Skip to content

No.

The CPRA created a new sub-category of personal information that it labels “sensitive personal information.” [1] The sub-category is comprised of twenty specific data fields which include, among other things, the religious beliefs, racial origin, precise geolocation, and sexual orientation of a consumer. Beginning on January 1, 2023, consumers will have the right to instruct ”at any time” a business to “limit its use of the consumer’s sensitive personal information . . . .”[2] This right to object to the continued use of sensitive personal information is not absolute, however. If a consumer instructs a business to limit the use of their sensitive personal information, a business may still use or disclose the information for, among other things, the following purposes:

  1. Performing services requested by the consumer, so long as the use of the data is reasonably expected by an average consumer as necessary to perform such services.[3]
  2. Providing goods requested by the consumer, so long as the use of the data is reasonably expected by an average consumer as necessary to provide such goods.[4]
  3. Helping to ensure the security and integrity of the business, or the security and integrity of the personal information, to the extent that the use of the information is “reasonably necessary and appropriate.”[5]
  4. Providing non-personalized advertising shown as part of a consumer’s current interaction with the business, so long as the data is not provided to a third party and is not used to build a marketing profile about the consumer.[6]
  5. Servicing accounts on behalf of the business. [7]
  6. Providing customer service for a business.[8]
  7. Processing or fulfilling orders. [9]
  8. Verifying customer information. [10]
  9. Processing payments. [11]
  10. Providing financing.[12]
  11. Providing analytical services. [13]
  12. Providing data storage to a business. [14]

Verifying the quality or safety of certain services or devices.[15]

[1] CPRA, 1798.140(ae).

[2] CPRA, 1798.121(a).

[3] CPRA, 1798.121(a).

[4] CPRA, 1798.121(a).

[5] CPRA, 1798.121(a), 1798.140(e)(2).

[6] CPRA, 1798.121(a); 1798.140(e)(4).

[7] CPRA, 1798.121(a); 1798.140(e)(5).

[8] CPRA, 1798.121(a); 1798.140(e)(5).

[9] CPRA, 1798.121(a); 1798.140(e)(5).

[10] CPRA, 1798.121(a); 1798.140(e)(5).

[11] CPRA, 1798.121(a); 1798.140(e)(5).

[12] CPRA, 1798.121(a); 1798.140(e)(5).

[13] CPRA, 1798.121(a); 1798.140(e)(5).

[14] CPRA, 1798.121(a); 1798.140(e)(5).

[15] CPRA, 1798.121(a); 1798.140(e)(8).