California added a sensitive-data tier in 2023, but with an American twist: instead of forbidding processing without consent, it gives consumers a brake pedal. The practical consequence is that SPI compliance is mostly an advertising question, whether identifiers, location, health-adjacent browsing, or inferred characteristics leak into the ad stack beyond what the permitted-purpose safe harbor covers, and the first enforcement actions confirm that reading.
| Provisions | Civ. Code 1798.121, 1798.140(ae) |
|---|---|
| Mechanism | ”Limit the Use of My SPI” right + link |
| Consent needed? | No (California); yes in most other states |
| Regulator | CPPA |
Operating rules
Classify first. Tag SPI fields in your data map, including derived and inferred values: a health-condition inference from content consumption is SPI even if no explicit health field exists. Precise geolocation deserves its own audit given SDK sprawl.
Check the safe harbor honestly. If every SPI use fits the permitted purposes (service delivery, security, transient use, quality), you need no link and limit machinery. The moment SPI feeds behavioral advertising, lookalike modeling, or characteristic inference, the safe harbor is gone. Most companies fail here through their tag manager, not their databases.
Honor limits like opt-outs. Same 15-business-day propagation, same GPC-adjacent automation expectations, same symmetry rules against dark patterns. Requests restrict use to permitted purposes; they do not require deletion.
Build to consent for multistate reach. Colorado, Connecticut, Texas, Oregon, and the Virginia-lineage states require opt-in consent for sensitive data, and their category lists differ at the edges (Oregon adds status as a victim of crime; New Jersey adds financial data). One consent-gated pipeline for the union of categories, documented in your state sensitive-data comparison, beats fifty conditional flows.
Minors are a separate track. Under-16 sale/sharing needs opt-in; under-13 needs parental consent, and COPPA plus the state children’s laws layer on top.
Find out whether your site is already transmitting SPI-adjacent signals, location, health-implying URLs, identifiers, to third parties: run a free scan.