Do I need consent to process sensitive personal data in the United States?

Controller, Healthcare provider, Online service, SME

Businesses and controllers covered by the California, Virginia, Colorado, Connecticut, Texas or Oregon privacy law that process sensitive data such as health, biometric, precise geolocation or children's data.

Virginia, Colorado, Connecticut, Texas and Oregon require opt-in consent; California gives a right to limit the use of sensitive personal information.

Obtain consent before processing in the five opt-in states, offer a 'Limit the Use of My Sensitive Personal Information' link in California, and carry out a data protection assessment where required.

medium (civil_penalty_per_violation)

Penalty amounts are adjusted for inflation: current amounts.

1. Map sensitive data categories
2. Collect opt-in consent for VA, CO, CT, TX and OR
3. Offer the right to limit in California
4. Run a data protection assessment
5. Apply COPPA rules to children's data

Before processing begins (opt-in states).

• Cal. Civ. Code 1798.121
• Va. Code 59.1-578(A)(5)
• Tex. Bus. & Com. Code 541.101(b)(4)

sha256 d397971a0e273678c7253ddc2d587a9df9753f2d049bb062c823b95a28ce1449 · read 2026-10-15 · Source: NovaCopilot

• CA, CCPA as amended by CPRA · sensitive data: right_to_limit · regulator: California Privacy Protection Agency and California Attorney General · max civil penalty: 2,500 dollars per violation, 7,500 dollars per intentional violation or violation involving minors under 16, adjusted for inflation (1798.155, 1798.199.90)
• VA, Virginia Consumer Data Protection Act · sensitive data: opt_in_consent · regulator: Virginia Attorney General · max civil penalty: 7,500 dollars per violation (59.1-584)
• CO, Colorado Privacy Act · sensitive data: opt_in_consent · regulator: Colorado Attorney General and district attorneys · max civil penalty: not in register
• CT, Connecticut Data Privacy Act · sensitive data: opt_in_consent · regulator: Connecticut Attorney General · max civil penalty: not in register
• TX, Texas Data Privacy and Security Act · sensitive data: opt_in_consent · regulator: Texas Attorney General · max civil penalty: 7,500 dollars per violation (541.155)
• OR, Oregon Consumer Privacy Act · sensitive data: opt_in_consent · regulator: Oregon Attorney General · max civil penalty: 7,500 dollars per violation (646A.589)

GDPR Art. 6GDPR Art. 9crosswalk

• What counts as sensitive personal information under the CPRA?
• Does the California privacy law apply to my business?
• Do I need parental consent to collect data from children?
• What must a clinic do after a health data breach?
• Must I report a data breach to the authority?

• agent:eu:business:gdpr-access-request (business_agent)
• agent:eu:business:gdpr-breach-72h (business_agent)
• agent:eu:business:gdpr-records (business_agent)
• agent:us:business:ccpa-consumer-requests (business_agent)
• agent:us:business:coppa-parental-consent (business_agent)
• agent:us:business:hipaa-breach-notification (business_agent)
• agent:us:business:privacy-access-request (business_agent)
• agent:us:business:privacy-consumer-request (business_agent)
• agent:us:business:privacy-deletion (business_agent)
• agent:us:business:privacy-notice (business_agent)