(1) as used in this statute, 'information that may be used to identify a consumer' means information that may be acquired through the production of a piece of identification as described in 475C.217 (Identification requirement), whether the information is contained in a piece of identification described in 475C.217 (identification requirement) or in a different document or record.

(2) a consumer may not be required to procure for the purpose of acquiring or purchasing a marijuana item a piece of identification other than:

(a) a piece of identification described in 475C.217 (Identification requirement) AND

(b) if the consumer is a registry identification cardholder, a registry identification card.

(3) a marijuana retailer may not record and retain any information that may be used to identify a consumer, except as necessary to make deliveries to consumers pursuant to 475C.205 (Restrictions on delivery or receipt) (3), as required by any rules adopted under 475C.205(3).

(4) a marijuana retailer may not transfer any information that may be used to identify a consumer to any other person

(5)(a) notwithstanding paragraph (3), a marijuana retailer may record & retain the name & contact information of a consumer for the purpose of notifying the consumer of services that the marijuana retailer provides or of discounts, coupons and other marketing information if:

(A) the marijuana retailer asks the consumer whether the marijuana retailer may record & retain the information AND

(B) the consumer consents to the recording & retention of the information

(b) this paragraph doesn't authorize a marijuana retailer to transfer information that may be used to identify a consumer

(6) this statute doesn't apply to deidentified information the documentation & transfer of which is required by the Department of Revenue for purposes of 475C.678 (exemption from tax on retail sale of marijuana items)