DPO SchoolDPO School

California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act, Proposition 24)

California privacy law (CCPA): sensitive data

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

California uses a 'limit' model rather than opt-in consent: consumers may direct a business to limit its use of sensitive personal information to what is necessary to provide the goods or services they expect. Sensitive personal information covers government identifiers, account log-ins, precise geolocation, racial or ethnic origin, citizenship or immigration status, religious beliefs, union membership, message contents, genetic data, neural data, biometric identification, health, and sex life or sexual orientation. For minors, a business may not sell or share personal information of a consumer it knows is under 16 without opt-in authorization (from the consumer if 13 to 15, from a parent if under 13).

Key points

  1. Definition includes neural data (activity of the central or peripheral nervous system) and citizenship or immigration status.

    Section: Cal. Civ. Code § 1798.140(ae)(1)(D), (G)

  2. Biometric data processed to identify a consumer, and information about health, sex life or sexual orientation, are sensitive.

    Section: Cal. Civ. Code § 1798.140(ae)(2)

  3. Right to limit: use beyond what is necessary for expected goods or services, and other permitted purposes, must stop on request.

    Section: Cal. Civ. Code § 1798.121(a)

  4. A 'Limit the Use of My Sensitive Personal Information' link, a combined link, or an opt-out preference signal must be offered where the right applies.

    Section: Cal. Civ. Code § 1798.135(a)(2), (a)(3), (b)

  5. Opt-in required to sell or share data of consumers known to be under 16; willful disregard of age counts as knowledge.

    Section: Cal. Civ. Code § 1798.120(c)

  6. Processing sensitive personal information (outside narrow employment purposes) requires a risk assessment from 2026-01-01.

    Section: Cal. Code Regs. tit. 11, § 7150(b)(2)

Sources

Compare sensitive data across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the California statute

Reference material, not legal advice.