Skip to content


The CCPA did not explicitly label any data type as being more, or less, “sensitive” than another, although it did confer special data security-related rights on a subset of data types (e.g., Social Security numbers, driver’s license numbers, medical information, etc.).

The CPRA created a new sub-category of personal information that it labels “sensitive personal information.” [1] The sub-category is comprised of twenty specific data fields which include, among other things, the religious beliefs, racial origin, precise geolocation, and sexual orientation of a consumer. Beginning on January 1, 2023, consumers will have a limited right to object to a business’s continued use of sensitive personal information. The statute does not require, however, that a business obtain opt-in consent from a consumer before collecting or utilizing their sensitive personal information.

[1] CPRA, 1798.140(ae).