CPRA Countdown: New Compliance Obligations and Challenges around “Sensitive Personal Information”

The California Privacy Rights Act (CPRA) creates a new category of personal information, called “sensitive personal information.” While the CPRA’s predecessor, the California Consumer Privacy Act (CCPA), in many ways had an outsized impact on businesses processing personal information, this new category will create novel obligations for California businesses that maintain information that California has determined is “sensitive.” This includes a new consumer right to limit the use of sensitive personal information to a narrow set of purposes prescribed in the statute and forthcoming regulations, which may have significant operational ramifications for businesses.