1. (a) The purpose of the Notice of Right to Limit is to inform consumers of their right to limit a business's use and disclosure of their sensitive personal information and to provide them with the opportunity to exercise that right. The purpose of the “Limit the Use of My Sensitive Personal Information” link is to immediately effectuate the consumer's right to limit, or in the alternative, direct the consumer to the Notice of Right to Limit. Accordingly, clicking the business's “Limit the Use of My Sensitive Personal Information” link will either have the immediate effect of limiting the use and disclosure of the consumer's sensitive personal information or lead the consumer to a webpage where the consumer can learn about and make that choice.
2. (b) The Notice of Right to Limit shall comply with section 7003, subsections (a) and (b).
3. (c) The “Limit the Use of My Sensitive Personal Information” link shall be a conspicuous link that complies with section 7003, subsections (c) and (d), and is located at either the header or footer of the business's internet homepage(s).
4. (d) In lieu of posting the “Limit the Use of My Sensitive Personal Information” link, a business may provide the Alternative Opt-out Link in accordance with section 7015. The business shall still post a Notice of Right to Limit in accordance with these regulations.

5. (e) A business that uses or discloses a consumer's sensitive personal information for purposes other than those specified in section 7027, subsection (m), shall provide the Notice of Right to Limit to consumers as follows:

   1. (1) A business shall post the Notice of Right to Limit on the internet webpage to which the consumer is directed after clicking on the “Limit the Use of My Sensitive Personal Information” link. The notice shall include the information specified in subsection (f) or be a link that takes the consumer directly to the specific section of the business's privacy policy that contains the same information. If clicking on the “Limit the Use of My Sensitive Personal Information” link immediately effectuates the consumer's right to limit, the business shall provide the notice within its privacy policy.
   2. (2) A business that does not operate a website shall establish, document, and comply with another method by which it informs consumers of their right to limit. That method shall comply with the requirements set forth in section 7003.

   3. (3) A business shall also provide the Notice of Right to Limit in the same manner in which it collects the sensitive personal information that it uses or discloses for purposes other than those specified in Section 7027, subsection (m). Illustrative examples and requirements follow.

      1. (A) A business that uses or discloses sensitive personal information that it collects in the course of interacting with consumers offline, such as in a brick-and-mortar store, for purposes other than those specified in section 7027, subsection (m), shall provide notice through an offline method (e.g., on the paper forms that collect the sensitive personal information or by posting signage in the area where the sensitive personal information is collected directing consumers to where the notice can be found online).
      2. (B) A business that uses or discloses sensitive personal information that it collects over the phone for purposes other than those specified in section 7027, subsection (m), shall provide notice orally during the call when the information is collected.
      3. (C) A business that uses or discloses sensitive personal information that it collects through a connected device (e.g., a smart television or a smart watch) for purposes other than those specified in section 7027, subsection (m), shall provide notice in a manner that ensures that the consumer will encounter the notice before or at the time the device begins collecting the personal information that it uses or discloses for those purposes.
      4. (D) A business that uses or discloses sensitive personal information that it collects in augmented or virtual reality, such as through gaming devices or mobile applications, for purposes other than those specified in section 7027, subsection (m), shall provide notice in a manner that ensures that the consumer will encounter the notice either: (1) before the consumer enters the augmented or virtual reality environment; or (2) before or at the time the business collects the personal information within the augmented or virtual reality environment.

6. (f) A business shall include the following in its Notice of Right to Limit:

   1. (1) A description of the consumer's right to limit; and
   2. (2) Instructions on how the consumer can submit a request to limit. If notice is provided online, the notice shall include the interactive form by which the consumer can submit their request to limit online, as required by section 7027, subsection (b)(1). If the business does not operate a website, the notice shall explain the offline method by which the consumer can submit their request to limit.

7. (g) A business does not need to provide a Notice of Right to Limit or the “Limit the Use of My Sensitive Personal Information” link if:

   1. (1) It only uses and discloses sensitive personal information that it collected about the consumer for the purposes specified in section 7027, subsection (m), and states so in its privacy policy; or
   2. (2) It only collects or processes sensitive personal information without the purpose of inferring characteristics about a consumer, and states so in its privacy policy.
8. (h) A business shall not use or disclose sensitive personal information it collected during the time the business did not have a Notice of Right to Limit posted for purposes other than those specified in section 7027, subsection (m), unless it obtains the consent of the consumer.

Note: Authority cited: Section 1798.185, Civil Code. Reference: Sections 1798.121, 1798.135 and 1798.185, Civil Code.

History

1. New section filed 3-29-2023; operative 3-29-2023 pursuant to Government Code section 11343.4(b)(3) (Register 2023, No. 13).

2. New subsections (e)(3)-(e)(3)(D) filed 9-22-2025; operative 1-1-2026 (Register 2025, No. 39).