Consumers’ Right to Limit Use and Disclosure of Sensitive Personal Information

What it requires

CPRA added a consumer right to limit how businesses use or disclose sensitive personal information (government identifiers, account and financial credentials, precise geolocation, racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, union membership, the contents of mail and messages, genetic data, biometric identification, health, sex life or sexual orientation, and, since SB 1223 took effect January 1, 2025, neural data) to uses necessary to perform services or provide goods reasonably expected by an average consumer. The right reaches less than that clause alone suggests, because subdivision (a) permits two further categories of use: the business purposes named in § 1798.140(e)(2), (4), (5), and (8) (helping to ensure security and integrity, short-term transient use, performing services on the business’s behalf, and verifying or maintaining the quality or safety of a service or device) and whatever the § 1798.185(a)(18)(C) regulations authorize. The full statutory category list lives in § 1798.140(ae), and the regulations add one more: since January 1, 2026, 11 CCR § 7001(bbb)(4) treats all personal information of a consumer the business actually knows is under 16 as sensitive personal information. Businesses using sensitive PI for other purposes must notify consumers and provide a mechanism to limit such use. AB 1542 (Ward), which would have added a subdivision (e) barring a business, service provider, or contractor from selling or sharing sensitive personal information to a third party, was vetoed by Governor Newsom on September 27, 2026, and is not law. The right to limit, not a prohibition, is what § 1798.121 grants.

Statute text

(a) A consumer shall have the right, at any time, to direct a business that collects sensitive personal information about the consumer to limit its use of the consumer's sensitive personal information to that use which is necessary to perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services, to perform the services set forth in paragraphs (2), (4), (5), and (8) of subdivision (e) of Section 1798.140, and as authorized by regulations adopted pursuant to subparagraph (C) of paragraph (18) of subdivision (a) of Section 1798.185. A business that uses or discloses a consumer's sensitive personal information for purposes other than those specified in this subdivision shall provide notice to consumers, pursuant to subdivision (a) of Section 1798.135 [...] (b) A business that has received direction from a consumer not to use or disclose the consumer's sensitive personal information, except as authorized by subdivision (a), shall be prohibited [...] from using or disclosing the consumer's sensitive personal information for any other purpose [...] (d) Sensitive personal information that is collected or processed without the purpose of inferring characteristics about a consumer is not subject to this section [...]

California Consumer Privacy Act / California Privacy Rights Act, § 1798.121Read the full section from California Privacy Protection Agency (CalPrivacy)

How Privisy tests it