Definitions: Sensitive Personal Information

What it requires

Subdivision (bbb) is the operative definition of sensitive personal information for the CCPA regulations, and since the CPPA’s CCPA Updates rulemaking took effect on January 1, 2026 it reaches further than the statutory list in Civ. Code § 1798.140(ae). Alongside government identifiers, account credentials, precise geolocation, racial or ethnic origin, religious or philosophical beliefs, union membership, the contents of mail and messages, genetic and neural data, biometric identification, and health, sex life, or sexual orientation data, paragraph (4) adds all personal information of consumers the business has actual knowledge are less than 16 years of age — and a business that willfully disregards a consumer’s age is deemed to have had that knowledge. Because § 7014 keys the Notice of Right to Limit and the “Limit the Use of My Sensitive Personal Information” link to this definition, a business that learns a visitor is under 16 and uses that data beyond the § 7027(m) purposes owes a link it may not have owed before 2026.

Legal text (excerpt)

(bbb) “Sensitive personal information” means: [...] (4) Personal information of consumers that the business has actual knowledge are less than 16 years of age. A business that willfully disregards the consumer’s age shall be deemed to have had actual knowledge of the consumer’s age.

Primary source