We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

Artifact GuideUSPersonal and Sensitive PI Categories

US CCPA Personal and Sensitive PI Categories

Classify personal information and sensitive personal information by the statutory definitions, then map collection, use, disclosure, retention, sale, sharing, limitation rights, and security controls.

Ground decisions in the consolidated CCPA statute and the regulations effective through January 1, 2026; preserve the trigger, owner, evidence, deadline, and reassessment condition for each control.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Jul 24, 2026
Sections
4

Structured answer sets in this page tree.

Primary sources
6

Cited legal and guidance references.

Publication metadata
Sorena AI
Published May 9, 2026
Updated Jul 24, 2026
Overview

Classify information by what it can reasonably identify, describe, or link to a consumer or household, not by its database label. is a defined subset of with additional notice and limit-use consequences. Use this guide to separate covered data from statutory exclusions and to connect each category to the controls it changes.

Section 1

What should teams decide about Personal and Sensitive PI Categories under the US CCPA?

Start by identifying what the CCPA treats as and . Personal information is information that identifies, relates to, or could reasonably be linked to a particular consumer or household, and the CCPA gives examples such as a name, email address, records of products purchased, internet browsing history, geolocation data, fingerprints, and inferences about preferences and characteristics.

is a narrower set that includes government identifiers; account credentials or financial-account access information; ; racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, union membership, and mail, email, or text contents when the business is not the intended recipient; genetic data; biometric information processed to identify a consumer; and collected and analyzed about health, sex life, or sexual orientation. Under the regulations effective January 1, 2026, it also covers personal information of consumers the business has actual knowledge are under 16.

Publicly available, lawfully obtained truthful information that is a matter of public concern, and deidentified or aggregate consumer information are excluded from under specific statutory conditions. A record does not become excluded merely because it can be found online or because direct identifiers were removed.

  • Identify the actual data element, how it is obtained, the consumer or household link, and whether it is used to infer another characteristic.
  • Check the sensitive-personal-information definition element by element; sensitivity in ordinary speech is not the legal test.
  • Test any public-information or deidentification exclusion against all statutory conditions and document the source and safeguards.
  • Map the final category to notice, access, deletion, correction, retention, security, sale, sharing, and limit-use controls.
Sources for this answer
California Civil Code section 1798.100
Supports the notice-at-collection rule requiring businesses to disclose personal-information and sensitive-personal-information categories, purposes, sale or sharing, and retention.
California Privacy Protection Agency FAQ - personal and sensitive personal information
Non-binding CPPA FAQ explaining the public-facing distinction between personal information, sensitive personal information, and the right to limit sensitive-information use.
California Civil Code section 1798.140
Provides the statutory definitions that determine whether data falls into CCPA personal-information or sensitive-personal-information categories.
California CCPA statute and regulations effective January 1, 2026
Section 7001 adds personal information of consumers the business actually knows are under 16 to sensitive personal information.
Section 2

Who should own Personal and Sensitive PI Categories, and what evidence should prove the decision?

Data owners should describe the field and use; privacy or legal should approve classification and exclusions; engineering and security should map systems and safeguards; and product, marketing, and procurement should document recipients and sale or sharing.

Keep a data dictionary, sample values or schemas that avoid unnecessary live , source, purpose, retention, recipients, inference logic, classification rationale, and links to the notices and rights workflows affected.

  • Record whether is used only for purposes allowed by the regulations or whether the right to limit must be offered.
  • Treat inferences as their own data product when the business creates a profile about preferences, characteristics, behavior, attitudes, abilities, or similar traits.
  • Reclassify when a field is combined with new identifiers, used for identification, or analyzed to reveal a protected characteristic.
  • Review category maps when collection, models, vendors, retention, or disclosure purposes change.
Sources for this answer
California Privacy Protection Agency FAQ
Non-binding CPPA FAQ identifying the CCPA rights tied to personal-information and sensitive-personal-information categories.
California Civil Code section 1798.100
Supports category evidence by requiring businesses to disclose purposes, sale or sharing status, and retention for each category.
California CCPA statute and regulations effective January 1, 2026
Sections 7002 and 7012 support data-minimization evidence by tying category handling to reasonably necessary and proportionate collection, use, retention, and sharing.
Section 3

Which edge cases should teams check before relying on a Personal and Sensitive PI Categories decision?

