US CPRA Sensitive Personal Information Limits

Under Section 1798.121, consumers have the right, at any time, to direct a business that collects sensitive personal information about them to limit its use to permitted purposes and to stop other uses or disclosures unless the consumer later consents. In plain English, the business must give consumers a way to limit how sensitive personal information is used and disclosed, and then follow that direction unless an exception applies.

Teams should treat Sensitive Personal Information Limits under the US CPRA as a source-linked operating decision: confirm whether the issue affects threshold status, sensitive personal information, sharing or cross-context advertising, GPC, correction rights, data-broker duties, ADMT, risk assessments, cybersecurity audits, or service-provider contracts, assign the team that can change the process, and keep evidence showing the action and review trigger.

The safest first step is to identify the data category, consumer-facing interaction, sale/share status, sensitive-personal-information issue, and vendor role before assigning the CPRA action.

Useful evidence is not just a privacy policy. Keep the source, threshold notes, request logs, GPC test evidence, notice screenshots, vendor terms, retention logic, and approval trail together.

The common failure pattern is treating every California privacy issue as a generic CCPA notice update instead of checking CPRA amendments, sharing, sensitive data, GPC, and phased CPPA rulemaking.