Sensitive personal information
By Gareth HoyleLast updated How we research
Sensitive personal information is a CCPA category covering identifiers, precise location, health, biometric, genetic and similar data that carries extra rights and limits.
Sensitive personal information is a category of personal information that state privacy laws protect more strictly. Under California Civil Code section 1798.140(ae) it includes government ID numbers, account log-ins with credentials, precise geolocation, racial or ethnic origin, citizenship or immigration status, religious beliefs, union membership, the contents of mail, email and texts, genetic data, neural data, biometric data used for identification, and health and sex life data.
What extra rules apply?
California gives consumers the right to limit the use of sensitive personal information. Several other states, including Virginia and Colorado, require opt-in consent before sensitive data is processed. New Jersey's P.L. 2026, c.25 goes furthest: it bars controllers, data brokers and data collectors from selling sensitive data at all.
What does this mean for AI training data?
Sensitive personal information is usually excluded from AI licenses or removed by de-identification before sale. Email archives, chat logs and call recordings often contain it in free text, so a manifest should show how it was found and removed.
The EU and UK equivalent is special category data under Article 9 of the GDPR, which needs both a lawful basis and an Article 9 condition.