California PII: What’s Covered, Your Rights, and Penalties

In California, personally identifiable information is defined far more broadly than most people expect. Under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, personal information means any data that identifies, relates to, or could reasonably be linked to a particular consumer or household.¹ That covers your name and Social Security number, yes, but also your IP address, your browsing history, your faceprint, your purchase records, and the inferences a company draws from any of it. The law then singles out a sensitive subcategory for stricter control and gives you concrete rights to see, delete, correct, and restrict how your data is used.

What Counts as Personal Information

The “reasonably linkable” phrase is what makes California’s definition so wide. A business doesn’t need to know your name for data to qualify. If the information could be tied back to you by combining it with other data points, the law treats it as personal information.¹

The statute lists twelve categories:

Identifiers such as real name, alias, postal address, email address, Social Security number, driver’s license number, passport number, IP address, and account name
Financial and customer records like bank account numbers, credit card numbers, and insurance policy numbers
Characteristics of legally protected classifications under California or federal law
Commercial information, including products or services purchased, obtained, or considered, and purchasing or browsing tendencies
Biometric information such as fingerprints, faceprints, voiceprints, and keystroke patterns
Internet or network activity, including browsing history, search history, and interactions with websites, apps, and advertisements
Geolocation data
Audio, electronic, visual, thermal, or similar sensory information
Professional or employment information
Education information not already public under the federal Family Educational Rights and Privacy Act
Inferences drawn from any of the above to build a profile of your preferences, characteristics, behavior, or aptitudes
Sensitive personal information, which carries its own protections

The list isn’t exhaustive. Anything meeting the reasonably linkable standard qualifies, even if it doesn’t fit neatly into one of the twelve.¹

Sensitive Personal Information

Within personal information, the law carves out a narrower set that gets extra control. Sensitive personal information includes:

Social Security, driver’s license, state ID, or passport numbers
Account login credentials together with a password or security code that would allow access to a financial account
Precise geolocation
Racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, and union membership
Contents of your mail, email, and text messages, unless the business is the intended recipient
Genetic data
Neural data generated by measuring the activity of your nervous system
Biometric data processed to identify you
Health information
Information about your sex life or sexual orientation

For this category, you can direct a business to use the data only as needed to deliver the service you asked for. That right to limit use is one of the strongest tools in the law.²

What California PII Does Not Cover

Some data about you sits outside the law, and knowing the boundaries matters because businesses sometimes claim exemptions that don’t actually apply.

Data lawfully obtained from federal, state, or local government records is excluded, as is information you’ve made broadly available to the public or shared without restricting the audience. Biometric information a business collects about you without your knowledge never counts as publicly available, even if some version of it might be obtainable elsewhere.¹

Information that has been de-identified so it can no longer reasonably be linked to a consumer or household is also outside the definition, along with aggregate consumer information. Businesses relying on de-identification have to meet specific technical and organizational requirements to prevent re-identification.¹

Certain federal regimes preempt the CCPA for specific data types. Protected health information under HIPAA, financial data under the Gramm-Leach-Bliley Act, and consumer credit information under the Fair Credit Reporting Act are not covered. These exemptions attach to data types, not whole companies. A hospital still has CCPA obligations for information it collects outside HIPAA’s scope, and a bank still has them for data gathered in non-financial contexts.³

The law also protects you only if you are a California resident, though it still applies when you are temporarily out of state. Employee data and business-to-business contacts are fully covered now; the earlier carve-outs expired on January 1, 2023.⁴ Not every business is subject to the law — smaller companies that fall under the revenue and data-volume thresholds in Civil Code 1798.140 are outside its reach — but once a business is covered, these rights apply fully.

