Lowers the thresholds above which controllers of data are subject to regulation when processing personal data of consumers; reduces the threshold from 100,000 to 35,000 consumers for controllers or processors of personal data, other than data used solely for payment transactions; reduces the threshold from 25,000 to 10,000 consumers for controllers or processors that derive 20% percent or more, down from 25%, of annual gross revenue from selling personal data; prohibits controllers from processing sensitive data for targeted advertising or to profile consumers in furtherance of decisions that produce legal effects or effects of similar significance; prohibits selling sensitive data for any reason, with or without a consumer's consent; requires a clear and conspicuous disclosure to consumers that the controller may not sell sensitive data for any reason, or process sensitive data for targeted advertising or to profile consumers in furtherance of decisions that produce legal effects or effects of similar significance.