1. Controlled or processed the personal data of at least 35,000 consumers (excluding personal