In short
Sensitive personal information is personal data that gets extra protection because of its higher risk of harm, like health data, biometric data or precise geolocation. Most US state privacy laws set stricter rules for it, but each state defines it differently.
This guide compares how 24 US state privacy laws define sensitive personal information, explains the main exceptions, and shows how to manage it with iubenda.
Any information that can be used to identify an individual is considered personal information. In the majority of privacy legislation, sensitive personal information is regarded as a special type of personal data. This type of data is particularly delicate since there may be a higher chance that the person it refers to could face discrimination.
We had an in-depth look into how you can handle sensitive data and more under the CPRA and the VCDPA regulations.
How US states define sensitive personal information
The table below compares how each US state privacy law defines sensitive personal information. Use the checkboxes to show only the states you need.
|
Florida (Digital Bill of Rights)
|
Delaware (DPDPA)
|
New Hampshire (NHDPA)
|
New Jersey (NJDPA)
|
Tennessee (TIPA)
|
Nebraska (NDPA)
|
Indiana (ICDPA)
|
Kentucky (KCDPA)
|
Rhode Island (DTPPA)
|
Maryland (MODPA)
|
Oklahoma (SB 546)
|
Alabama (APDPA)
|
Louisiana (LDPA)
|
Vermont (VDPOSA)
|
|||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Personal information that reveals: Citizenship data |
Social security, driver’s license, state Identification card, or passport number; citizenship or immigration status |
Citizenship or immigration status |
Citizenship or citizenship status |
Citizenship or immigration status; government-issued ID numbers (from July 1, 2026) |
Citizenship or immigration status |
Citizenship or immigration status |
Citizenship or immigration status and status as a victim of crime |
Citizenship or immigration status |
Citizenship or immigration status |
Citizenship or immigration status |
Citizenship or immigration status |
Citizenship or immigration status |
Citizenship or immigration status |
Citizenship or immigration status |
Citizenship or immigration status |
Citizenship or immigration status |
Citizenship or immigration status |
Citizenship or immigration status |
Citizenship or immigration status |
Citizenship or immigration status |
Citizenship or immigration status |
Citizenship or immigration status |
Citizenship or immigration status |
Citizenship or immigration status; government-issued ID numbers |
| Personal information that reveals: Account details |
Account log-In, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account.* |
Not included |
Not included |
Financial account number, financial account log-in information, or credit or debit card number with any required access code or password (from July 1, 2026) |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Financial information, which shall include a consumer’s account number, account log-in, financial account, or credit or debit card number, in combination with any required security code, access code, or password that would permit access to a consumer’s financial account |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Financial information (e.g. account or card numbers with access credentials) |
| Personal information that reveals: Location |
Precise geolocation |
Precise geolocation data |
Precise geolocation data |
Precise geolocation data |
Specific geolocation data |
Precise geolocation data |
Accurately identifies within a radius of 1,750 feet a consumer’s present or past location, or the present or past location of a device that links or is linkable to a consumer by means of technology that includes, but is not limited to, a global positioning system that provides latitude and longitude coordinates |
Precise geolocation data |
Precise geolocation data |
Precise geolocation data |
Precise geolocation data |
Precise geolocation data |
Precise geolocation data |
Precise geolocation data |
Precise geolocation data |
Specific geolocation data |
Precise geolocation data |
Precise geolocation data |
Precise geolocation data |
Precise geolocation data |
Precise geolocation data |
Precise geolocation data |
Precise geolocation data |
Precise geolocation data |
| Personal information that reveals: Origin |
Racial or ethnic origin |
Racial or ethnic origin |
Racial or ethnic origin |
Racial or ethnic origin |
Racial or ethnic origin |
Racial or ethnic origin |
National origin and racial or ethnic background |
Racial or ethnic origin |
Racial or ethnic origin |
National, racial, or ethnic origin |
Racial or ethnic origin |
Racial or ethnic origin |
Racial or ethnic origin |
Racial or ethnic origin |
Racial or ethnic origin |
Racial or ethnic origin |
Racial or ethnic origin |
Racial or ethnic origin |
Racial or ethnic origin |
Racial or ethnic origin; national origin |
Racial or ethnic origin |
Racial or ethnic origin |
Racial or ethnic origin |
Racial or ethnic origin |
| Personal information that reveals: Beliefs |
Religious or philosophical beliefs |
Religious beliefs |
Religious beliefs |
Religious beliefs |
Religious beliefs |
Religious beliefs |
Religious beliefs |
Religious beliefs |
Religious beliefs |
Religious beliefs |
Religious beliefs |
Religious beliefs |
Religious beliefs |
Religious beliefs |
Religious beliefs |
Religious beliefs |
Religious beliefs |
Religious beliefs |
Religious beliefs |
Religious beliefs |
Religious beliefs |
