US CPRA Sensitive Personal Information Limits

Classify the data under Civil Code section 1798.140 and regulation section 7001, then map each use and disclosure to a permitted purpose in section 7027(m). The permitted-purpose analysis turns on what the business does with the information, not only on the category name. Account credentials used to authenticate a consumer may fit a permitted service purpose, while using the same information for an unrelated inference or advertising purpose may trigger the right.

The right to limit lets a consumer restrict use and disclosure to the permitted purposes; it is not a deletion request or a blanket opt-out from all processing. If the business uses or discloses the information beyond those purposes, it must provide the required limit method and honor a request without identity verification. It must stop the restricted use or disclosure as soon as feasibly possible and no later than 15 business days, notify applicable service providers, contractors, and third parties, and wait at least 12 months before asking the consumer to consent to the previously restricted use or disclosure.

Privacy should own the category and purpose classification and the consumer response. Product and engineering should own the public interface and system restriction. Procurement or vendor management should own downstream instructions, and legal should review disputed classifications or exceptions. Assign one case owner to track the 15-business-day implementation deadline across those teams.

The evidence record should connect the consumer's choice to the systems and recipients affected by it. Keep the category-and-purpose map, notice version, request timestamp, system change, recipient instruction, confirmation, exception rationale, reviewer, and dated test together.

The right to limit is separate from deletion and from the opt-out of sale or sharing. It does not require a business to stop uses within section 7027(m), and a service provider's involvement does not authorize a purpose outside that list. Publicly available information and information outside the statutory sensitive categories do not become sensitive personal information merely because a business regards them as confidential.

Check the definition carefully at its boundaries. Message contents count only when the business is not the intended recipient, and precise geolocation has a statutory meaning. Biometric information is sensitive only when processed to identify a consumer uniquely; the separate right-to-limit test also asks whether the business processes information to infer characteristics. Reassess when a purpose, inference, recipient, advertising use, retention period, interface, or contract changes.

A right-to-limit exception does not remove the separate risk-assessment duty. Under the regulations effective January 1, 2026, a business generally must assess processing of sensitive personal information before it begins. A narrow exception covers employee or independent-contractor information processed solely and specifically for listed compensation, work-authorization, benefits, reasonable-accommodation, or wage-reporting purposes. Covered processing already underway before January 1, 2026, must be assessed by December 31, 2027; assessments must be reviewed at least every three years and updated within 45 calendar days after a material change.

Build the control at the purpose and recipient level. A data field may remain available for a permitted account-security use while being blocked from cross-context behavioral advertising, profiling, or another non-permitted purpose. The implementation should prevent the restricted use without disabling a permitted use the consumer still expects.

Test the public request method, the 15-business-day system change, profile and device behavior, downstream instructions, the 12-month consent rule, and the privacy-policy explanation. A closed support ticket does not prove that the system and recipients stopped the restricted use.