California Vetoed a Ban on Selling Sensitive Data. Which States Have One?

What Would AB 1542 Have Done?

AB 1542 would have amended the California Consumer Privacy Act (CCPA) to prohibit the sale of sensitive personal information. Its core provision read, "a business, service provider, or contractor shall not sell or share sensitive personal information to a third party." Sensitive personal information includes precise location, health information, government ID numbers, and immigration status, among several other categories. The ban would not have applied when a consumer directs the business to disclose the information to a third party.

The Legislature sent the bill to the Governor on September 9. He returned it without his signature on September 27, writing that "a categorical ban on sharing that information is a step too far." He noted that California already gives consumers the option to limit the sharing of sensitive information and warned of "unintended consequences if consumers are removed entirely from the decision process." He also cited enforcement costs that were not included in the state budget.

What Does California Allow Today?

California regulates the sale of sensitive personal information through consumer choice. Under Civil Code section 1798.135, a business that sells or shares it must offer two links, "Do Not Sell or Share My Personal Information" and "Limit the Use of My Sensitive Personal Information," or a single link that does both. A consumer who uses one of these links, or whose browser sends an opt-out preference signal, can stop the sale. Without an opt-out request in any of these forms, the sale can continue.

California defines a sale broadly, as an exchange of personal information for money or "other valuable consideration." This is how, unintuitively, the use of ordinary advertising and even analytics trackers can qualify as a sale without any money changing hands. An app or website that collects a visitor's precise location can pass it to advertising partners the same way. Civil Code section 1798.140 defines precise location as location within a radius of 1,850 feet.

Which States Ban the Sale of Sensitive Data?

Maryland and New Jersey ban the sale of all sensitive data, while Oregon, Virginia, and Connecticut ban the sale of precise location data only. All five bans took effect between October 2025 and October 2026. Texas and Florida allow the sale but require a specific notice, in addition to the consent that most state privacy laws require before a business processes sensitive data. The table lists each of these states' approaches, with California included for comparison.

Based on each state's statute or enacted act, as of October 2026.

The bans are not identical. For example, New Jersey sets a penalty of $50,000 for each record sold. Virginia defines a sale as an exchange for money only, so its ban may not reach advertising tools that trade data for a service. Connecticut still allows the sale of other sensitive data with the consumer's consent.

What Does This Mean for a Business?

Many businesses default to handling personal data the same way for customers in every state, whether it moves through website tags, app software, or data shared directly with partners and vendors. A sale of sensitive data that is lawful in one state may be prohibited in another, so a business that sells it has to account for this and handle it differently for consumers in each state.

Then, the privacy notice has to reflect those differences. Texas requires a business that sells sensitive data to post the exact sentence "NOTICE: We may sell your sensitive personal data." Louisiana will require it too, starting January 1, 2027. The same sentence, read by a Maryland or New Jersey resident, describes a practice that those states prohibit.

I recommend that a business first confirm whether it sells sensitive data at all, through any channel. That includes precise location sent to advertising partners, customer lists shared with marketing partners, and data provided to data brokers. If it does, each of those channels may need special rules that apply by state, based on the visitor's location online and the consumer's address in customer records. The notice can then describe each state's rules in state-specific sections, rather than one statement that is accurate in some states and an admission of a violation in others.