If sensitive PI is collected, specific uses disclosed; consumers can limit use
Why it matters
CPRA added § 1798.121 establishing a new category of sensitive personal information (SPI) — Social Security numbers, precise geolocation, financial account credentials, biometric identifiers, health data, racial and ethnic origin, and a few others defined in Civil Code § 1798.140(ae) — with heightened protections. Collecting SPI without a separate privacy policy disclosure is a violation. Using SPI for profiling or cross-context behavioral advertising without offering a "Limit the Use of My Sensitive Personal Information" mechanism is a separate violation. Precise geolocation (within 1,850 feet via navigator.geolocation) is the most common SPI collected by AI-built apps that don't realize it qualifies.
Severity rationale
Low because SPI violations require both collection and either missing disclosure or impermissible use — the combination is detectable but depends on the application's specific data flows.
Remediation
Search your codebase for navigator.geolocation, SSN field names, financial account inputs, and biometric API calls to identify SPI collection points. Add a Sensitive Personal Information section to your privacy policy for each category found.
## Sensitive Personal Information (add to privacy policy per CPRA § 1798.121)
We collect the following sensitive personal information:
- Precise geolocation — used only to show nearby service locations
We use sensitive personal information solely as necessary to deliver the requested
service, as permitted under California Civil Code § 1798.121. We do not use
sensitive PI for inferring characteristics or cross-context behavioral advertising.
To limit our use of your sensitive personal information, contact: privacy@example.com
If SPI is used only for the permitted purposes listed in § 1798.121 — service delivery, security, quality control — you do not need to build a separate "Limit Use" UI, but the policy disclosure is mandatory regardless.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the CCPA/CPRA Readiness Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- ccpa · §1798.121 — Right to limit use of sensitive personal information
- ccpa · §1798.140(ae) — Sensitive personal information — definition (SSN, financial, biometric, health, geolocation, etc.)
- gdpr · Art. 9 — Processing of special categories of personal data
- hipaa · §164.502(b) — Minimum necessary — limitation on uses of protected health information
Taxons
History
- 2026-04-18·v1.0.0·Initial import from ccpa-readiness·automated