What is 'sensitive personal information' under the CCPA and the right to limit it?

The CCPA treats some data as more dangerous than the rest, and gives it a separate rulebook. If you collect a Social Security number, a precise location, or anything about someone's health, you are likely holding sensitive personal information, and a distinct consumer right attaches to it. Many businesses handle this category without realizing the CCPA singles it out.

What is sensitive personal information under the CCPA?

Cal. Civ. Code Section 1798.140(ae) defines it as a specific, closed list. It covers a consumer's Social Security, driver's license, state identification card, or passport number; an account log-in or a financial account, debit, or credit card number together with any access code or password; precise geolocation; racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership; the contents of mail, email, and text messages where your business is not the intended recipient; and genetic data. It also covers biometric information processed to identify a consumer, and personal information collected and analyzed about a consumer's health, sex life, or sexual orientation. If a category is genuinely publicly available, it is not treated as sensitive.

What is the right to limit its use?

Cal. Civ. Code Section 1798.121 gives a consumer the right, at any time, to direct a business to use their sensitive personal information only for what is necessary to deliver the goods or services an average consumer would expect, plus a narrow set of permitted operations like security and short-term use. If a business uses sensitive data beyond those purposes, for example to build advertising profiles, the consumer can tell it to stop. This is a use limit, not a deletion right, so the business can keep providing the service while restricting how the data is exploited.

How do you honor the right?

Cal. Civ. Code Section 1798.135 sets the mechanics. A business that uses sensitive personal information beyond the permitted purposes has to post a clear and conspicuous "Limit the Use of My Sensitive Personal Information" link on its homepage, alongside the "Do Not Sell or Share My Personal Information" link. As with the sale opt-out, a business that honors an opt-out preference signal for every consumer can rely on that instead of the separate link. You also owe a notice at collection that names the sensitive categories you gather and why.

Where this sits with your other CCPA duties

The right to limit is the sensitive-data counterpart to the broader opt-out. If you also sell or share data, review the Do Not Sell or Share right, which uses its own homepage link. Health data specifically can trigger other regimes too, including Washington's My Health My Data Act. To confirm the CCPA applies to you at all, start with does California's CCPA apply to your business.

Next step

If you collect IDs, precise location, payment credentials, or health signals, the free 2-minute Obligation Scan checks whether you hold sensitive personal information and lists the limit-link, notice, and use-restriction steps the CCPA requires, so a data category you overlooked does not become a violation. The US state privacy laws hub shows how California's sensitive-data rules compare with other states.