California residents have specific rights under CCPA and CPRA to access, delete, correct, and opt out of certain uses of their personal information, including sensitive health and biometric data.
This analysis describes what Oura's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
California law provides stronger privacy protections than the baseline policy, including opt-in rights for sensitive personal information and the right to limit use of sensitive data, which are operationally important for California-based Oura users.
Interpretive note: The full text of Oura's California-specific rights disclosure was not fully visible in the provided document excerpt, so the completeness of Oura's CPRA rights operationalization cannot be fully assessed from the available text.
The updated policy explicitly discloses that Oura uses artificial intelligence and machine learning in the service, including an AI assistant called Oura Advisor that provides personalized wellness guidance based on information you submit or that Oura collects. The revised terms state that Oura may use AI and algorithmic analysis to suggest partner services and may use personal data to develop or refine AI-powered health features. The policy establishes that you retain choice about whether to engage with these AI features or share personal data with partner services when suggestions are offered.
View change record →This provision was replaced by a more generalized 'Advertising and Marketing Data Processing' provision that removes specific mention of California resident protections, reducing targeted privacy regulation compliance clarity.
View full change record →If you are a California resident, you have enforceable rights under CCPA and CPRA to access, delete, correct, and limit how Oura uses your sensitive personal information, including health and biometric data, and you can exercise these rights by contacting Oura.
How other platforms handle this
If you are a California resident, you may have the right to: Know what personal information we collect, use, disclose, sell, or share. Correct inaccurate personal information. Delete your personal information. Opt out of the sale or sharing of your personal information. Limit the use and disclosure ...
If you are a California resident, you have the right to: Know what personal information is being collected about you; Know whether your personal information is sold or disclosed and to whom; Say no to the sale of personal information; Access your personal information; Request deletion of your person...
If you are a California resident, you have the right to know what personal information we collect, use, and disclose about you; the right to request deletion of your personal information; the right to opt out of the sale or sharing of your personal information; the right to correct inaccurate person...
Monitoring
Oura has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"We process marketing-related personal data to provide online advertising and other marketing communications on behalf of Oura and our partners. For example, as explained more fully in our Cookie Policy, we use cookies and similar technologies on our website to create audiences for online advertisement. You can opt out of direct marketing communications from Oura.— Excerpt from Oura's Oura Privacy Policy
REGULATORY LANDSCAPE: CCPA as amended by CPRA grants California residents rights to know, delete, correct, opt out of sale or sharing, and limit use of sensitive personal information. Sensitive personal information under CPRA includes health data, biometric data, and precise geolocation. The California Privacy Protection Agency and the California Attorney General have enforcement authority. CPRA's sensitive personal information opt-out right is particularly relevant given the scope of health and biometric data Oura collects. GOVERNANCE EXPOSURE: Medium. Oura's policy acknowledges California rights but the policy text provided does not fully enumerate the CPRA-specific rights framework, including the right to limit use of sensitive personal information. The adequacy of Oura's operationalization of these rights depends on whether the full rights disclosure is provided elsewhere in the policy or through a dedicated California-specific section. JURISDICTION FLAGS: Applies exclusively to California residents. Colorado Privacy Act, Connecticut Data Privacy Act, and Virginia Consumer Data Protection Act create analogous rights frameworks for residents of those states that may also be relevant to Oura's user base. CONTRACT AND VENDOR IMPLICATIONS: Oura's contracts with marketing technology vendors and analytics providers that receive California consumer data should include CPRA-compliant data processing terms. Any sharing of California consumer health or biometric data for advertising purposes may implicate CPRA's restrictions on sale or sharing of sensitive personal information. COMPLIANCE CONSIDERATIONS: Legal teams should confirm that Oura has implemented a 'Limit the Use of My Sensitive Personal Information' mechanism as required by CPRA, and that this mechanism is accessible and operational for California users. Consumer requests for access, deletion, and correction should be fulfillable within CPRA's statutory timeframes.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
California law provides stronger privacy protections than the baseline policy, including opt-in rights for sensitive personal information and the right to limit use of sensitive data, which are operationally important for California-based Oura users.
If you are a California resident, you have enforceable rights under CCPA and CPRA to access, delete, correct, and limit how Oura uses your sensitive personal information, including health and biometric data, and you can exercise these rights by contacting Oura.
ConductAtlas has identified this type of provision across 14 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Oura.