After the recent Court of Justice of the European Union decision on sensitive inferences that can be drawn from the name of your spouse, it is fair to ask: Is everything sensitive data (special category data)?

Katie Hewson of Stephenson Harwood and I were duly skeptical earlier this month at the 7th annual INPLP Annual Conference in Vienna, Austria.


  • It IS a CJEU decision
  • The definition of sensitive information under the new US privacy laws is Article 9 GDPR, plus more
  • Sensitive inferences are a point of focus for the Federal Trade Commission and at issue in the new FTC Kochava case
  • Sensitive inferences take on a new significance in the wake of the Dobbs decision
  • Inferences are personal information and should be included in your response to CA access requests, along with, according to the California Attorney general, a detailed explanation of how the inferences were made (algorithmic transparency)
  • Sensitive inferences are addressed in the draft Colorado CPA rules
  • The NAI recently addressed them in a guidance regarding the advertising context.

And as a bonus:

  • Sensitive inferences could be part of the new CPRA right to limit use of sensitive information, and in the Colorado CPA required opt in.