CCPA Personal Information Definition: Categories and Exclusions

Under the California Consumer Privacy Act, the definition of personal information is deliberately broad: it covers any data that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked to a particular California consumer or household. That language, found in Civil Code Section 1798.140(v)(1), reaches far past names and Social Security numbers to include browsing history, location data, purchasing patterns, and even the conclusions an algorithm draws about you from other inputs.¹

The Statutory Definition and Why It Is So Broad

The operative phrase in the statute is “reasonably capable of being associated with.” A data point does not need to contain your name to qualify. If a business could connect it back to you through cross-referencing, linking, or analysis, the data is protected.

One feature that sets the CCPA apart from most privacy frameworks is the inclusion of households. Data tied to a family’s shared internet connection, a smart-home device, or a jointly held account carries the same protections as data tied to an individual.¹ That distinction matters because advertisers routinely build profiles around household-level activity without ever identifying a single person by name.

The Twelve Categories the Statute Lists

The law enumerates twelve categories, labeled (A) through (L), but says the list is “not limited to” the items shown. Anything fitting the broad functional definition is covered whether or not it appears on the list.

Identifiers, including real names, aliases, postal and email addresses, account names, IP addresses, Social Security numbers, driver’s license numbers, and passport numbers.¹
California Customer Records information described in Civil Code Section 1798.80, such as financial account numbers, medical information, and insurance policy numbers.
Protected classifications under California or federal law, including race, gender, and disability status.
Commercial information, such as records of property owned, products or services purchased or considered, and purchasing histories or tendencies.
Biometric information used for identification, including fingerprints, face scans, and voice recordings.
Internet or other electronic network activity, including browsing history, search history, and interactions with websites, apps, and ads.
Geolocation data revealing your physical location.
Sensory data: audio, visual, thermal, olfactory, and similar recordings. Customer service call recordings and security-camera footage fit here.
Professional or employment-related information, such as job titles, work history, and performance evaluations.
Non-publicly-available education records as defined under the federal Family Educational Rights and Privacy Act.
Inferences drawn from any of the above to build a profile reflecting your preferences, behavior, attitudes, intelligence, or abilities.
Sensitive personal information, a heightened sub-category discussed below.

The sensory and inferences categories are the ones most people overlook. A business that records your customer service call, collects thermal imaging from a storefront sensor, or runs an algorithm to predict your creditworthiness is handling personal information in each case.

Sensitive Personal Information Is a Separate Tier

The California Privacy Rights Act, which amended the CCPA effective January 1, 2023, added a heightened category. Civil Code Section 1798.140(ae) defines sensitive personal information to include:²

Government-issued identifiers: Social Security, driver’s license, state ID, and passport numbers.
Financial credentials: account log-in details, or a financial account, debit card, or credit card number combined with a security code or password.
Precise geolocation, defined as data that locates you within a radius of 1,850 feet.³
Racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, and union membership.
Contents of your mail, email, and text messages, unless the business is the intended recipient.
Genetic data.
Neural data generated by measuring activity of your central or peripheral nervous system. Inferences drawn from non-neural data do not count.²
Biometric data processed to uniquely identify you.
Health information and information about your sex life or sexual orientation.

The tier matters because it unlocks a specific right: you can direct a business to use your sensitive personal information only for what is necessary to provide the goods or services you actually requested.⁴ Businesses collecting sensitive data must post a “Limit the Use of My Sensitive Personal Information” link. The neural-data addition reflects the state’s recognition that brain-computer interfaces are no longer hypothetical.

What Falls Outside the Definition

Three categories are excluded from the definition, which means CCPA rights and obligations do not attach to them.

Publicly Available Information

Data drawn from federal, state, or local government records qualifies as publicly available. The CPRA expanded the exclusion to also cover information a business reasonably believes a consumer made available to the general public, information from widely distributed media, and information a consumer disclosed to someone without restricting the audience.¹ One carve-out to the carve-out: biometric information collected without your knowledge never counts as publicly available, even if the underlying source is public.

Deidentified Information

Data stripped of identifying characteristics can be excluded, but the bar is high. The business must implement technical safeguards preventing re-identification, maintain business processes that specifically prohibit re-identification, have processes to prevent accidental release, and make no attempt to re-identify the data.² Deleting a name column from a spreadsheet does not clear that bar.

Aggregate Consumer Information

Data combined into group-level statistics with no individual identifiers falls outside the definition. Once the link to any specific consumer or household is gone, the CCPA no longer applies to the data set.

Inferences and Consumer Profiles Are Personal Information Too

Category (K) reaches further than most people realize. When a business collects ordinary inputs like browsing history and purchase records, then feeds them into an algorithm concluding you are a high-income homeowner interested in luxury travel, that conclusion is itself a new piece of personal information under the statute.¹ The profile reflecting your preferences, psychological tendencies, behavior, attitudes, and predicted abilities is protected as fully as the raw inputs.

Predictive modeling powers targeted advertising, credit scoring, insurance pricing, and hiring algorithms. Without this provision, a company could argue its algorithmic output is a proprietary business product rather than personal information. California closed that door. In September 2025, the California Privacy Protection Agency finalized regulations covering automated decision-making technology, adding requirements for businesses that use algorithms to make decisions producing legal or similarly significant effects, and giving consumers a right to opt out of automated decisions in areas like lending, housing, insurance, and employment.⁵

Why the Definition Matters

Everything a California resident can do under the CCPA hinges on whether specific data qualifies as personal information. If it qualifies, the following rights attach:⁴

Right to know what categories and specific pieces of personal information a business has collected, where it came from, why it is used, and who it is shared with. You can make this request up to twice per year at no cost.
Right to delete personal information a business collected from you, subject to exceptions such as legal retention requirements.
Right to correct inaccurate personal information a business holds about you.⁶
Right to opt out of the sale or sharing of your personal information, including through a browser-based Global Privacy Control signal.
Right to limit a business’s use of sensitive personal information to what is necessary to deliver what you requested.
Right to non-discrimination for exercising any of these rights.

Businesses must also provide a “notice at collection” identifying the categories of personal information they are gathering and how they plan to use it, before or at the point of collection.⁴ The “Do Not Sell or Share My Personal Information” link at the bottom of many websites is this framework in practice.

One boundary worth noting: not every category of personal information supports a private lawsuit after a data breach. The right to sue under Civil Code Section 1798.150 applies only to the narrower set of personal information defined in Section 1798.81.5, not the full CCPA definition. A breach of browsing history alone, for example, may violate the CCPA and draw agency enforcement without giving individual consumers a claim for statutory damages.⁷

1
California Legislative Information. California Civil Code 1798.140
2
California Legislative Information. California Civil Code 1798.140
3
California Privacy Protection Agency. LOCKED Series: Right to Limit and Opt-Out
4
State of California – Department of Justice – Office of the Attorney General. California Consumer Privacy Act (CCPA)
5
California Privacy Protection Agency. California Finalizes Regulations to Strengthen Consumers’ Privacy
6
California Privacy Protection Agency. California Consumer Privacy Act of 2018 – Section 1798.106
7
California Legislative Information. California Civil Code 1798.150