# Regulatory Standards — CPRA Sensitive Personal Information

## Primary Legislation

### Cal. Civ. Code §1798.121 — Consumers' Right to Limit Use and Disclosure of Sensitive PI

- §1798.121(a): Consumer right to direct a business that collects sensitive PI to limit its use to specified purposes
- §1798.121(b): Business must comply with consumer's direction; restrict processing to enumerated purposes
- §1798.121(c): Business not obligated to provide the limit right if it only uses/discloses sensitive PI for permitted purposes and discloses this in privacy notice
- §1798.121(d): "Limit the Use of My Sensitive Personal Information" link requirement

### Cal. Civ. Code §1798.140(ae) — Definition of Sensitive PI

Enumerates the categories:
1. Government identifiers (SSN, driver's license, state ID, passport)
2. Account log-in with security credentials
3. Precise geolocation (within 1,850-foot/564-meter radius)
4. Racial or ethnic origin
5. Religious or philosophical beliefs
6. Union membership
7. Contents of mail/email/text (where business is not intended recipient)
8. Genetic data
9. Biometric information for unique identification
10. Health information
11. Sex life or sexual orientation data

### Cal. Civ. Code §1798.135(a)(2) — Link Requirements

Business must provide a clear and conspicuous link titled "Limit the Use of My Sensitive Personal Information" on the homepage of its internet website or the download page of its mobile application.

### Cal. Civ. Code §1798.100(a) — Notice at Collection

Requires disclosure at or before the point of collection of the categories of sensitive PI to be collected, the purposes, and whether PI is sold or shared.

## CPPA Implementing Regulations

### 11 CCR §7026 — Requests to Limit Use of Sensitive PI

- §7026(a): Link placement and labeling requirements
- §7026(b): Business may use a single combined link for opt-out and limit ("Your Privacy Choices" with CPPA-approved icon)
- §7026(c): Processing requirements — no verification needed

### 11 CCR §7027 — Alternative Combined Link

Permits a single link labeled "Your Privacy Choices" or "Privacy Options" accompanied by the CPPA-approved opt-out preference icon, combining the opt-out of sale/sharing and the limit of sensitive PI functionality.

## Federal Comparisons

### HIPAA (45 CFR Parts 160, 164)

Health information under CPRA sensitive PI partially overlaps with HIPAA Protected Health Information (PHI). Key distinction: CPRA applies to businesses not covered by HIPAA (non-covered entities and non-business associates). A business may be subject to both regimes if it is a covered entity or business associate under HIPAA and also meets CCPA/CPRA thresholds.

### Genetic Information Nondiscrimination Act (GINA) — 42 U.S.C. §2000ff

Prohibits use of genetic information in employment and health insurance decisions. CPRA's sensitive PI category for genetic data provides additional consumer rights beyond GINA's anti-discrimination protections.

### Illinois Biometric Information Privacy Act (BIPA) — 740 ILCS 14

BIPA provides a private right of action for unauthorized collection/use of biometric data. CPRA's biometric sensitive PI category creates a parallel regulatory framework in California without a private right of action (except for data breach claims under §1798.150).

## Industry Guidance

### IAPP Guide to CPRA Sensitive Personal Information (2023)

The International Association of Privacy Professionals published guidance noting that the CPRA sensitive PI framework represents a "hybrid approach" — neither the prohibitive model of GDPR Article 9 nor a fully permissive model, but a consumer-directed limitation mechanism.

### CPPA FAQ on Sensitive PI (Updated 2024)

The CPPA clarified that:
- Precise geolocation means data derived from a device (not self-reported address)
- The 1,850-foot radius is measured at the point of data collection/derivation
- Biometric data collected but not used for identification (e.g., step count from fitness tracker) may not qualify as sensitive PI
- Account credentials must include both the identifier and the security element to qualify