The California Consumer Privacy Act (CCPA) sorts personal information into 11 categories in Civil Code section 1798.140(v)(1): identifiers, customer records, protected classifications, commercial information, biometric information, internet activity, geolocation, sensory data, professional information, education information and inferences. Sensitive personal information sits on top of them as a separately regulated subset. The definition covers data that identifies, relates to, describes or could reasonably be linked to a specific consumer or household, and that household element sets it apart from the GDPR: data tied to a shared device qualifies. For website owners, the question is which categories your site actually collects. A single analytics cookie can touch three or four at once.
How the CCPA defines personal information
Section 1798.140(v) of the Civil Code defines personal information as any data that "identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household." It captures not just obvious identifiers but also behavioural data, device identifiers, and inferences drawn from other collected data. Every right in the CCPA applies to data that meets this definition.
The inclusion of "household" means shared-device data qualifies even when no single person is identified. The phrase "reasonably capable of being associated with" sets a lower bar than requiring direct identification. And the statute names cookies, beacons and pixel tags in its definition of a unique identifier. Publicly available government records, de-identified data, and aggregate consumer information are excluded.
The 11 categories of personal information under the CCPA
The CCPA organises personal information into 11 enumerated categories, codified in Section 1798.140(v)(1) as letters A to K. Businesses must disclose which they collect, sell, or share in their privacy policy and notice at collection.
| Category | Examples | Collected via cookies or tracking? |
|---|---|---|
| 1. Identifiers | Name, email, IP address, account name, cookie ID, device identifier | Yes - cookie IDs, IP addresses, device identifiers |
| 2. Customer records | Name, signature, address, phone, bank or credit card number, insurance or medical information | Rarely - typically collected via forms, not cookies |
| 3. Protected classifications | Race, religion, gender, sexual orientation, age, disability, nationality | Indirectly - if inferred from browsing patterns or ad targeting |
| 4. Commercial information | Purchase records, products viewed or considered, shopping cart contents | Yes - e-commerce tracking cookies, remarketing pixels |
| 5. Biometric information | Fingerprints, facial recognition data, voiceprints, iris scans, keystroke patterns | Rarely via standard websites |
| 6. Internet or network activity | Browsing history, search history, interactions with a website or advert | Yes - analytics cookies, ad pixels, session recordings |
| 7. Geolocation data | GPS coordinates, IP-based location, Wi-Fi triangulation | Yes - IP geolocation, location-based advertising |
| 8. Sensory data | Audio, video, thermal, olfactory, or similar recordings | Occasionally - session replay recordings, voice or video features |
| 9. Professional or employment data | Job title, employer, work history, performance reviews | Rarely - more common in HR systems and B2B lead enrichment |
| 10. Education information | School records, grades, student status (non-public, as defined by FERPA) | Rarely via standard websites |
| 11. Inferences | Consumer profiles reflecting preferences, behaviour, psychological trends, predispositions, attitudes | Yes - ad platforms and analytics tools routinely create audience segments and interest profiles |
The current text of the statute adds sensitive personal information to the same list as item (L), which is why some summaries count 12. Categories 1, 4, 6, 7, and 11 are the ones most website owners encounter through cookies. A typical stack with Google Analytics, a Meta Pixel, and a remarketing tag touches all five.
One checkout page view with GA4 and a Meta Pixel
Sensitive personal information sits on top of the 11 categories
The California Privacy Rights Act (CPRA), which amended the CCPA and took effect on 1 January 2023, introduced a higher-risk subset called sensitive personal information (SPI). This concept is similar to the GDPR's special categories of data, though California's version includes some items the GDPR does not.
SPI under the statute includes government identifiers, account log-ins and financial credentials, precise geolocation, racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, union membership, the contents of mail, email and text messages, genetic data, neural data, biometric data used to identify someone, health information, and information about sex life or sexual orientation. The CCPA regulations in force since 1 January 2026 add personal information of consumers the business knows are under 16 to the regulatory definition (approved on 23 September 2025).
Consumers have a right to limit how a business uses SPI. A business that uses or discloses SPI beyond the purposes the regulations allow must display a "Limit the Use of My Sensitive Personal Information" link or combine it with the "Do Not Sell or Share" link. For most standard websites, cookie categories like analytics and marketing do not typically collect SPI. The exception is precise geolocation: data derived from a device that locates someone within a circle of 1,850 feet qualifies as sensitive, while city-level IP approximations do not.
What cookies and tracking technologies collect under the CCPA
Cookies are named in the statute's definition of a unique identifier. The law treats cookie data the same way it treats a name or email address - as personal information subject to disclosure, access, and deletion rights.
Google Analytics (_ga) touches identifiers, internet activity, and geolocation - plus inferences if you use audience segments. Meta Pixel (_fbp) collects identifiers, internet activity, commercial information (purchase tracking), and geolocation. Session replay tools (Hotjar, FullStory) capture internet activity and may record sensory data depending on configuration.
A cookie scan is the fastest way to map which categories your tracking technologies touch. Guessing incorrectly in a CCPA enforcement investigation is not a defence.