Your Rights Over the Data

California gives you six core rights. A business cannot punish you for using any of them by charging more, degrading the service, or refusing to deal with you.⁴

Know and Access

You can ask what categories and specific pieces of personal information a business has collected about you, where it came from, why it was collected, and which third parties received it. The response has to come in a format you can readily use and move to another company.⁴

Delete

You can tell a business to delete personal information it collected from you and to pass that instruction on to its service providers. Exceptions exist. A business may keep data it genuinely needs to complete a transaction you requested, detect security incidents, comply with a legal obligation, or use internally in ways a reasonable consumer would expect given the relationship.⁴

Correct

If a business holds inaccurate personal information about you, you can ask it to fix the record.⁴

Opt Out of Sale or Sharing

You can tell a business to stop selling your personal information or sharing it for cross-context behavioral advertising. “Sharing” has a technical meaning here: disclosing data to a third party for targeted advertising purposes, whether or not money changes hands.⁵ Businesses must also honor opt-out preference signals like the Global Privacy Control browser setting, treating them as valid opt-out requests for that browser, device, and any linked profile.⁶

Limit Use of Sensitive Information

You can direct a business to use your sensitive personal information only for the purposes necessary to provide the service you requested. Without that restriction, data like your precise location or genetic profile could be used in ways you never anticipated when you handed it over.⁴

How to Make a Request

A covered business has to offer at least two methods for you to submit a request. One has to be a toll-free phone number. If the business has a website, it also has to provide an online submission method. Companies that operate exclusively online and have a direct relationship with you can substitute an email address for the phone number.⁷

The business has 45 days to respond and can extend by another 45 days if it tells you about the extension within the original window. The response is free.⁷

Your request must be verifiable. The business can require reasonable authentication to confirm you are who you say you are, but it cannot force you to create an account just to submit a request. If you already have one, it can require you to use it.⁷ Any consent extracted through a “dark pattern,” meaning a user interface designed to undermine your real ability to choose, does not count as valid consent.⁸

What Businesses Must Tell You Before Collecting

Before a business collects any personal information from you, it must give you a clear notice stating the categories of data it plans to collect (including sensitive personal information), the purposes for the collection, whether the data will be sold or shared, and how long each category will be kept. Without that notice at or before the point of collection, the business is not permitted to collect the data at all.⁹

A data minimization rule applies on top of that. A business may collect, use, retain, and share your personal information only to the extent reasonably necessary and proportionate to the purpose it was collected for. Repurposing data later requires the new purpose to be compatible with the original one.⁹

Penalties and When You Can Sue

The California Privacy Protection Agency is the primary enforcer, and the Attorney General also retains enforcement authority. Fines are assessed per violation, which adds up quickly when the data of thousands of consumers is involved. Unintentional violations carry a penalty of up to $2,500 each. Intentional violations, and any violation involving the personal information of a consumer the business knows is under 16, carry up to $7,500 each. Both amounts are subject to periodic inflation adjustment.¹⁰

Consumers have a limited right to sue directly, but only in one situation: a data breach caused by the business’s failure to maintain reasonable security practices. If your unencrypted personal information is stolen or exposed because of a security failure, you can recover statutory damages between $100 and $750 per consumer per incident, or your actual damages, whichever is greater.¹¹ For privacy violations that don’t involve a breach, enforcement runs through the CPPA and the Attorney General rather than through private lawsuits.

1
California Legislative Information. California Civil Code 1798.140 – Definitions
2
California Legislative Information. California Code Civil Code 1798.140 – Definitions
3
California Legislative Information. California Civil Code 1798.145 – Exemptions
4
State of California – Department of Justice – Office of the Attorney General. California Consumer Privacy Act
5
California Legislative Information. California Civil Code 1798.140 – Definitions
6
New York Codes, Rules and Regulations. California Code of Regulations 7025 – Opt-Out Preference Signals
7
California Legislative Information. California Civil Code 1798.130
8
California Privacy Protection Agency. Enforcement Advisory No. 2024-02
9
California Legislative Information. California Civil Code 1798.100
10
California Legislative Information. California Civil Code 1798.155 – Administrative Enforcement
11
California Legislative Information. California Code Civil Code 1798.150