Biometric information is when processed for the purpose of uniquely identifying a consumer. A photograph, voice recording, or keystroke pattern still may be even when that sensitive-category test is not met.

means a location derived from technology that identifies a consumer within a geographic area no larger than a circle with a radius of 1,850 feet, subject to the statutory exception for certain content of communications. General city or region information may remain without meeting that precise-geolocation test. Message content is sensitive only when the business is not the intended recipient, while metadata may fit other personal-information categories.

  • Do not classify encrypted or hashed identifiers as deidentified without the required technical and organizational measures against reidentification.
  • Do not omit household information merely because no named individual is present.
  • Do not treat an inference as outside scope because its underlying source data was public.
  • Do not assume a sectoral exemption covers the entire entity; many CCPA exemptions attach to specified information or activities.
Sources for this answer
California Civil Code section 1798.100
Supports edge-case review when new category collection, incompatible secondary use, sale or sharing, or retention changes require updated notice.
California Privacy Protection Agency FAQ
Non-binding CPPA FAQ listing examples of sensitive personal information tied to the right to limit.
California Civil Code section 1798.140
Supports category boundary review because CCPA definitions decide whether records, identifiers, inferences, or sensitive data are in scope.
California CCPA statute and regulations effective January 1, 2026
The consolidated official text supports the 1,850-foot precise-geolocation boundary and the current sensitive-personal-information definition.
Section 4

How should teams operationalize Personal and Sensitive PI Categories with proportionate controls?

Classify at field and use-case level, then group fields into consumer-facing CCPA categories for notices and rights responses. The internal record should remain specific enough to reproduce the classification and locate the data.

Apply a change trigger whenever a team adds an identifier, creates an inference, changes a biometric or location use, combines data sets, or changes a recipient or purpose.

  • Describe the data element, source, linkability, processing purpose, and any inferred characteristic.
  • Apply the personal-information definition, then the sensitive subset and each claimed exclusion.
  • Record systems, retention, recipients, sale or sharing, allowed sensitive uses, and affected rights.
  • Update notices and controls before introducing a new category or materially different use.
Sources for this answer
California Civil Code section 1798.100
Operational support for mapping each personal-information category to purpose, retention, and compatibility controls.
California Privacy Protection Agency FAQ
Non-binding CPPA FAQ connecting sensitive-information categories to consumer limit-use choices.
California Civil Code section 1798.140
Operational support for classifying records against the statutory personal-information and sensitive-personal-information definitions.
Recommended next step

Turn US CCPA Personal and Sensitive PI Categories into assigned work

This US CCPA guide turns Personal and Sensitive PI Categories into owners, evidence requests, review checkpoints, and reusable operating records in Sorena.

Assessment workflow
Open Assessment Autopilot for US CCPA

Turn Personal and Sensitive PI Categories into scoped questions, evidence fields, and review tasks.

Explore next step
Research workflow
Review US CCPA source evidence

Use Research Copilot to answer follow-up questions with cited source material.

Explore next step
Talk to Sorena
Talk through implementation

Review scope, evidence, owners, and the next compliance actions with Sorena.

