When does the CCPA right to limit apply to your firm?

What counts as sensitive personal information under the CCPA?

Sensitive personal information is a defined list in Civil Code section 1798.140(ae), and it is narrower than many firms assume. The list covers Social Security, driver's license, state ID and passport numbers; account log-ins and financial account, debit card or credit card numbers combined with the code, password or credentials that allow access to the account; precise geolocation; racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs and union membership; the contents of mail, email and text messages unless the business is the intended recipient; genetic data; and neural data. Processing biometric information to identify a person, and information collected and analyzed about a person's health, sex life or sexual orientation, are also on the list.

A few edges matter in practice. Precise geolocation means a location within a circle with a radius of 1,850 feet. Information that is publicly available is excluded from the definition. The CCPA regulations also treat as sensitive the personal information of consumers the business has actual knowledge are under 16. Everything else a firm collects, such as names, email addresses and job titles, is ordinary personal information and is governed by the other CCPA rights.

What does the right to limit let a consumer do?

The right to limit lets a California consumer direct a business to use their sensitive personal information only for what is necessary to provide the goods or services an average consumer would reasonably expect, plus a short list of operational purposes. That is the core of Civil Code section 1798.121(a). Once the consumer makes the request, subdivision (b) bars other uses and disclosures unless the consumer later consents. Subdivision (c) carries the restriction to service providers and contractors working for the business under a written contract.

The right is narrower than the right to opt out of sale or sharing. A business can still collect sensitive data and use it to serve the person who provided it. What the right restricts is secondary use, such as profiling, marketing built on health details, or disclosures beyond what the service requires. Under subdivision (d), sensitive information collected or processed without the purpose of inferring characteristics about a consumer falls outside the section entirely and is treated as ordinary personal information.

Which uses of sensitive data never trigger the right to limit?

Uses that fit one of the eight purposes listed in section 7027(m) of the CCPA regulations, as long as each use is reasonably necessary and proportionate, never trigger the right to limit. A business that stays inside them does not need a limit link, a notice of right to limit or a request method. The eight purposes are:

• Providing the goods or services an average consumer would reasonably expect when requesting them.
• Preventing, detecting and investigating security incidents that affect the availability, integrity, authenticity or confidentiality of information.
• Resisting malicious, deceptive, fraudulent or illegal actions directed at the business, and prosecuting those responsible.
• Ensuring the physical safety of people.
• Short-term, transient use, such as non-personalized advertising shown during the current interaction, if the data is not disclosed to a third party, used to build a profile or used to alter the person's experience outside that interaction.
• Performing services on behalf of the business, such as account maintenance, customer service, order fulfillment, payment processing, financing, analytics and storage.
• Verifying, maintaining or improving the quality or safety of the business's products, services or devices.
• Collecting or processing the information without the purpose of inferring characteristics about the consumer.

For a professional services firm, routine work such as payroll, benefits administration, client onboarding, identity checks and security monitoring often maps to these purposes. The questions start when sensitive data flows into marketing platforms, analytics, data enrichment services or AI tools for something the list does not describe.

When does a business have to post the limit link?

A business has to post the limit link when it uses or discloses sensitive personal information for any purpose outside the eight permitted purposes in regulation section 7027(m). Civil Code section 1798.135(a)(2) then requires a clear and conspicuous homepage link titled "Limit the Use of My Sensitive Personal Information." Under (a)(3), a business may instead offer a single link that handles both opting out of sale or sharing and limiting sensitive data. Regulation section 7015 titles that alternative "Your Privacy Choices" or "Your California Privacy Choices" and pairs it with the opt-out icon.

Regulation section 7014 adds a Notice of Right to Limit, which must describe the right and explain how to submit a request, with an interactive form when the notice is online. Section 7014(g) lets a business skip both the link and the notice if it uses sensitive data only for the 7027(m) purposes, or only without the purpose of inferring characteristics, and states that in its privacy policy. The privacy policy rules in section 7011 separately require the policy to say whether the business uses or discloses sensitive personal information beyond those purposes. That sentence is easy to leave out and easy for a regulator to check.

Section 7014(h) catches firms that add a new use later. Sensitive data collected while no Notice of Right to Limit was posted cannot be used or disclosed for purposes outside 7027(m) unless the consumer consents.

How fast must a business act on a request to limit?

