---
title: "Ask before using sensitive data · Agent Wranglers"
url: https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws/us-sensitive-data-consent
id: CMP-58
level: Required
region: US
risk: law
updated: 2026-10-27
build: a2a6bdfed830
tokens: 684
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Ask before using sensitive data

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [US privacy and AI laws](https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: CMP-58
- Level: Required
- Chapter: [US privacy and AI laws](https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws.md)
- Rule: Process sensitive data only after an opt-in where any applying state requires it, and record each consent with its time and wording.
- Check: An integration test stores each sensitive field without a consent record, and the call is refused. With a consent record, it succeeds and the record holds a time and a wording version.
- Risk: A law broken
- Region: United States (US). The duty comes from the law there. The rule applies only when the project serves people there, and its Applies when also holds.
- How: Most states require opt-in consent for sensitive data. That includes health, precise location, race, religion, sexual orientation, biometrics and data about children. California instead gives a right to limit its use. Maryland goes further and bans the sale of sensitive data entirely. For children under 13, the federal COPPA rule applies, and its 2025 amendments must be met since 22 April 2026. Use the strictest applying rule for everyone, so one code path is enough. Store each consent as [Keep proof of consent](https://agentwranglers.se/playbook/notifications/channels-and-preferences/marketing-consent.md) says.

## Sources

- [COPPA Rule, 16 CFR Part 312](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-312)

## Related rules

- NTF-2 [Have consent before any marketing message](https://agentwranglers.se/playbook/notifications/channels-and-preferences/marketing-consent.md) in Notifications

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws/us-sensitive-data-consent">Agent Wranglers compliance and governance playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [List every sale and every share](https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws/sales-and-sharing-inventory.md)
- Next: [Track request deadlines by law](https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws/request-deadlines-by-law.md)
- [US privacy and AI laws](https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws.md)