Processes biometric data, in California

Cal. Civ. Code sections 1798.99.80 to 1798.99.85 · Read the law's page

• Register with the California Privacy Protection Agency on or before January 31 following each year in which you are a data broker (you knowingly collect and sell to third parties the personal information of consumers you have no direct relationship with), and pay the registration fee the Agency sets.
• You are not a data broker to the extent the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act or the Insurance Information and Privacy Protection Act covers you, or your processing is exempt under Civil Code section 1798.146.
• In the registration, give your name and primary physical, email and website addresses and your request metrics, and say whether you collect minors' personal information; names, dates of birth, ZIP Codes, email addresses or phone numbers; account logins or account numbers with the codes that unlock them; government identification numbers; mobile advertising, connected television or vehicle identification numbers; citizenship or immigration data; union membership; sexual orientation; gender identity or expression; biometric data; precise geolocation; or reproductive health care data. If you collect none of the names, dates of birth, ZIP Codes, email addresses or phone numbers, and none of the mobile advertising, connected television or vehicle identification numbers, name one to three of the most common types of personal information you collect.
• Also state in the registration whether in the past year you shared or sold consumers' data to a foreign actor, the federal government, other state governments, law enforcement (except under a subpoena or court order) or a developer of a generative artificial intelligence system or model; whether and to what extent you or a subsidiary is regulated by the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act, the Insurance Information and Privacy Protection Act, the Confidentiality of Medical Information Act or the federal HIPAA privacy, security and breach notification rules; and, beginning January 1, 2029, whether you have undergone the independent audit of your deletion compliance and the most recent year you submitted its report to the Agency.
• Link in the registration to a page on your website, free of dark patterns, that explains how consumers can delete and correct their personal information, learn what you collect and how to access it, learn what you sell or share and to whom, opt out of its sale or sharing, and limit the use and disclosure of their sensitive personal information.
• By July 1 each year, disclose in the privacy policy posted on your website, and through a link included in that policy, how many deletion, access, opt-out and limit requests you received, complied with in whole or in part, and denied in the previous calendar year, and the median and mean number of days you took to respond substantively. For deletion requests made through the Agency's accessible deletion mechanism, give how many you denied because the request was not verifiable, was not made by a consumer, called for exempt information or for other reasons. For every deletion request, give how many each provision of section 1798.145 or 1798.146 excused, in whole or in part.

Cal. Civ. Code section 1798.81.5, as amended by AB 825 (2021, Ch. 527) · Read the law's page

• This binds a business that owns, licenses, or maintains personal information about a California resident, and by contract extends the same duty to a nonaffiliated third party the business discloses that information to; it exempts a health care provider, plan, or contractor already regulated by the Confidentiality of Medical Information Act, a financial institution subject to the California Financial Information Privacy Act, a covered entity governed by the federal HIPAA medical privacy and security rules, and a business already subject to state or federal law providing greater protection on the same subject, deemed compliant with this duty instead.
• Implement and maintain reasonable security procedures and practices appropriate to the nature of the personal information you own, license, or maintain, to protect it from unauthorized access, destruction, use, modification, or disclosure.
• Covered personal information reaches a name paired with a Social Security, driver's license, state ID, passport, military ID, or tax ID number, a financial account or payment card number with its access code, medical or health insurance information, unique biometric data used to authenticate a person, or genetic data, when either the name or the data element is not encrypted or redacted; it also reaches a username or email address paired with a password or security question that unlocks an online account.
• A customer injured by a violation of this duty may bring a civil action for damages under Civil Code section 1798.84(b); where the violation is a breach of nonencrypted or nonredacted personal information, the CCPA/CPRA's own statutory-damages private right of action, Civil Code section 1798.150, is a separate and further remedy, researched as this jurisdiction's privacy row.

Cal. Civ. Code section 1798.140(c), (ae); section 1798.121 · Read the law's page

• Treat any faceprint or voiceprint your app captures, stores, or derives from a California consumer, including one extracted from a photo, video, or audio recording, as CCPA sensitive personal information.
• Honor a California consumer's request to limit your use of sensitive personal information, including biometric information, to what is necessary to provide the requested service.
• Do not treat a biometric identifier as publicly available just because the source photo, video, or audio recording was public; the CCPA's publicly-available exemption does not reach biometric information collected without the consumer's knowledge.

Cal. Civ. Code § 1798.140(v) · Read the law's page

• Do not treat personal data scraped from a third-party aggregator, directory, or re-posting site as publicly available under the CCPA merely because it appears on a public page; the exemption reaches only lawfully available government records, information lawfully made available to the general public by the consumer or from widely distributed media, and information made available by a person to whom the consumer disclosed it without restricting the audience.
• Never treat biometric information a business collected about a consumer without that consumer's knowledge as publicly available, regardless of source.
• If you meet CCPA's revenue or volume thresholds, personal data you collect by scraping still triggers the Act's business obligations, including when it feeds AI training.

Cal. Code Regs. tit. 11, sections 7150 to 7157 · Read the law's page

• Before you start processing that presents significant risk to consumers' privacy (selling or sharing personal information, processing sensitive personal information other than for the employment purposes section 7150(b)(2)(A) lists, using automated decisionmaking technology for a significant decision, the inferences about applicants, students, employees, contractors or people in a sensitive location that section 7150(b)(4) and (5) describe, or training automated decisionmaking or facial-recognition or emotion-recognition technology), conduct a risk assessment (section 7150).
• In the risk assessment, document a specific purpose for the processing, the categories of personal information (the minimum necessary), the operational elements of the processing, the benefits, the negative impacts to consumers' privacy and their sources, and the safeguards, and weigh whether the risks outweigh the benefits (section 7152(a)).
• Review and update each risk assessment at least once every three years, and update it as soon as feasible and within 45 calendar days of a material change in the processing (section 7155(a)(2) and (3)).
• For processing you began before January 1, 2026 that continues after that day, complete and document the risk assessment no later than December 31, 2027 (section 7155(b)).
• Retain risk assessments, original and updated, for as long as the processing continues or for five years after completion, whichever is later (section 7155(c)).
• Submit the risk assessment information section 7157(b) lists to the Agency, with an attestation under penalty of perjury from a member of executive management, by April 1, 2028 for assessments conducted in 2026 and 2027 and by April 1 of each later year (section 7157).

Cal. Labor Code sections 1051, 1052 and 1054 · Read the law's page

• Do not require, as a condition of securing or retaining employment, that an employee or applicant be photographed or fingerprinted by a person who wants the photograph or fingerprints to furnish them, or information about the employee or applicant, to another employer or third person, where they could be used to the employee's or applicant's detriment (section 1051).
• Do not knowingly cause, suffer or permit an agent, superintendent, manager or employee to commit that violation, and take all reasonable steps within your power to prevent it (section 1052).

Cal. Lab. Code Sections 1580 to 1583 (AB 1883, Ch. 853, Stats. 2026) · Read the law's page

• Do not use a workplace surveillance tool that uses artificial intelligence on employees to recognize, or make inferences or predictions about, an individual's emotional state
• Do not use a workplace surveillance tool that uses artificial intelligence on employees to collect neural data, meaning information generated by measuring the activity of an employee's central or peripheral nervous system that is not inferred from nonneural information
• This binds any employer, meaning a person or governmental entity that employs or exercises control over the wages, hours, or working conditions of any person, including state and local government bodies and labor contractors