A business must act on a request to limit within 15 business days. Section 7027(g) requires the business to stop uses and disclosures outside the permitted purposes as soon as feasibly possible, and no later than 15 business days after receiving the request. In the same window it must notify the service providers, contractors and third parties that received the data, and direct third parties to forward the request to anyone they passed the data to.

The rest of section 7027 sets the mechanics. A business that needs the right to limit must offer two or more methods for submitting requests, and a cookie banner alone is not an acceptable method. Methods must be easy to use and require minimal steps. The business cannot require a verifiable consumer request or make the consumer create an account. After a request, it must wait at least 12 months before asking the consumer to consent to other uses, which matches Civil Code section 1798.135(c)(4). Administrative fines reach $2,663 per violation and $7,988 per intentional violation or violation involving a consumer the business knows is under 16, as adjusted effective January 1, 2025.

How does this apply to financial firms with a GLBA exemption?

The right to limit applies to financial firms with a GLBA exemption only in part. The exemption in Civil Code section 1798.145(e) covers personal information collected, processed, sold or disclosed under the Gramm-Leach-Bliley Act, so client account data at an RIA, broker-dealer, dual-registered firm or insurance agency generally sits outside the right to limit. Data handled outside GLBA does not, which is the point of our piece on the scope of the GLBA exemption.

For a firm that meets a CCPA business threshold, the remaining exposure is usually employee and applicant data, prospect data from the website and events, and marketing data. The CCPA's employee exemption became inoperative on January 1, 2023, so Social Security numbers, government IDs and health information collected from staff are sensitive personal information. Much of that use, such as payroll and benefits, fits the permitted purposes. What tends to fall outside them is newer: recruiting tools that score candidates, CRM enrichment services, website analytics that infer characteristics from what a visitor reads, and AI tools that analyze HR records. If your employee privacy notice has not been refreshed since the exemption ended, start there.

What should your firm do this quarter?

Find where sensitive personal information lives, match each use to a permitted purpose, and close the gaps in your privacy policy, vendor contracts and request process. For most firms, these steps answer the question:

• Inventory every system that holds a category on the section 1798.140(ae) list, including HR, payroll, benefits, CRM, website forms and AI tools. A data inventory built for requests to know is a good starting point.
• For each system, record the purpose of each use and match it to one of the eight purposes in section 7027(m). Flag anything that does not match.
• Check vendor contracts for the written-contract restriction in section 1798.121(c) and the service provider terms in regulation sections 7050 and 7051.
• Read your privacy policy for the statement section 7011 requires about sensitive data use. If you rely on the section 7014(g) exception, confirm the policy says so.
• If any use falls outside the permitted purposes, either stop that use or publish the link, the notice and a request process that can meet the 15-business-day deadline. The counsel review list below covers that decision.
• If you use the "Your Privacy Choices" link, test it together with your handling of Global Privacy Control signals.

What should your counsel review before you rely on the permitted purposes?

Counsel should review four decisions: whether each use is reasonably necessary and proportionate to a permitted purpose, whether to rely on the section 7014(g) exception, which data sits inside the GLBA exemption, and whether vendor contracts meet the CCPA's restrictions. Do this review before you connect a new tool to sensitive data, and before your next privacy policy update. Bring the inventory from the steps above.

• Whether each use is reasonably necessary and proportionate to one of the purposes in regulation section 7027(m). Bring the system inventory with the purpose recorded for each use.
• Whether to rely on the section 7014(g) exception or post the limit link under Civil Code section 1798.135(a)(2) and the Notice of Right to Limit under regulation section 7014. Bring the current privacy policy and a screenshot of the homepage footer.
• Which data sits inside the GLBA exemption in Civil Code section 1798.145(e). Bring your GLBA privacy notice and a map of which systems hold client data and which hold employee, prospect and marketing data.
• Whether vendor contracts meet Civil Code section 1798.121(c) and regulation section 7051. Bring the contracts for HR, CRM, analytics and AI vendors that receive sensitive data.

How can s90 help?

If you are not sure where sensitive data lives in your firm, or whether each use would hold up if a regulator or an exam team asked about it, that is the gap s90 closes. We map where sensitive personal information lives across Microsoft 365, line-of-business systems and AI tools, document the purpose behind each data flow, and keep the inventory and vendor evidence your counsel needs to make the call. If you would like a second look at your sensitive data map, we are happy to walk through it with you.