Explore next step
Primary sources

References and citations

California Civil Code section 1798.100
leginfo.legislature.ca.gov
Referenced sections
  • Operational support for mapping each personal-information category to purpose, retention, and compatibility controls.
"reasonably necessary and proportionate"
California Civil Code section 1798.100
leginfo.legislature.ca.gov
Referenced sections
  • Supports category evidence by requiring businesses to disclose purposes, sale or sharing status, and retention for each category.
"categories of sensitive personal information to be collected"
California Civil Code section 1798.140
leginfo.legislature.ca.gov
Referenced sections
  • Operational support for classifying records against the statutory personal-information and sensitive-personal-information definitions.
"sensitive personal information"
Related guides

Explore more topics

California Data Brokers: CCPA, Registration, and DROP Duties
Decide whether a CCPA business is also a California data broker and track registration, privacy metrics, DROP deletion, vendor, and audit duties.
CCPA Consumer Rights Workflow: Requests, Clocks, and Evidence
Route CCPA requests by right, apply the correct verification and response rule, coordinate downstream action, and retain a clear decision record.
CCPA Contract Classification: Service Provider or Third Party?
Classify CCPA recipients from their actual processing and contracts, then document the clauses, restrictions, monitoring, and opt-out consequences.
CCPA Dark Patterns: Rules, Examples, and Review Checklist
Check a CCPA privacy interface for clear language, symmetrical choices, unnecessary steps, and other designs that can invalidate consent.
CCPA Deadlines and Compliance Calendar
Track CCPA request clocks, annual duties, DROP dates, and phased 2026-2030 deadlines for risk assessments, ADMT, and cybersecurity audits.
CCPA Do Not Sell or Share Guide
Classify CCPA sales and sharing, provide valid opt-out methods, honor preference signals, stop disclosures within 15 business days, and notify recipients.
CCPA Do Not Sell or Share: Implementation and Testing
Implement CCPA sale-or-sharing opt-outs across links, GPC, consent state, ad tech, recipients, confirmation, privacy disclosures, and evidence.
CCPA Do Not Sell or Share: Scope and Implementation
Determine whether a transfer is a CCPA sale or sharing, provide the required opt-out path, honor preference signals, and propagate the choice.
CCPA DSAR Workflow: Intake, Verification, and Response
Run CCPA data-subject requests from intake through verification, search, exception review, downstream action, response, and retained evidence.
CCPA Financial Incentives: Notice, Consent, and Data Value
Assess a loyalty, discount, payment, or service program under the CCPA and document notice, opt-in, withdrawal, and data-value requirements.
CCPA Global Privacy Control (GPC): team obligations and technical implementation
Implement Global Privacy Control as a CCPA sale and sharing opt-out across browsers, devices, known accounts, and relevant downstream systems.
CCPA Minors: Opt-In Rules for Consumers Under 16
Apply the CCPA's under-13 parent authorization and age-13-to-15 consumer opt-in rules for sale or sharing of personal information.
CCPA Notice at Collection: Timing, Content, and Examples
Place a CCPA notice where consumers encounter it before collection and disclose categories, purposes, retention, sale or sharing, and required links.
CCPA Opt-Out Signal Workflow: Detect, Apply, and Test GPC
Process CCPA opt-out preference signals across browsers, devices, profiles, accounts, offline data, conflicts, recipients, and confirmation controls.
CCPA Penalties and Fines: Current Amounts
See current CCPA fines, civil penalties, security-breach damages, adjustment rules, and the facts needed before estimating exposure.
CCPA Personal and Sensitive Information Categories
Classify personal and sensitive personal information under the current CCPA, including exclusions and the duties each category can trigger.
CCPA Privacy Policy Template: Required Content and Review
Draft and maintain a CCPA privacy policy covering data practices, rights, request methods, GPC handling, minors, contacts, and the last-updated date.
CCPA Risk Assessments, Cybersecurity Audits, and ADMT
Apply California's regulations effective January 1, 2026 for risk-assessment triggers, phased cybersecurity audits, ADMT rights, evidence, reviews, and CPPA submissions.
CCPA vs CPRA: What Changed and Which Rules Apply
Compare the original CCPA with the CPRA amendments and learn why current California privacy work must use the CCPA as amended, not two separate laws.
CCPA vs GDPR: Scope, Rights, Duties, and Evidence
Compare the California CCPA and EU GDPR by scope, roles, legal basis, rights, advertising transfers, contracts, security, deadlines, and enforcement.
Does the CCPA apply to my business? Threshold guide
Apply the CCPA revenue, data-volume, and sale-or-sharing revenue thresholds, then check California nexus, control, joint ventures, roles, and exemptions.
US CCPA Applicability Test Guide
Apply the CCPA entity-by-entity: test California nexus, for-profit control, current thresholds, related-entity routes, exemptions, and processing roles.
US CCPA Compliance Checklist
A verifiable CCPA checklist for scope, data mapping, notices, rights, opt-outs, contracts, retention, security, risk assessments, audits, ADMT, and evidence.
US CCPA Compliance Guide
Build a CCPA operating model for entity scope, data mapping, notices, rights, opt-outs, contracts, retention, security, assessments, audits, ADMT, and evidence.
US CCPA Dark Patterns Guide
Review CCPA privacy interfaces for plain language, symmetry, minimal steps, neutral presentation, valid consent, and reliable opt-out operation.
US CCPA Data Broker Crossover Guide
Test whether a CCPA business is also a California data broker, then assign registration, metrics, DROP, deletion, downstream, and audit duties.
US CCPA DSAR Verification Guide
Verify CCPA know, delete, correct, and ADMT-access requests with request-specific, secure, minimized methods without adding friction to opt-outs.
US CCPA Enforcement and Penalties Guide
Understand CPPA investigations, Attorney General civil actions, CCPA administrative orders, current penalties, and the limited security-breach private action.
US CCPA Financial Incentives Guide
Decide whether a CCPA financial-incentive rule applies, then document the notice, data-value method, opt-in, withdrawal, and nondiscrimination checks.
US CCPA GPC Signal Guide
Implement Global Privacy Control under the CCPA across browsers, devices, accounts, ad technology, downstream recipients, and consumer notices.
US CCPA Minors Guide
Apply the CCPA opt-in rules for selling or sharing personal information of consumers under 16, including age bands, authorization, notices, and evidence.
US CCPA Notice at collection Guide
Build a CCPA Notice at Collection for online and offline collection points, including categories, purposes, sale or sharing, retention, links, and change control.
US CCPA Privacy Law FAQ
Direct answers on CCPA scope, rights, notices, opt-outs, GPC, minors, sensitive information, financial incentives, and data brokers.
US CCPA Privacy Notices and Disclosures Guide
Choose and maintain each CCPA consumer notice: privacy policy, collection, sale or sharing, sensitive-information limits, financial incentives, and ADMT.
US CCPA Privacy Policy Guide
Build and maintain a CCPA privacy policy covering online and offline practices, 12-month disclosures, consumer rights, request methods, and annual updates.
US CCPA Requirements Guide
Plain-language CCPA requirements covering scope, minimization, notices, rights, opt-outs, contracts, security, records, risk assessments, audits, and ADMT.
US CCPA Scope and Thresholds Guide
CCPA scope and threshold reference covering the current $26,625,000 revenue threshold, the 100,000-consumer-or-household test, related entities, and exemptions.
US CCPA Service Provider Contractor and Third Party Contracts Guide
Classify CCPA recipients and check the distinct contract terms for service providers, contractors, and third parties before disclosing personal information.
US CCPA Service Provider Contractor Contracts Guide
Check CCPA service-provider and contractor agreements for specific purposes, use restrictions, consumer-request support, subcontractors, and remediation.
US CCPA Thresholds Guide
Apply the CCPA business thresholds per legal entity, including the 2025 CPI-adjusted revenue amount, volume and sale-or-sharing tests, and control routes.
What must a CCPA privacy policy include?
A practical guide to CCPA privacy-policy content, placement, annual updates, consumer rights, request methods, and supporting evidence.
What must CCPA service-provider contracts include?
Required CCPA contract terms, role checks, subcontractor flow-downs, oversight rights, and evidence for service providers and contractors.
What should teams do about consumer request verification under the CCPA?
Choose a proportionate CCPA verification method for know, delete, and correct requests without collecting unnecessary identity data.
When does the CCPA require risk assessments or cyber audits?
CCPA triggers, deadlines, evidence, retention, and submission duties for risk assessments and annual cybersecurity audits.