---
title: "Ask before using sensitive data · Agent Wranglers"
url: https://agentwranglers.se/playbook/compliance/us-state-privacy-laws/us-sensitive-data-consent
updated: 2026-10-20
licence: "All rights reserved"
---

# Ask before using sensitive data

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [US state privacy laws](https://agentwranglers.se/playbook/compliance/us-state-privacy-laws)
- Rule: Process sensitive data only after an opt-in where any applying state requires it, and record each consent with its time and wording.
- How: Most states require opt-in consent for sensitive data. That includes health, precise location, race, religion, sexual orientation, biometrics and data about children. California instead gives a right to limit its use. Maryland goes further and bans the sale of sensitive data entirely. For children under 13, the federal COPPA rule applies, and its 2025 amendments must be met since 22 April 2026. Use the strictest applying rule for everyone, so one code path is enough.
- Check: An integration test stores each sensitive field without a consent record, and the call is refused. With a consent record, it succeeds and the record holds a time and a wording version.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers compliance playbook: https://agentwranglers.se/playbook/compliance/us-state-privacy-laws/us-sensitive-data-consent`.

- Previous: [List every sale and every share](https://agentwranglers.se/playbook/compliance/us-state-privacy-laws/sales-and-sharing-inventory)
- Next: [Track request deadlines by law](https://agentwranglers.se/playbook/compliance/us-state-privacy-laws/request-deadlines-by-law)
- [US state privacy laws](https://agentwranglers.se/playbook/compliance/us-state-privacy-laws)