If you're building a sensitive data inventory, you've likely noticed that "sensitive" means different things in different states. This is especially true for gender and sexuality data. States like Colorado, Connecticut, Florida, Indiana, Montana, Oregon, Tennessee, Texas, and Virginia require consent for sensitive data collection, but they don't agree on what counts as sensitive regarding gender identity, sexual orientation, or sex life.
This checklist helps you identify what's sensitive in each jurisdiction where you operate and configure your systems accordingly.
Prerequisites
Before you start, confirm:
- You've mapped which state laws apply to your organization based on revenue, resident count, and data processing activities.
- You have access to your data inventory or can query what categories of personal information you collect.
- You can identify the business purpose for collecting gender, sexuality, or related demographic data.
- Your Consent Management Platform can segment consent requirements by user location.
If you're collecting this data but can't articulate why, stop and conduct a necessity review first.
Checklist Items
1. Identify every field that captures gender or sexuality information
Document each form field, profile attribute, survey question, or inferred data point related to gender identity, sexual orientation, sex life, or transgender/nonbinary status. Include fields like "pronouns," "partner gender," "dating preferences," or "health services accessed" that may reveal this information indirectly.
2. Map your data to state-specific definitions
Determine whether each field qualifies as sensitive data under each applicable state law based on that state's specific terminology. For example, "sexual orientation" is sensitive in California (defined as heterosexuality, homosexuality, or bisexuality), Oregon, Delaware, Tennessee, Texas (if "sexuality" encompasses orientation), and under GDPR. "Transgender status" is explicitly sensitive only in Oregon and Delaware.
3. Resolve definitional ambiguity in your compliance posture
Decide how to treat undefined terms in states where you operate. For instance, Texas uses "sexuality" without defining it. Document your interpretation for each ambiguous term, erring toward the broader definition. Revisit these interpretations annually.
4. Configure consent flows by state and data type
Ensure your CMP presents consent requests that match each state's requirements. For example, Oregon and Delaware users should see consent requests for "transgender or nonbinary status," while Texas users see requests covering "sexuality."
5. Account for indirect disclosure
Identify combinations of non-sensitive data that reveal sensitive categories. In Oregon and Delaware, collecting both "gender assigned at birth" and "current gender identity" may reveal transgender status. Apply consent requirements to the data combination.
6. Audit inference and derived attributes
Review any algorithms, models, or business logic that infer sexual orientation, gender identity, or sex life from behavioral data. Document what you infer, from what inputs, and whether the inference creates sensitive data under any applicable state law.
7. Validate data protection impact assessment triggers
Confirm whether your sensitive data processing triggers a data protection impact assessment requirement in states like Colorado, Connecticut, and others. Complete an assessment for any processing activity involving sensitive data or document why it's not required.
8. Check for Data Protection Officer appointment requirements
If you process large amounts of special categories of data under GDPR, determine whether you must appoint a Data Protection Officer. Either appoint a DPO or document that your processing volume doesn't meet the "large scale" threshold.
9. Review state-specific legal definitions that expand or contract scope
Check whether states where you operate have statutory definitions that broaden or narrow what counts as sensitive. For instance, Montana's SB 458 created a definition of "sex" that makes transgender and nonbinary status legally unrecognizable.
10. Document your consent records with jurisdiction-specific labels
Tag each consent record with the state law under which consent was obtained and the specific sensitive data category consented to. This precision is crucial if you need to demonstrate compliance during an investigation.
Common Mistakes
Assuming "sexual orientation" has a universal definition. Definitions vary by state, so you can't apply one state's definition across your entire consent flow.
Treating gender identity as uniformly sensitive. It's explicitly sensitive only in Oregon and Delaware. In other states, it may be sensitive only if it reveals sexual orientation or is part of "sex life."
Overlooking indirect disclosure. Collecting certain combinations of data may reveal sensitive information, requiring consent even if each field alone might not.
Ignoring inference. If you derive sensitive data from behavioral signals, you're creating sensitive data that requires consent.
Next Steps
Once you've completed this checklist, schedule a quarterly review. State privacy laws are evolving rapidly, and courts haven't yet interpreted many of these undefined terms. When Texas courts rule on what "sexuality" means, or when Colorado clarifies which definition of "sexual orientation" applies to its privacy act, you'll need to update your compliance matrix and potentially re-consent users.
If you're collecting gender or sexuality data without a clear business necessity, consider whether you need it at all. The safest sensitive data is the data you never collect.
