Agent WranglersUS state privacy laws Required
Ask before using sensitive data
Process sensitive data only after an opt-in where any applying state requires it, and record each consent with its time and wording.
How to do it
Most states require opt-in consent for sensitive data. That includes health, precise location, race, religion, sexual orientation, biometrics and data about children. California instead gives a right to limit its use. Maryland goes further and bans the sale of sensitive data entirely. For children under 13, the federal COPPA rule applies, and its 2025 amendments must be met since 22 April 2026. Use the strictest applying rule for everyone, so one code path is enough.
How to check
An integration test stores each sensitive field without a consent record, and the call is refused. With a consent record, it succeeds and the record holds a time and a wording version.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers compliance playbook: https://agentwranglers.se/playbook/compliance/us-state-privacy-laws/us-sensitive-data-consent.