--- title: "California privacy law (CCPA): sensitive data" canonical: "https://dposchool.com/state-privacy-laws/state/california/sensitive-data" source: "https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5." text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en-US" publisher: "DPO School" --- California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act, Proposition 24) # California privacy law (CCPA): sensitive data Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review) ## Summary (not the statute text) California uses a 'limit' model rather than opt-in consent: consumers may direct a business to limit its use of sensitive personal information to what is necessary to provide the goods or services they expect. Sensitive personal information covers government identifiers, account log-ins, precise geolocation, racial or ethnic origin, citizenship or immigration status, religious beliefs, union membership, message contents, genetic data, neural data, biometric identification, health, and sex life or sexual orientation. For minors, a business may not sell or share personal information of a consumer it knows is under 16 without opt-in authorization (from the consumer if 13 to 15, from a parent if under 13). ## Key points 1. Definition includes neural data (activity of the central or peripheral nervous system) and citizenship or immigration status. Section: [Cal. Civ. Code § 1798.140(ae)(1)(D), (G)](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5.) 2. Biometric data processed to identify a consumer, and information about health, sex life or sexual orientation, are sensitive. Section: [Cal. Civ. Code § 1798.140(ae)(2)](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5.) 3. Right to limit: use beyond what is necessary for expected goods or services, and other permitted purposes, must stop on request. Section: [Cal. Civ. Code § 1798.121(a)](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5.) 4. A 'Limit the Use of My Sensitive Personal Information' link, a combined link, or an opt-out preference signal must be offered where the right applies. Section: [Cal. Civ. Code § 1798.135(a)(2), (a)(3), (b)](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5.) 5. Opt-in required to sell or share data of consumers known to be under 16; willful disregard of age counts as knowledge. Section: [Cal. Civ. Code § 1798.120(c)](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5.) 6. Processing sensitive personal information (outside narrow employment purposes) requires a risk assessment from 2026-01-01. Section: [Cal. Code Regs. tit. 11, § 7150(b)(2)](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5.) ## Sources - [CCPA statute text effective 2026-01-01 (AB 137, AB 566 update), consolidated by the CPPA](https://cppa.ca.gov/pdf/20260101_ccpa_statute.pdf) [Compare sensitive data across all states](https://dposchool.com/state-privacy-laws/topic/sensitive-data) ## Related GDPR articles Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions. - [Article 9: Processing of special categories of personal data](https://dposchool.com/gdpr/article/9) (sensitive data) ## Status Law as of October 28, 2026. [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed. [Official text of the California statute](https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5.) Reference material, not legal advice. ## Other topics for California - [Applicability](https://dposchool.com/state-privacy-laws/state/california/applicability) - [Consumer rights](https://dposchool.com/state-privacy-laws/state/california/consumer-rights) - [Controller duties](https://dposchool.com/state-privacy-laws/state/california/controller-duties) - [Processors](https://dposchool.com/state-privacy-laws/state/california/processors) - [Enforcement](https://dposchool.com/state-privacy-laws/state/california/enforcement) ## Navigation [US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [California](https://dposchool.com/state-privacy-laws/state/california) / Sensitive data Previous: [Consumer rights](https://dposchool.com/state-privacy-laws/state/california/consumer-rights) Next: [Controller duties](https://dposchool.com/state-privacy-laws/state/california/controller-duties) Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt - JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents