What counts as sensitive data in advertising?
Part of US and Canada targeting
The short answer
Sensitive data is a defined subset of personal data. US state laws list categories such as health, race or ethnic origin, religious beliefs, sexual orientation, citizenship status, precise geolocation and children's data. Colorado and Connecticut require consent before processing it, California gives a right to limit its use, and Canadian guidance generally expects express consent for sensitive information.
Key takeaways
- California's CCPA regulations list sensitive personal information in section 7001(bbb), including neural data and personal information of consumers a business knows are under 16.
- Colorado's Attorney General says controllers must get affirmative consent before collecting and processing sensitive data, and must conduct data protection assessments before processing it.
- The Office of the Privacy Commissioner of Canada says there is no bright line between sensitive and non-sensitive information, and that context can make ordinary information sensitive.
- California's regulations say sensitive personal information collected or processed without the purpose of inferring characteristics about a consumer is not subject to requests to limit.
What counts as sensitive data under US state privacy laws?
State privacy laws write their own lists, and the three examined here overlap without matching. California uses the term sensitive personal information; Colorado and Connecticut use sensitive data. The table sets the categories side by side as California's regulations and each Attorney General describe them, checked on October 22, 2026. A blank in a row means the category is missing from that source, not that the state never protects it elsewhere.
| Category | California | Colorado | Connecticut |
|---|---|---|---|
| Health | Personal information collected and analyzed concerning health | Mental or physical health conditions or diagnoses | Mental or physical health conditions or diagnoses, plus consumer health data |
| Race, ethnicity, religion | Racial or ethnic origin, religious or philosophical beliefs | Race, ethnic origin, religious beliefs | Racial or ethnic origins, religious beliefs |
| Sex life and identity | Sex life or sexual orientation | Sexual activity, preferences or orientation | Sexual activity or orientation, status as nonbinary or transgender |
| Citizenship | Citizenship or immigration status | Citizenship status or citizenship | Citizenship or immigration status |
| Location | Precise geolocation | Not on the AG's list | Precise geolocation |
| Young people | Consumers the business knows are under 16 | A child under 13 | A child under 13 |
| Biometric, genetic, neural | Genetic data, biometric processing to identify, neural data | Biometric data used to identify | Genetic and biometric data, neural data |
Definition
- Neural data, in California's regulations
- "Information that is generated by measuring the activity of a consumer's central or peripheral nervous system, and that is not inferred from nonneural information."
Two other categories matter less for media plans but appear in California's list: government identifiers such as a driver's license or passport number, and account log-in or card numbers with their access codes. Connecticut's Attorney General lists financial account credentials and government-issued identification numbers as well. The wider set of state laws and their dates sits on the US state privacy laws page.
Which uses of sensitive data need consent?
The states split into two models. Under the Colorado Privacy Act, the Attorney General's guidance (opens in a new tab) says controllers must get affirmative consent before "(1) collecting and processing sensitive data," and that such consent "must be affirmative, freely given, specific, informed, and unambiguous." The Connecticut Attorney General (opens in a new tab) says that "a controller needs a consumer's consent to process sensitive data." California instead lets consumers limit how a business uses and discloses sensitive personal information.
| Jurisdiction | Rule for sensitive data | Assessment duty |
|---|---|---|
| Colorado | Affirmative consent before collecting and processing; broad terms of service, hovering or pausing content and deceptive design do not count | Data protection assessment before processing sensitive data |
| Connecticut | Consent before processing sensitive data | Assessments before processing that presents a heightened risk of harm, which the AG says includes targeted advertising and processing sensitive data |
| California | A right to limit use and disclosure to what is necessary for the goods or services an average consumer expects, with listed exceptions | Risk assessment before processing sensitive personal information, under regulation 7150(b)(2) |
| Canada, federal | Express consent generally expected for sensitive information | Not addressed in the OPC guidance cited here |
| Quebec | Consent for sensitive information must be given expressly | Covered on the Law 25 page |
How does Canadian guidance treat sensitive information?
PIPEDA does not carry a closed list. The OPC's Guidelines for obtaining meaningful consent (opens in a new tab), modified August 11, 2025, say: "There is no 'bright line' separation of what is, and is not, sensitive information." They add that health or financial information will generally be considered sensitive and that "even non-sensitive information can become sensitive depending on the circumstances."
When the OPC says express consent is generally required
- The information is sensitive. The guidelines name sensitivity as the first trigger for express consent.
- The use is unexpected. Collection, use or disclosure outside the reasonable expectations of the individual needs express consent.
- Harm remains possible. Collection, use or disclosure that creates a meaningful residual risk of significant harm needs express consent.
The information collected and used is limited, to the extent practicable, to non-sensitive information (avoiding information that is generally considered sensitive such as medical or health information, financial data, ethnic and racial origins, political opinions, genetic data, uniquely identifying biometric data, an individual's sex life or sexual orientation, and religious/philosophical beliefs)
Quebec's Commission d'accès à l'information explains (opens in a new tab) that information is sensitive when it is medical, biometric or otherwise intimate, or when the context of its use or disclosure raises a high reasonable expectation of privacy, and that consent for it must be given "de façon expresse," through an explicit gesture or statement. Quebec's wider rules are on the Law 25 page, and federal consent for tracking on the PIPEDA page.
Can contextual placements on sensitive topics involve sensitive data?
They can, depending on what is collected around the placement. A page about faith, health or sexuality is content, and none of the state lists above names a web page as sensitive data. California's regulation 7027(a) draws the line at purpose: sensitive personal information "that is collected or processed without the purpose of inferring characteristics about a consumer is not subject to requests to limit." Its example in 7027(m)(8) is a website search box where people look up articles about their health condition.
The OPC reaches a similar place by another route: sensitivity depends on the information and its context, so a reading history tied to a person can reveal health or beliefs even when no single page is labeled sensitive. Platforms add their own rules on top of the law. Google's restricted targeting policy (opens in a new tab) says advertisers promoting products in sensitive interest categories, including health, religious beliefs, sexual orientation and race and ethnicity, "are unable to use advertiser-curated audiences."
What should change if the brief proposes using sensitive attributes?
The sources above describe what a sensitive attribute in a brief sets off. In Colorado and Connecticut, targeting people by an attribute on the list means processing sensitive data, which needs consent first, and in Colorado an assessment as well. In California it means a use that falls outside the transient advertising exception once a profile is built. On Google, a product in a sensitive interest category cannot use advertiser-curated audiences at all.
Questions a sensitive attribute in a brief raises
- Which listed category the attribute falls in, under each state where the audience lives and under Canadian guidance.
- Whether the attribute is collected from people or inferred about them, since the state definitions reach data that reveals a category.
- Whether consent exists, and whether it is the affirmative, specific consent Colorado describes or the express consent the OPC and the CAI describe.
- Whether a data protection or risk assessment covers the processing before it starts.
- Whether the platform's own policy still allows the targeting type for that product category.
- Whether the goal can be met by choosing pages by topic, with no attribute attached to a person.
Fictional example
A halal grocery delivery service in Connecticut
An unnamed halal grocery delivery service in Hartford and New Haven, Connecticut, drafts a brief asking to reach Muslim households before Ramadan. The planner marks the request against the Connecticut AG's list, where religious beliefs are sensitive data and processing needs consent, and the brief has no consent record behind any audience.
The revised plan drops the household audience and builds a site list of halal recipe pages, iftar cooking guides, Middle Eastern and South Asian food writing and local food news chosen by page content. Measurement stays at the campaign level, with no segment named after a faith.
How does PlacementGraph plan sensitive topic briefs from pages?
Frequently asked questions
Is precise geolocation sensitive data?
California's regulations and the Connecticut Attorney General list precise geolocation as sensitive. Connecticut describes it as information that identifies a person's specific location with a defined degree of precision and accuracy. The Colorado AG's sensitive data list, as checked in October 2026, does not name it among its categories.
Does California require opt in consent for sensitive personal information?
California's model is a right to limit rather than opt in consent for adults. Regulation 7027 lets consumers limit a business's use to what is necessary for the goods or services an average consumer expects, with narrow exceptions listed in subsection (m). Personal information of consumers known to be under 16 is itself listed as sensitive.
Can a Canadian site rely on opt out consent for ads using health information?
The OPC's behavioural advertising guidelines make opt out consent reasonable only under conditions, one of which is limiting information to non-sensitive information and avoiding medical or health information. The OPC's consent guidelines say sensitive information generally calls for express consent.
Does a data protection assessment apply to sensitive data in Colorado?
The Colorado AG's guidance lists conducting data protection assessments before selling personal data or processing sensitive data among controllers' obligations, alongside the duty to obtain consent before processing sensitive data. The same page points to Part 6 of the state's rules, 4 CCR 904-3, for the specific requirements on controllers.
Sources
- California Consumer Privacy Act Regulations, effective January 1, 2026 (opens in a new tab)California Privacy Protection Agency
- Colorado Privacy Act (opens in a new tab)Colorado Attorney General
- The Connecticut Data Privacy Act (opens in a new tab)Connecticut Office of the Attorney General
- Guidelines for obtaining meaningful consent (opens in a new tab)Office of the Privacy Commissioner of Canada
- Guidelines on privacy and online behavioural advertising (opens in a new tab)Office of the Privacy Commissioner of Canada
- Consentement des personnes concernées par les entreprises (opens in a new tab)Commission d'accès à l'information du Québec
- Restricted targeting in Personalized advertising (opens in a new tab)Google Advertising Policies Help
Researched and written by PlacementGraph Research. Read how we research, source and update these pages. Corrections: diana@placementgraph.com.