Yes. Controllers generally must obtain consent before processing sensitive data. Sensitive data includes specified information about race or ethnicity, religion, health diagnoses, sexuality, citizenship or immigration status, identifying genetic or biometric data, known children, and precise geolocation. Processing sensitive data about known children must comply with applicable COPPA requirements.
Consent must reflect a clear affirmative, freely given, specific, informed, and unambiguous agreement. Acceptance of broad terms containing unrelated information, passive interactions, and agreement obtained through dark patterns do not qualify.
Controllers selling sensitive or biometric personal data also must post the statute’s prescribed notices. Those notices do not replace applicable consent requirements.
For operational guidance and structured compliance documentation tools, visit the CLIClaw Privacy Compliance Library.
These FAQs provide general information and operational commentary. They are not legal advice. Applicability and compliance obligations depend on an organization’s activities, data practices, exemptions, and circumstances. It is intended as a starting point for understanding the issues discussed and should not be relied on as a substitute for advice from qualified legal counsel.
These materials were obtained directly from the Federal Government public website and are posted here for your review and reference only. No Claim to Original U.S. Government Works. This may not be the most recent version. The U.S. Government may have more current information. We make no guarantees or warranties about the accuracy or completeness of this information, or the information linked to. Please check the linked sources directly.