CCPA Sensitive Data and AI Inferences: What SaaS Companies Must Know
When your AI infers that a California user is pregnant, financially stressed, or has a chronic illness — even from indirect signals — that inference is personal information under CCPA. If it touches a sensitive category, opt-in consent may be required. Most AI teams haven't audited this.
What CCPA Says About AI-Derived Inferences
The California Consumer Privacy Act, as amended by CPRA, defines personal information broadly enough to capture the outputs of AI systems — not just the inputs. Section 1798.140 explicitly includes "inferences drawn from any of the information identified in this subdivision to create a profile about a consumer reflecting the consumer's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes" as a category of personal information.
This matters because many AI teams focus CCPA compliance on the data they collect and overlook what their models derive. A recommendation engine that infers a user's political views from reading behavior. A health app that infers pregnancy from product searches. A financial tool that infers credit risk from behavioral patterns. All of these generate CCPA-covered personal information, and all are subject to consumer rights including the right to know, the right to delete, and — if they touch sensitive categories — the right to limit use.
The Sensitive Personal Information Categories
CPRA created a new tier within CCPA — sensitive personal information (SPI) — that receives heightened protection. Consumers have a right to direct businesses to limit the use and disclosure of SPI to what is necessary for the core purpose of the interaction. For SPI uses beyond that core purpose, opt-in consent is generally required.
The SPI categories are:
Social Security / Government IDs
SSNs, driver's license numbers, state ID numbers, passport numbers
Financial Account Credentials
Account numbers with access codes, login credentials, card numbers with PINs — not balance data
Precise Geolocation
Location within 1,850 feet of the consumer's actual location
Race and Ethnic Origin
Explicitly a protected characteristic triggering heightened rules
Religious or Philosophical Beliefs
Including inferences about religion derived from behavioral data
Union Membership
Status as a union member or activities related to union organizing
Private Communications
Contents of mail, email, and text messages unless the business is the intended recipient
Genetic Data
Individual-level genetic data including genetic test results
Biometric Data for ID
Biometric information used or intended to be used to identify an individual
Health and Medical Information
Personal information about health conditions, diagnoses, treatments, or medical history
Sex Life / Sexual Orientation
Including inferences about sexual orientation derived from any data source
The AI Inference Problem: When Derivation Becomes SPI
Here's where AI teams frequently get it wrong: they assume that because they didn'tcollect a sensitive attribute, they don't have SPI. But CCPA's inference definition closes that gap. If your AI derives a conclusion that falls within an SPI category — from whatever inputs — the resulting inference is SPI.
Health Inference from Behavioral Data
HighScenario: A wellness app AI infers that a user has diabetes based on meal logging patterns, step count data, and product searches.
The inference is health SPI even though no medical record was collected. The right to limit use applies.
Financial Stress Inference from Engagement Patterns
HighScenario: A fintech app AI infers financial hardship or credit risk from late bill-pay notifications, spending category shifts, and overdraft patterns.
If this inference is used beyond the core service — e.g., sold to lenders or used in marketing targeting — opt-in is required.
Race/Ethnicity Inference from Name or Location Data
CriticalScenario: A marketing AI infers likely ethnicity from name patterns and ZIP code to segment for targeted advertising.
Racial/ethnic origin is explicit SPI. Any use beyond the core service requires opt-in consent. Using racial inferences for ad targeting is a significant compliance exposure.
Religious Belief Inference from Content Preferences
HighScenario: A content recommendation AI detects consumption of religious content and tags users with religious affiliation inferences to personalize content.
Religious belief is SPI. Profiling users by religion for purposes beyond serving religiously relevant content raises opt-in requirements.
Sexual Orientation Inference from Social Graph
CriticalScenario: An AI analyzes social connections, interests, and engagement patterns to infer sexual orientation for ad targeting.
Sexual orientation is explicit SPI. This scenario is almost certainly outside any permissible core-service purpose and requires opt-in at minimum — and may violate other California non-discrimination law.
The Right to Limit Use of Sensitive Personal Information
CPRA adds a new consumer right that doesn't exist for regular personal information: the right to direct a business to limit the use and disclosure of their SPI. When a consumer exercises this right, a business may only use their SPI for:
- Performing the services or providing the goods reasonably expected based on the consumer's relationship with the business
- Detecting security incidents, protecting against fraud, and ensuring physical safety
- Short-term, transient use that doesn't involve building consumer profiles
- Maintaining or servicing accounts, providing customer service, processing transactions
- Undertaking activities to verify or maintain the quality or safety of the service
Any use of SPI outside these permitted purposes — including using sensitive inferences to train other AI models, selling SPI to data brokers, or targeting advertising based on sensitive attributes — requires opt-in consent when the consumer has exercised their right to limit. Businesses must add a clear and conspicuous "Limit the Use of My Sensitive Personal Information" link where required.
