Under the CCPA, the right to limit the use of sensitive personal information lets you tell a California business to stop using your most private data for anything beyond delivering the product or service you actually requested. The right lives in Civil Code Section 1798.121 and covers categories like Social Security numbers, precise location, biometric identifiers, and health information. You exercise it by submitting a request through the business’s “Limit the Use of My Sensitive Personal Information” link or another listed channel, and the business has to comply within 15 business days. One rule catches both sides off guard: a business cannot make you verify your identity before honoring the request.
What the Right Covers
This right targets how the collecting business itself handles your sensitive data internally. That is different from the right to opt out of the sale or sharing of personal information, which stops a business from transferring data to third parties. A company that never sells a byte can still be using your sensitive information in ways you never agreed to, and the right to limit is the tool for that situation. Both rights can be exercised at the same time if both apply.
When you submit a request, you are directing the business to restrict its use of your sensitive personal information to what is necessary to deliver the goods or services you asked for. The yardstick written into the statute is what an average consumer would reasonably expect from the transaction.1California Legislative Information. California Civil Code 1798.121 A retailer collecting your precise geolocation to complete a delivery is expected. The same retailer feeding that location into a behavioral advertising profile is not, and you can shut that down.
A boundary to know: sensitive personal information that a business collects or processes without the purpose of inferring characteristics about you is not subject to the right to limit. That data is still protected as regular personal information under the rest of the CCPA, but the specific limitation mechanism does not reach it.1California Legislative Information. California Civil Code 1798.121
Which Data Qualifies as Sensitive
The CCPA draws a line between ordinary personal information and a narrower category of sensitive personal information. Civil Code Section 1798.140(ae) lists what qualifies:2California Legislative Information. California Civil Code 1798.140
- Social Security numbers, driver’s license numbers, state ID card numbers, and passport numbers.
- Account login information combined with a password, security code, or other credentials that would grant access to an account.
- Precise geolocation, meaning data that pinpoints your location within a circle with a radius of 1,850 feet or less.
- Racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership.
- The contents of your mail, email, and text messages, unless the business itself is the intended recipient.
- Genetic data.
- Neural data generated by measuring the activity of your central or peripheral nervous system.
- Biometric information when processed to uniquely identify you, such as fingerprints or facial recognition data.
- Personal information collected and analyzed concerning your health, sex life, or sexual orientation.
Two edges worth noting. Inferences a business draws from your data to build a consumer profile count as personal information but not as sensitive personal information. And sensitive personal information that is publicly available is excluded from both categories entirely.3California Privacy Protection Agency. Frequently Asked Questions
Which Businesses Have to Honor Your Request
The CCPA only applies to for-profit businesses that operate in California and meet at least one of three thresholds: annual gross revenue above $26,625,000 as of January 1, 2025; buying, selling, or sharing the personal information of 100,000 or more California residents or households; or earning 50 percent or more of annual revenue from selling California residents’ personal information.4California Privacy Protection Agency. Updated Monetary Thresholds in CCPA
A covered business that uses sensitive personal information for purposes beyond what an average consumer would reasonably expect has to offer the limit link. If a business only uses sensitive data for the specifically permitted purposes outlined in the regulations, it is not required to offer the link at all.1California Legislative Information. California Civil Code 1798.121 So the absence of a link on a small or narrow-use website is not automatically a violation.
How to Submit the Request
Businesses that use sensitive personal information beyond permitted purposes must offer at least two methods for submitting a request. Any business that collects this data online must provide an interactive form reached through a conspicuous link titled “Limit the Use of My Sensitive Personal Information” (or an equivalent combined privacy link) placed in the header or footer of its website.5Legal Information Institute. 11 CCR 7014 – Notice of Right to Limit and the Limit the Use of My Sensitive Personal Information Link Other acceptable channels include a toll-free number, a designated email address, or a form submitted in person or by mail.6Legal Information Institute. 11 CCR 7027 – Requests to Limit Use and Disclosure of Sensitive Personal Information
The rule that trips businesses up: they cannot require identity verification for a request to limit. The regulations explicitly state that a verifiable consumer request is not required for this type of request.6Legal Information Institute. 11 CCR 7027 – Requests to Limit Use and Disclosure of Sensitive Personal Information The process also has to be easy and take minimal steps. A cookie banner or cookie control tool alone does not satisfy the obligation, because cookies relate to data collection rather than to how sensitive personal information is used and disclosed.
If a business tries to make you create an account, fill out extensive verification forms, or jump through extra hoops before honoring your request, it is likely out of compliance. The CPPA’s first public enforcement action against an automaker rested in part on exactly that failure.
Using an Authorized Agent
You can authorize another person, or a business entity registered with the California Secretary of State, to submit the request on your behalf.7State of California – Department of Justice – Office of the Attorney General. California Consumer Privacy Act (CCPA) For requests to limit, a business cannot require you to directly confirm to it that you authorized the agent. That is a lower bar than requests to know or delete personal information, where businesses can ask for signed proof of the agent’s authority and may ask you to verify your identity.
What the Business Must Do After You Ask
Once a business receives your request, it must stop using and disclosing your sensitive personal information for non-permitted purposes as soon as feasibly possible, and no later than 15 business days.6Legal Information Institute. 11 CCR 7027 – Requests to Limit Use and Disclosure of Sensitive Personal Information The business also has to notify any service providers or contractors that process the data on its behalf, and those entities must follow the same limitation in their work for that business.1California Legislative Information. California Civil Code 1798.121
Retaliation is prohibited. The business cannot deny you services, charge higher prices, or provide a lower quality of service because you exercised the right.
After honoring your request, the business must wait at least 12 months before asking whether you want to reconsider and consent to broader uses of your sensitive data. If you later give consent, the business can resume those additional uses, but the default stays limited until you affirmatively agree.1California Legislative Information. California Civil Code 1798.121
What Uses Can Continue Anyway
A limitation request does not shut down every use of your sensitive data. Businesses can still rely on it for a defined set of operational purposes: performing the service or providing the goods you requested, ensuring the security and integrity of your data and the business’s systems, short-term transient use that is not personalized (such as a non-targeted ad shown during a single interaction), performing services on behalf of the business like maintaining accounts or processing transactions, and verifying or maintaining the quality and safety of a product or service.1California Legislative Information. California Civil Code 1798.121
In practice: a payroll company can still use your Social Security number to process your taxes, and a bank can still use your account credentials to protect you from fraud. What they cannot do is feed that data into behavioral profiling, cross-device tracking, or unrelated research. The line falls between using your data to serve you and using your data to serve the business’s other interests.
If a Business Ignores Your Request
You cannot personally sue a business for violating the right to limit. The CCPA only grants a private right of action for data breaches, and even then only under limited circumstances.7State of California – Department of Justice – Office of the Attorney General. California Consumer Privacy Act (CCPA) Enforcement sits with the California Privacy Protection Agency and the California Attorney General.
If a business ignores your request, makes the process unreasonably difficult, or retaliates against you, file a complaint through the CPPA’s online form.8California Privacy Protection Agency. Complaint Form The Agency does not act as your attorney, but your complaint feeds the enforcement pipeline. It can be used to monitor compliance trends, open an inquiry, conduct an audit, contact the business, or ultimately bring an enforcement action.3California Privacy Protection Agency. Frequently Asked Questions Any personal information you provide in a complaint may be used and disclosed as part of an enforcement proceeding, so submit only what you are comfortable sharing in that context.