Religious beliefs |
Religious beliefs |
Religious beliefs |
| Personal information that reveals: Union Membership |
Union membership |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
| Personal information that reveals: Health |
Health |
Mental or physical health diagnosis |
Mental or physical health condition or diagnosis |
Mental or physical health condition or diagnosis, disability or treatment; consumer health data |
Individual’s medical history, mental or physical health condition, or medical treatment or diagnosis by a health care professional |
Mental or physical health diagnosis |
Mental or physical condition or diagnosis |
Mental or physical health diagnosis |
Mental or physical health condition or diagnosis |
Mental or physical health condition or diagnosis (including pregnancy) |
Mental or physical health diagnosis |
Mental or physical health condition or diagnosis |
Mental or physical health condition, treatment or diagnosis |
Mental or physical health diagnosis |
Mental or physical health diagnosis |
Mental or physical health condition or diagnosis |
Mental or physical health diagnosis made by a health care provider |
Mental or physical health diagnosis |
Mental or physical health condition or diagnosis |
Consumer health data |
Mental or physical health diagnosis |
Mental or physical health condition or diagnosis |
Mental or physical health diagnosis |
Mental or physical health condition, diagnosis, disability or treatment; consumer health data |
| Personal information that reveals: Sex |
Sex life or sexual orientation |
Sexual orientation |
Sex life or sexual orientation |
Sex life or sexual orientation; status as nonbinary or transgender |
Sexual orientation |
Sexual orientation |
Sexual orientation and status as transgender or nonbinary |
Sexuality |
Information about a person’s sex life, sexual orientation |
Sex life, sexual orientation, and status as transgender or nonbinary |
Sexual orientation |
Sex life and sexual orientation |
Sex life or sexual orientation and status as transgender or non-binary |
Sexual orientation |
Sexual orientation |
Sexual orientation |
Sexual orientation |
Sexual orientation |
Sex life, sexual orientation |
Sex life, sexual orientation, and status as transgender or nonbinary |
Sexual orientation |
Sex life, sexual orientation |
Sexuality |
Sex life, sexual orientation, and status as nonbinary or transgender |
| Personal information that reveals: Email or SMS content of consumer |
The contents of a consumer’s mail, email, and text messages; unless the business is the intended recipient of the communication. |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
| Personal information that reveals: Genetic/biometric data |
Genetic data; biometric information processed to uniquely identify a consumer. |
Genetic or biometric data for the purpose of uniquely identifying a natural person |
Genetic or biometric data that may be processed for the purpose of uniquely identifying an individual |
Genetic or biometric data for the purpose of uniquely identifying an individual |
Genetic personal data or biometric data, if the processing is for the purpose of identifying a specific individual |
Genetic or biometric data processed to uniquely identify an individual |
Genetic or biometric data |
Genetic or biometric data that is processed for the purpose of uniquely identifying an individual |
Genetic or biometric data for the purpose of uniquely identifying an individual |
Genetic or biometric data |
Genetic or biometric data |
The processing of genetic or biometric data to uniquely identify an individual |
The processing of genetic or biometric data to uniquely identify an individual |
Genetic or biometric data processed to uniquely identify an individual |
Genetic or biometric data that is processed for the purpose of uniquely identifying an individual |
Biometric data or genetic information for the purpose of uniquely identifying an individual |
Genetic or biometric data that is processed for the purpose of uniquely identifying a specific individual |
Processing of genetic or biometric data that is processed for the purpose of uniquely identifying a specific natural person |
Processing of genetic or biometric data for the purpose of uniquely identifying an individual |
Genetic or biometric data |
Genetic or biometric data processed to uniquely identify an individual |
Genetic or biometric data processed to uniquely identify an individual |
Genetic or biometric data processed to uniquely identify an individual |
Genetic or biometric data |
| Neural data |
Neural data |
Not included |
Biological data and neural data |
Neural data (from July 1, 2026) |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Not included |
Neural data |
| Personal information that reveals: Information regarding minors |
Not included |
The personal data collected from a known child |
Personal data from a known child |
Personal data collected from a known child |
Not included |
Personal data of a known child (an individual under the age of 18) |
A child’s personal data |
Personal data collected from a known child |
Personal data collected from a known child |
Personal data of a known child (an individual under the age of 13) |
Personal data collected from a known child (any natural person younger than 13) |
Personal data of a known child (an individual under the age of 13) |
Personal data of a known child (an individual under the age of 13) |
Personal information collected from a known child (a natural person younger than 13) |
Personal data of a known child (an individual under the age of 13) |
Personal data of a known child (an individual under the age of 13) |
Personal data collected from a known child (an individual who is less than 13 years of age) |
Personal data collected from a known child (individual under the age of 13) |
Personal data collected from a known child (an individual who is less than 13 years of age) |
Personal data of a consumer the controller knows or has reason to know is a child (under 13) |
Personal data collected from a known child (under 13) |
Personal data collected from a known child (under 13) |
Personal data collected from a known child (under 13) |
Personal data collected from a child under 13 whom the controller knows or willfully disregards is a child |
* Please note that under the CPRA, consumers’ account log-in, password or credentials are considered sensitive personal information. When processing this kind of information for purposes other than those mentioned in Sec. 1798.121., subdivision (a) of the Civil Code, you are required to inform of and allow consumers to exercise the right to limit the use or disclosure of their sensitive personal information to those purposes. The exceptions include but are not limited to, processing for the purpose of performing services or providing goods requested by a consumer or for purposes that do not infer characteristics about the consumer. Please verify whether your sensitive personal information processing activities fall within the scope of such exceptions.
Exceptions
Similar exceptions apply under the other laws, including the VCDPA, CPA, CTDPA, and UCPA. However, there’s a slight difference:
- Under the CPRA, the exceptions apply only to the processing of sensitive personal information.
- Under the other US state laws, the exceptions apply to the processing of any type of personal information.
In other words, when controllers process personal data for one of the activities on the exceptions list, they don’t have to follow the applicable legal requirements.
Most of the exceptions are common to all legislations and include (among others):
- complying with federal, state, or local laws, rules, or regulations;
- complying with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by federal, state, local, or other governmental authorities;
- conducting internal research to improve, repair, or develop products, services, or technology;
- performing internal operations that the consumer could expect, based on their existing relationship with the controller;
- providing a product or service specifically requested by a consumer, performing a contract with a consumer, or prior to entering into a contract;
- protecting the vital interests of the consumer or of another individual;
- preventing, detecting, protecting against, or responding to security incidents, identity theft, fraud, harassment, or malicious, deceptive, or illegal activity;
- preserving the integrity or security of systems; or investigating, reporting, or prosecuting those responsible for any such action.
How can iubenda help manage sensitive personal information?
Sensitive personal information needs careful handling and is typically subject to additional processing requirements.
Did you know that generating a privacy policy with iubenda automatically connects it with our Privacy Controls and Cookie Solution?
What does this mean?
Once you’ve set up your privacy policy, our solution detects whether you’ve declared any sensitive personal information and configures your Privacy Controls and Cookie Solution accordingly.
In the Privacy and Cookie Policy Generator, select Enable disclosures for users residing in the United States to activate the US-specific clauses.
The Privacy and Cookie Policy Generator also provides US custom options.
If a type of personal information is also considered sensitive personal information under one of the US state laws, it’s automatically shown in the relevant section of your privacy policy.
Make sure you enable US State Laws in the Privacy Controls and Cookie Solution: the solution configures itself to help you meet the US requirements.
Heads up
Our solution supports only precise geolocation as a sensitive personal information category, as it’s the one connected to browsing and navigation. If you’ve declared categories other than precise geolocation in your privacy policy, you can’t manage the related choice mechanism through your Privacy Controls and Cookie Solution.
Not generated a privacy policy with us, or want to customize things yourself?
In the Privacy Controls and Cookie Solution, enable the US State Laws option to manage consent for the processing of users’ precise geolocation data (if applicable).
To do this, toggle on US State Laws and click Edit.
Next, click Manual configuration. From here, you can manage consent for the processing of precise geolocation data.
GPC and GPP support
iubenda supports both GPC signals and the IAB Global Privacy Platform (GPP). Our systems automatically detect and honor the GPC signal, which streamlines opt-out requests and removes the need for script tagging in the Privacy Controls and Cookie Solution.
Once you’re done editing, click the back button and we’ll save your preferences. Then finish your setup by clicking Confirm and Proceed.
Finally, click Complete the Configuration to see the embedding instructions.
Next steps: embed your solutions
These guides walk you through embedding our solutions, step by step: