Agent Wranglers

CMP-58Required US law

Ask before using sensitive data

Process sensitive data only after an opt-in where any applying state requires it, and record each consent with its time and wording.

By Agent Wranglers. Updated .

Region

United States (US). The duty comes from the law there. The rule applies only when the project serves people there, and its Applies when also holds.

How to do it

Most states require opt-in consent for sensitive data. That includes health, precise location, race, religion, sexual orientation, biometrics and data about children. California instead gives a right to limit its use. Maryland goes further and bans the sale of sensitive data entirely. For children under 13, the federal COPPA rule applies, and its 2025 amendments must be met since 22 April 2026. Use the strictest applying rule for everyone, so one code path is enough. Store each consent as Keep proof of consent says.

How to check

An integration test stores each sensitive field without a consent record, and the call is refused. With a consent record, it succeeds and the record holds a time and a wording version.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws/us-sensitive-data-consent">Agent Wranglers compliance and governance playbook</a>. In code you write, add a comment next to it with the same link.