What is personal information?
Personal information may mean different things to different people. Fortunately, California law gives us a clear definition. Under the California Consumer Privacy Act, personal information includes any data that identifies, relates to, or could reasonably be linked to you or your household, directly or indirectly.
Personal information includes:
- Name or nickname
- Email address
- Purchase history
- Browsing history
- Location data
- Employment data
- IP address
- Profiles businesses create about you, including pseudonymous profiles (“user1234”)
- Sensitive personal information
What is sensitive personal information?
Sensitive personal information is a specific subset of personal information that describes certain types personal information that are more sensitive in nature. You have the right to limit a business’s use and disclosure of your sensitive personal information to only certain purposes under the law.
Sensitive personal information includes:
- Social security or passport number, driver’s license, or state ID
- Financial account credentials
- A consumer’s precise geolocation
- Racial or ethnic origin, citizen or immigration status, religious or philosophical beliefs, or union membership
- Contents of messages (e.g., emails, texts, chats), unless it’s directed to the business
- Genetic data
- Biometrics, like facial recognition
- Information concerning your health, sex life, or sexual orientation
How does a business get my personal information?
Businesses can collect information about you in several ways, such as:
You provide it directly to the business.
For example, signing up for a news site, buying a product, or creating an account with a streaming service.
The business collects your information in the background.
For example, a business may use cookies or web beacons to record the browser you used to visit the business, the website you visited before you visited the business, or your IP address.
The business collects information about the actions you take online, including via smart devices.
For example, a business may collect information about what you post on a social media site, phone calls you make, or videos you watch.
The business buys information about you.
For example, a business may purchase a list of people who have signed up for a dating app to target them for gym membership ads.