Requests to Limit Use and Disclosure of Sensitive Personal Information

What it requires

The request to limit lets a consumer confine a business’s use of their sensitive personal information to what is necessary to provide the goods or services an average consumer would reasonably expect, subject to the narrow exceptions listed in subsection (m). A business that uses or discloses sensitive personal information beyond those purposes must offer two or more designated methods for submitting a request to limit, and one collecting it online must at least offer an interactive form reached through the “Limit the Use of My Sensitive Personal Information” link or the Alternative Opt-out Link. Sensitive personal information collected or processed without the purpose of inferring characteristics about the consumer is outside the right.

Regulation text

(a) The unauthorized use or disclosure of sensitive personal information creates a heightened risk of harm for the consumer. The purpose of the request to limit is to give consumers meaningful control over how their sensitive personal information is collected, used, and disclosed. [...] Sensitive personal information that is collected or processed without the purpose of inferring characteristics about a consumer is not subject to requests to limit. (b) A business that uses or discloses sensitive personal information for purposes other than those set forth in subsection (m) shall provide two or more designated methods for submitting requests to limit. [...] (1) A business that collects sensitive personal information from consumers online shall, at a minimum, allow consumers to submit requests to limit through an interactive form accessible via the “Limit the Use of My Sensitive Personal Information” link or the Alternative Opt-out Link.

California Consumer Privacy Act / California Privacy Rights Act, § 7027Read the full section from California Privacy Protection Agency (CalPrivacy)