Law note · California
CCPA/CPRA Sensitive Personal Information and Biometric Data
Defines biometric information to expressly include faceprints extracted from facial imagery and voiceprints extracted from voice recordings, with no exclusion for an identifier derived from a recording, and classifies biometric information processed to uniquely identify a consumer as sensitive personal information. A consumer may direct a business to limit use of sensitive personal information, including biometric information, to what is necessary to provide the requested goods or services.
California has no dedicated biometric capture-consent or retention-and-destruction statute comparable to Illinois's BIPA; biometric data is regulated only as a CCPA sensitive-information category, and the CCPA's private right of action does not reach this provision.
What it asks of an app
- Treat any faceprint or voiceprint your app captures, stores, or derives from a California consumer, including one extracted from a photo, video, or audio recording, as CCPA sensitive personal information.
- Honor a California consumer's request to limit your use of sensitive personal information, including biometric information, to what is necessary to provide the requested service.
- Do not treat a biometric identifier as publicly available just because the source photo, video, or audio recording was public; the CCPA's publicly-available exemption does not reach biometric information collected without the consumer's knowledge.
When LexLint raises it
Declared activities: crawls_web, trains_models, processes_voice, processes_biometrics
Primary source: Official codified statute text, California Legislative Information (leginfo.legislature.ca.gov)