The CPRA created a new sub-category of personal information that it labels “sensitive personal information.”[1] The sub-category is comprised of twenty specific data fields which include, among other things, the religious beliefs, racial origin, precise geolocation, or sexual orientation of a consumer. Beginning on January 1, 2023, consumers will have the right to instruct, ”at any time,” a business to “limit its use of the consumer’s sensitive personal information . . . .”[2]
The right to object to the continued use of sensitive personal information is not absolute. According to the CPRA, if a business receives an instruction to limit its use of sensitive personal information, the business is still permitted to use the sensitive personal information for some forms of advertising. Such advertising, however, must be “non-personalized” and can only be shown as part of a consumer’s “current interaction with the business.”[3] As a result, behavioral or targeted advertising that is personalized for a consumer may no longer be permitted.
[1] CPRA, 1798.140(ae).
[2] CPRA, 1798.121(a).
[3] CPRA, 1798.121(a); 1798.140(e)(4).