Sensitive personal data is a category with two definitions that overlap and do not match. California's consumer privacy statute defines sensitive personal information and attaches a right to limit its use. European law defines special categories and generally prohibits processing them unless a specific condition applies. A US company serving both has to know which list a field falls on, because the consequences are different.
What California puts on the list
Government identifiers such as social security, driver's license, state identification and passport numbers. Account log-in, financial account, debit or credit card numbers in combination with any required security code or credentials. Precise geolocation. Racial or ethnic origin, religious or philosophical beliefs, and union membership. The contents of mail, email and text messages where the business is not the intended recipient. Genetic data, biometric data processed to identify a person, health information, and information about sex life or sexual orientation.
What Europe puts on its list
Racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purpose of uniquely identifying a person, health data, and data concerning sex life or sexual orientation. Criminal convictions and offences sit under a separate rule of their own. The list is shorter than California's and the effect is stronger: processing is prohibited unless one of the named conditions applies, of which explicit consent is one.
The two different consequences
In California the duty is a right to limit: where a business uses or discloses sensitive personal information beyond a set of permitted purposes, the consumer may direct it to limit that use, and the business provides a link to do so. In Europe the duty is prior: you need a condition before you process at all, and holding the data without one is unlawful regardless of what anybody asks. One is a control you must offer; the other is a gate you must pass.
Where small companies hold it without noticing
A support inbox containing a customer explaining a medical reason for a refund. A recruitment process collecting dietary requirements that reveal religion. A delivery app keeping precise location rather than an address. A photograph used for face matching in an access system. A form field asking for a driver's license number for verification. Each is on one list or both, and none of them arrives labeled as sensitive.
Questions people ask about sensitive personal data
Is a date of birth sensitive?
Not on either list by itself. It is personal data and often a verification factor, so it deserves care, but it does not trigger the sensitive category rules.
Does inferring something sensitive count?
In California, inferences drawn to create a profile can themselves be personal information, and inferences about sensitive characteristics are treated as sensitive. In Europe, data from which a special category can be inferred is generally treated as special category.
Can we just avoid collecting it?
Usually the best answer, and the one worth trying first. If a field is not needed for a purpose you can name, removing it removes the whole obligation with it.