HumenhukCIPP/US Study Guide
Chapter 6: State Comprehensive Privacy Laws

Rights Concerning Sensitive Data and Nondiscrimination

Reviewed by Victor Humenhuk. Published . Reviewed .

Sensitive-data handling splits sharply: Colorado, Connecticut, Virginia require opt-in consent; Utah requires only notice and opt-out; California uses a more complex self-restrict-or-opt-out model. All five forbid discrimination against consumers who exercise their rights.

How this supports CIPP/US study

Use this lesson to compare state-law scope, rights, exceptions and enforcement before choosing an answer. Continue with the CIPP/US exam questions.

How sensitive personal information is handled
StateMechanism
Colorado, Connecticut, VirginiaOpt-in consent required to process sensitive data-
UtahNotice plus opportunity to opt out
CaliforniaComplex - business may self-restrict uses OR give notice and opt-out

The right to nondiscrimination prohibits businesses from punishing consumers who exercise privacy rights - examples include denying goods or services, charging different prices, or degrading quality. All five states provide this right.

Opt-in vs opt-out for sensitive data

Classic CIPP/US distinction: Colorado, Connecticut, and Virginia require OPT-IN consent for sensitive data; Utah only requires notice and OPT-OUT. California sits in between with a self-restrict-or-opt-out model.

Key terms - quick answers

What is “Right to nondiscrimination”?
The right not to be discriminated against (e.g., denied goods, charged different prices, given degraded quality) for exercising privacy rights; provided by all five states.

Sources and study method

This independent lesson uses active recall, spaced retrieval and scenario practice. Read the full study method.