Sensitive data
Sensitive data is the personal data that privacy laws protect most strictly, such as health, racial or ethnic origin, religion, sexual orientation, biometrics and genetics, because its misuse can lead to discrimination or serious harm.Article 9(1) of the GDPR calls them special categories and prohibits processing personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, and processing genetic data, biometric data for uniquely identifying a person, data concerning health, or data concerning a person's sex life or sexual orientation. Article 9(2) lists the exceptions, the first of which is explicit consent.
California's list, "sensitive personal information" in Cal. Civ. Code 1798.140(ae), is broader. It adds government identifiers such as social security and passport numbers, account log-in or card numbers with their access codes, precise geolocation, citizenship or immigration status, the contents of mail, email and texts, and neural data. Consumers can limit its use under section 1798.121, through a link titled "Limit the Use of My Sensitive Personal Information".
Websites reach this category without meaning to. The Court of Justice held in Meta Platforms v Bundeskartellamt (C-252/21, 4 July 2023) that data collected about visits to websites or apps can fall under Article 9 when it reveals such information. A pixel on a clinic's booking page or a pharmacy's product pages is the usual example, and it calls for extra care before any marketing cookies are allowed there.