The Coming ADMT Rules: Opt-Out for AI Profiling
Separately from the SPI framework, the California Privacy Protection Agency (CPPA) is finalizing Automated Decision-Making Technology (ADMT) regulations. These rules will require businesses that use AI for significant decisions — including profiling consumers for advertising, employment, or credit — to provide opt-out rights and, in certain cases, access to information about the logic used.
When the ADMT rules finalize, AI tools that profile California consumers for targeted advertising, pricing optimization, or risk scoring must offer a clear opt-out path. Teams should be building the infrastructure now — the CPPA has indicated the rules are close to final, and enforcement under existing CCPA authority already reaches many AI profiling uses.
Compliance Checklist for AI Teams Handling Sensitive Data
Audit & Inventory
- ☐Map every AI model that generates inferences about California residents
- ☐Document what input data feeds each model and what output inferences it produces
- ☐Tag any output category that touches SPI (health, finances, race, religion, location, biometric, sexual orientation)
- ☐Identify downstream uses: internal personalization, ad targeting, model training, third-party sharing
Rights Infrastructure
- ☐Add 'Limit the Use of My Sensitive Personal Information' link where SPI is processed beyond core service
- ☐Build deletion workflows that cover AI-derived inferences, not just raw collected data
- ☐Update privacy policy to disclose inference categories and their purposes
- ☐Create a consent flow for SPI use beyond the permitted purposes list
Vendor Contracts
- ☐Review data sharing agreements — SPI passed to vendors may trigger service provider contract requirements
- ☐Confirm that AI vendors processing California consumer data are bound by appropriate data processing terms
- ☐Check whether AI training data contains SPI and whether sharing it with model providers is permissible
Prepare for ADMT Rules
- ☐Inventory all automated decision-making uses (advertising, credit, employment, health) affecting California residents
- ☐Design opt-out flows for AI profiling before ADMT rules finalize
- ☐Document the logic behind significant automated decisions to support access requests
Frequently Asked Questions
Our AI doesn't explicitly ask for sensitive data — it infers it. Does CCPA still apply?
Yes. The inference definition in CCPA doesn't distinguish between data the consumer provided and data derived by AI. If your AI concludes that a user has a health condition, holds a religious belief, or has a particular sexual orientation — regardless of whether that attribute was ever disclosed directly — the inference is personal information, and if it falls in an SPI category, it's sensitive personal information with all associated rights.
We use AI inferences internally only, never shared with third parties. Are we still covered?
Yes. CCPA applies to the use of personal information, not just its disclosure. Using SPI beyond the permitted core-service purposes — including using it to make internal decisions about the consumer that are outside their reasonable expectation — triggers the right to limit use. The consumer can restrict how you use their SPI even if you never sell or share it.
How specific do we have to be when disclosing the categories of inferences we derive?
Your privacy policy must disclose the categories of personal information collected and the purposes for which they'll be used. For inferences, you must disclose that you derive inferences and the categories of inferences you create. You don't need to reveal specific inferences (e.g., the specific health condition inferred for a specific user) if doing so would reveal a trade secret, but the category-level disclosure is required.
Do these rules apply to B2B AI tools that process employee data rather than consumer data?
CCPA has historically applied to California consumers, with certain exemptions for employee and B2B data that have fluctuated with legislative amendments. As of 2026, employee data is generally subject to CCPA in California. If your AI tool processes employee personal information — including inferences about employee behavior, health, or performance — CCPA obligations apply, including SPI protections for relevant categories.
Audit Your AI's Outputs, Not Just Its Inputs
Most privacy audits start and end with data collection. Under CCPA's inference framework, that's insufficient for AI-powered products. What your model concludes about California residents is as regulated as what they told you directly.
Map your AI's output categories, flag any that touch SPI, and build the right-to-limit-use infrastructure before the CPPA comes looking. The ADMT rules are coming too — the businesses prepared to offer AI profiling opt-outs will clear procurement faster than those scrambling to build it after enforcement action.