Regulates data brokers, data collectors, and collection and dissemination of certain sensitive information.

The public registry in section 2(b) now covers data brokers and collectors 'engaged in selling or licensing personal data' instead of those 'engaged in processing personal data,' narrowing which entities must be listed.

In section 3(b), three exemptions (for Motor Vehicle Commission sales, consumer reporting agencies under FCRA, and human subjects research) were narrowed from covering 'personal data' to covering only 'sensitive data,' meaning the sensitive-data prohibition now applies more broadly to non-sensitive personal data in those contexts.

The registration fee schedule in section 2(c)(2) now applies to a data broker that 'sells or licenses' personal data rather than one that merely 'possesses' it, meaning the fee trigger is tied to the commercial act of selling or licensing.

Multiple definitions were updated to replace 'controller' with 'data broker or data collector': in 'de-identified data,' 'processing,' 'processor,' and 'publicly available information.' This aligns the bill's terminology with its own defined terms rather than borrowing from P.L.2023, c.266.

In section 2(d)(6) and (7), 'personal identifying information' was replaced with 'personal data,' broadening the scope of breach history and minor-data reporting requirements to cover all personal data rather than only personally identifiable information.

The effective date provision was narrowed: previously all of section 2 was delayed 270 days after enactment, but now only subsection b (the public registry) is delayed. The registration and fee provisions in subsection c will take effect immediately upon enactment.

Section 5 penalty language was restructured so that 'including a controller' applies only to 'data broker' and was struck from the 'data collector' reference, clarifying that data collectors are penalized in their own right without needing the controller qualifier.