CCPA and GDPR classify personal data differently
The CCPA and the GDPR both cast a wide net, but they structure classifications differently. The GDPR defines personal data broadly under Article 4(1) and carves out special categories under Article 9, rather than enumerating 11 fixed categories.
| Feature | CCPA (as amended by the CPRA) | GDPR |
|---|---|---|
| Definition scope | Consumer or household | Identified or identifiable natural person |
| Enumerated categories | 11 statutory categories | No fixed list - broad definition plus special categories under Article 9 |
| Sensitive data tier | Sensitive personal information | Special categories of data (Article 9) |
| Cookies explicitly named | Yes - in the definition of a unique identifier | Not explicitly, but covered via the ePrivacy Directive and EDPB guidance |
| Consent model for cookies | Opt-out (opt-in only to sell or share data of known minors under 16, right to limit for SPI) | Opt-in (prior informed consent) |
| Household data included | Yes | No |
| Inferences as a category | Yes - explicitly listed as Category 11 | Not a standalone category, but profiling is regulated under Article 22 |
| Maximum penalty | $2,663 per violation / $7,988 per intentional violation or one involving a known minor under 16 (set from 1 January 2025) | Up to 20 million EUR or 4% of global annual turnover |
The key practical difference: under the GDPR and ePrivacy Directive, non-essential cookies require prior opt-in consent. Under the CCPA, cookies can fire by default, but consumers must be able to opt out of the sale or sharing of their personal information, and you must honour GPC browser signals. If your visitors come from both regions, the overview of global privacy laws shows which model each region uses.
How to classify and map your website's data
Data classification is not a one-off exercise. New cookies appear when you add widgets, swap analytics providers, or embed social feeds. Running a classification on a schedule keeps your privacy disclosures accurate and your consumer rights responses defensible.
Step 1: Audit your cookies and tracking scripts
Use a cookie scanner to identify every cookie, pixel, and script on your site. Kukie.io's scanner detects cookies across your pages and groups them by purpose and provider.
Step 2: Map each cookie to a CCPA category
For each cookie or tracker, determine which of the 11 categories it touches. A single cookie often spans multiple categories. Document these mappings in a data inventory.
Step 3: Identify any sensitive personal information
Check whether any tracking technologies collect precise geolocation, biometric data, data from visitors you know are under 16, or other SPI. If you use that data beyond the purposes the regulations allow, you need the "Limit the Use" link.
Step 4: Update your privacy disclosures
Your privacy policy must list the categories collected, the sources, the business purposes, and the third parties involved. The CCPA requires updates at least every 12 months.
Step 5: Implement opt-out mechanisms
Provide a "Do Not Sell or Share My Personal Information" link and honour GPC signals. If you collect SPI for other purposes, add the "Limit the Use" link as well.
What enforcement shows about the categories
Several California cases turned on these categories. In July 2025, the Attorney General settled with Healthline Media for $1.55 million after it shared data that could link a reader to article titles suggesting a medical diagnosis, an inference about health, with advertisers. In May 2026, the Attorney General announced a $12.75 million settlement with General Motors over the sale of drivers' location and driving data, the largest CCPA penalty to date according to the Attorney General's list of enforcement actions.
The earlier Attorney General settlements with Sephora ($1.2 million, 2022) and DoorDash ($375,000, 2024) concerned undisclosed sales and opt-outs. The California Privacy Protection Agency (CPPA) fined Tractor Supply $1.35 million in September 2025, in part for a privacy policy that did not tell consumers their rights.
As of October 2026, the CPPA's inflation-adjusted amounts set from 1 January 2025 apply: up to $2,663 per violation and $7,988 per intentional violation or one involving the data of a known minor under 16. The next adjustment is due in January 2027. Each affected consumer can count as a separate violation, so a single failure affecting thousands of California visitors can escalate into a seven-figure penalty.
Short answers on CCPA data categories
How many categories of personal information does the CCPA define?
The CCPA defines 11 categories of personal information in Section 1798.140(v)(1), lettered A to K. These range from direct identifiers (names, IP addresses, cookie IDs) to inferences drawn from other collected data. The current text also lists sensitive personal information as item L. Businesses must disclose which categories they collect in their privacy policy.
Are cookies considered personal information under the CCPA?
Yes. The CCPA names cookies, pixel tags, and beacons in its definition of a unique identifier, which is part of the identifiers category. Any cookie that assigns a unique identifier to a visitor, such as Google Analytics' _ga cookie, qualifies as personal information under Category 1 (identifiers).
What is the difference between personal information and sensitive personal information under the CCPA?
Personal information is the broad category covering any data reasonably linkable to a consumer or household. Sensitive personal information (SPI), introduced by the CPRA, is a subset that includes higher-risk data such as government IDs, financial credentials, precise geolocation, biometric data, and information about health or sexual orientation. Consumers have the additional right to limit SPI use.
Does the CCPA require opt-in consent for cookies like the GDPR does?
No. The CCPA follows an opt-out model for most data collection. Cookies can fire by default, but businesses must provide a "Do Not Sell or Share My Personal Information" link and honour Global Privacy Control signals. Opt-in consent is required only to sell or share the data of consumers known to be under 16. For sensitive personal information, consumers get a right to limit its use, not an opt-in.
What CCPA categories does Google Analytics data fall into?
Google Analytics data typically falls into at least three CCPA categories: identifiers (the _ga client ID), internet or network activity (pages visited, session duration, referral sources), and geolocation data (IP-based location). If you build audience segments or remarketing lists, it also generates data in the inferences category.
How often must a business update its CCPA data classification disclosures?
The CCPA requires businesses to update their privacy policy at least every 12 months with current information about the categories of personal information collected, the sources, the purposes, and the third parties involved. The CPPA's 2025 decision against Tractor Supply cited a privacy policy that did not tell consumers about their rights.
Can household data collected through shared devices qualify as personal information?
Yes. The CCPA's definition extends to data linked to a household, not just an individual. This means cookies or tracking data associated with a shared device or home IP address can qualify as personal information even if no specific person is identified, a distinction the GDPR does not make.
Map what your site collects before you write the policy
A privacy policy can only list the categories you know about. Kukie.io scans your site, sorts the cookies it finds by purpose and provider, and gives visitors a "Do Not Sell or Share" choice that also honours GPC where you use an opt-out model.
