

    O.C.G.A. § 10-1-912 requires notice of a security breach involving unencrypted personal information (including financial account/card numbers) in the most expedient time possible without unreasonable delay, with mandatory nationwide consumer-reporting-agency notification if over 10,000 Georgia residents are affected.

  3. [W10-E3] T2 Derived: Confirmed in_forcehttps://practiceguides.chambers.com/practice-guides/data-protection-privacy-2026/usa-georgia/trends-and-developments/O24534 re-verified

    Unlike most state breach statutes, Georgia's imposes no fixed notification deadline; third-party data processors must notify the data owner within 24 hours of discovering a breach, and the breach statute provides no private right of action, though violations are enforceable as unlawful practices under the Fair Business Practices Act.

  4. [W10-E4] T1 Derived: Confirmed in_forcehttps://consumered.georgia.gov/ask-ed/2021-03-03/credit-card-surcharges re-verified

    Georgia consumer protection guidance requires clear, upfront disclosure of any credit card surcharge or convenience fee before transaction completion, with failures enforceable as deceptive or false advertising by the Attorney General's Consumer Protection Division.

  5. [W10-E5] T1 Derived: Confirmed in_forcehttps://law.georgia.gov/press-releases/2026-03-03/carr-secures-over-50-million-consumers-and-taxpayers-2025 re-verified

    The Georgia Attorney General's Consumer Protection Division reached more than 715,600 individuals through consumer education/outreach in 2025 and secured over $50 million for consumers and taxpayers, part of its active posture on financial-fraud and scam protection.