Senate Bill 166 aims to enhance consumer data protection by establishing specific rights for individuals regarding their personal data. The bill defines key terms such as "controller," which refers to entities that determine the purpose and means of processing personal data, and sets thresholds for applicability based on the number of consumers served and revenue derived from data sales. It grants consumers rights to access, correct, delete, and opt out of the processing of their personal data, particularly for targeted advertising and sales. Additionally, the bill mandates that controllers provide a privacy notice detailing the categories of personal data processed and the purposes for which it is used, while also prohibiting discrimination against consumers exercising their rights.

The bill also outlines the responsibilities of controllers and processors, including the establishment of secure means for consumers to submit requests and the requirement to respond to such requests without undue delay. It introduces penalties for violations, with fines of up to $10,000 per infraction, and stipulates that the Department of Agriculture, Trade and Consumer Protection (DATCP) and the Department of Justice have exclusive enforcement authority. Furthermore, the bill prohibits local governments from enacting their own regulations on personal data collection and processing, thereby creating a uniform standard across the state.