Sensitive personal information.

Section 1798.100(a)(2): Removed the requirement that businesses disclose whether sensitive personal information is 'sold or shared.' The disclosure obligation now only requires stating the purposes for which sensitive personal information is collected or used, dropping the sold/shared disclosure specifically for sensitive personal information.

Section 1798.121(e): The prohibition on selling or sharing sensitive personal information to a third party is no longer absolute. It is now subject to exceptions found in subparagraph (A) of paragraph (2) of subdivision (ad) of Section 1798.140 and subparagraph (B) of paragraph (2) of subdivision (ah) of Section 1798.140, creating carve-outs that permit certain sales or sharing of sensitive personal information.

Section 1798.121 title changed from 'Consumers' Right to Limit Use and Disclosure of Sensitive Personal Information' to the shorter 'Consumers' Sensitive Personal Information,' removing the explicit reference to the right to limit use and disclosure.

Section 1798.121(b): Corrected garbled drafting language ('shall be prohibited, not...from using or disclosing use or disclose') to a clear prohibition ('shall not...use or disclose').

Section 1798.121(c): Fixed conflicting language 'may shall not' to simply 'shall not,' resolving an apparent drafting error that created ambiguity about whether service providers and contractors are permitted or prohibited from using sensitive personal information beyond authorized purposes.