What counts as personal and sensitive personal information under the US CCPA?
Personal information includes identifiers, customer records, protected characteristics, commercial information, biometric information, internet activity, geolocation, sensory information, employment information, education information, inferences, and when the linkability test is met. It can exist in physical, digital, compressed, encrypted, metadata, or AI-system formats.
includes government identifiers; account credentials that allow access; precise geolocation; racial or ethnic origin; citizenship or immigration status; religious or philosophical beliefs; union membership; contents of communications when the business is not the intended recipient; genetic data; neural data; biometric information processed to uniquely identify a consumer; and collected and analyzed information concerning health, sex life, or sexual orientation. The regulations also include personal information of consumers the business actually knows are under 16; willful disregard of age counts as actual knowledge.
Some elements are conditional. An account log-in, financial account, debit-card, or credit-card number is sensitive when combined with the security code, password, or credentials that permit account access. Biometric information is sensitive when processed to uniquely identify a consumer. Communication contents have an intended-recipient qualification. Precise geolocation means device-derived data used or intended to locate a consumer within an area no larger than a circle with a radius of 1,850 feet.
Publicly available information, lawfully obtained truthful information of public concern, deidentified information, and aggregate consumer information are outside the personal-information definition when the statutory conditions are met. A public-web label alone is insufficient: the statute identifies government records, information the business reasonably believes the consumer or widely distributed media lawfully made public, and information disclosed to another person without restriction to a specific audience. Biometric information collected without the consumer's knowledge is not publicly available.
Classification does not decide every downstream right by itself. A business must disclose sensitive categories in notices and assess applicable security and risk duties, but the right to limit applies only to uses or disclosures outside the purposes allowed by Civil Code section 1798.121 and section 7027. For example, proportionate use to perform a requested service, resist fraud, protect physical safety, or verify identity may fall within a listed purpose.
- Apply the consumer-or-household linkability test before assigning a category.
- Use the statute's specific category terms in notices and rights responses, then add enough detail for a meaningful understanding.
- Record the condition that makes a field sensitive, such as credentials, precise location, intended recipient, unique identification, or collection and analysis.
- Test exclusions separately; information found online is not automatically publicly available under the CCPA.
- Connect the result to notice, access, deletion, correction, security, retention, sale or sharing, right-to-limit, risk-assessment, and audit workflows as applicable.
What is personal information under the CCPA?
Personal information is information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a California consumer or household. The test covers identifiers, activity, transactions, location, sensory and employment data, inferences, and other listed categories when the required link exists.
What categories count as ?
The list covers government identifiers; qualifying account credentials; precise geolocation; racial or ethnic origin; citizenship or immigration status; religious or philosophical beliefs; union membership; communication contents when the business is not the intended recipient; genetic data; neural data; biometric information processed to uniquely identify a consumer; and collected and analyzed information concerning health, sex life, or sexual orientation. The regulations also include personal information of consumers the business actually knows are under 16, including willful disregard of age.
Is every account number or biometric signal ?
No. An account log-in or financial, debit-card, or credit-card number is sensitive in the combination described by the statute with a security code, password, or credentials that allow access. Biometric information enters the sensitive category when it is processed to uniquely identify a consumer. The broader personal-information definition may still cover the data even when the sensitive condition is not met.
What does precise geolocation mean under the CCPA?
Precise geolocation is device-derived data used or intended to locate a consumer within a geographic area equal to or smaller than a circle with a radius of 1,850 feet. Broader location data can still be personal information even when it does not meet this sensitive-personal-information threshold.
Is information posted online automatically publicly available?
No. The statutory routes cover government records; information a business reasonably believes the consumer or widely distributed media lawfully made available to the general public; and information disclosed to another person without restriction to a specific audience. Biometric information collected by a business without the consumer's knowledge is not publicly available.
Does every use of create a right to limit?
No. The right to limit applies when a business uses or discloses outside the purposes allowed by Civil Code section 1798.121 and section 7027. Proportionate processing for requested goods or services, security and fraud resistance, physical safety, specified short-term use, service performance, quality or safety, and processing without inferring characteristics can fall within listed purposes.
What are deidentified and aggregate consumer information?
Deidentified information cannot reasonably be used to infer information about or link to a consumer when the business uses required safeguards, publicly commits not to reidentify it except to test deidentification, and binds recipients to the same restrictions. Aggregate consumer information concerns a group whose individual identities have been removed and is not linked or reasonably linkable to a consumer or household. Pseudonymous data is not automatically either category.
Citations (2)
- California Privacy Protection Agency FAQ
Official plain-language explanation of personal and sensitive personal information and consumer rights.
- California Civil Code section 1798.140
Binding definitions, category lists, formats, linkability test, precise geolocation, and exclusions.