The CPRA created a new sub-category of personal information that it labels “sensitive personal information.”[1] The sub-category is comprised of twenty specific data fields which include, among other things, the religious beliefs, racial origin, precise geolocation, or sexual orientation of a consumer. Beginning on January 1, 2023, consumers will have the right to instruct ”at any time” a business to “limit its use of the consumer’s sensitive personal information . . . .”[2]

The right to object to the continued use of sensitive personal information is not absolute. According to the CPRA, if a business receives an instruction to limit its use of sensitive personal information, the business is still permitted to request that a company perform services on that same data to provide analytics on its behalf.[3]

[1] CPRA, 1798.140(ae).

[2] CPRA, 1798.121(a).

[3] CPRA, 1798.121(a); 1798.140(e)(5).