Applies to for-profit businesses that collect consumers' personal information and meet one of the thresholds: gross annual revenue over $25M, buy/sell/receive/share personal information of 50,000+ consumers annually, or derive 50%+ of annual revenues from selling consumers' personal information.