CIPP/US Study Guide
Chapter 6: State Comprehensive Privacy Laws

Rights Concerning Sensitive Data and Nondiscrimination

Last reviewed:

Sensitive-data handling splits sharply: Colorado, Connecticut, Virginia require opt-in consent; Utah requires only notice and opt-out; California uses a more complex self-restrict-or-opt-out model. All five forbid discrimination against consumers who exercise their rights.

How sensitive personal information is handled
StateMechanism
Colorado, Connecticut, VirginiaOpt-in consent required to process sensitive data-
UtahNotice plus opportunity to opt out
CaliforniaComplex - business may self-restrict uses OR give notice and opt-out

The right to nondiscrimination prohibits businesses from punishing consumers who exercise privacy rights - examples include denying goods or services, charging different prices, or degrading quality. All five states provide this right.

Opt-in vs opt-out for sensitive data

Classic CIPP/US distinction: Colorado, Connecticut, and Virginia require OPT-IN consent for sensitive data; Utah only requires notice and OPT-OUT. California sits in between with a self-restrict-or-opt-out model.

Key terms - quick answers

What is “Right to nondiscrimination”?
The right not to be discriminated against (e.g., denied goods, charged different prices, given degraded quality) for exercising privacy rights; provided by all five states.

Keep going - free

Every study note on this site is free. So are these: