Relating to requirements that apply to persons that process consumer personal data.

Lowers the thresholds above which, in applicable circumstances, controllers are subject to regulation in processing consumers' personal data. Prohibits controllers from processing sensitive data for the purposes of targeted advertising or profiling a consumer in furtherance of decisions that produce legal effects or effects of similar significance. Prohibits a controller from selling sensitive data for any reason.