Law / United States / 
California
CCPA/CPRA Sensitive Personal Information and Biometric Data
Cal. Civ. Code section 1798.140(c), (ae); section 1798.121
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since 1 January 2023.
A sensitive categories rule binding private bodies.
As of 23 August 2026.
What it requires
- Treat any faceprint or voiceprint your app captures, stores, or derives from a California consumer, including one extracted from a photo, video, or audio recording, as CCPA sensitive personal information.
- Honor a California consumer's request to limit your use of sensitive personal information, including biometric information, to what is necessary to provide the requested service.
- Do not treat a biometric identifier as publicly available just because the source photo, video, or audio recording was public; the CCPA's publicly-available exemption does not reach biometric information collected without the consumer's knowledge.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
Civ. Code section 1798.155(a): an administrative fine of not more than $2,500 for each violation, or $7,500 for each intentional violation or one involving the personal information of a consumer known to be under 16, as enacted, adjusted for inflation by the California Privacy Protection Agency under section 1798.199.95(d) to $2,663 and $7,988 effective 2025-01-01 (the higher figure is recorded as per_violation_amount). This is the Act's general civil penalty, reaching any CCPA violation including the sensitive personal information and biometric duties this row describes; it is not a duty-specific penalty. The Attorney General holds a parallel civil-penalty power at the same amounts under section 1798.199.90(a).
- Rule
- Per violation only
- As of
- 2 September 2026
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 7,988
Who enforces it
Enforcement body
California Privacy Protection Agency (administrative enforcement) and the California Attorney General (civil actions), sharing enforcement of the CCPA/CPRA.
Enforcement record
Count of distinct, dated CCPA enforcement announcements (a fine, order, or settlement against a named respondent) in the twelve months from 2025-09-02 to 2026-09-02, read from the California Privacy Protection Agency's own newsroom archive (CalPrivacy moved its announcements from cppa.ca.gov/announcements/ to privacy.ca.gov/about-us/newsroom/ on 2026-01-26; both archives were read to cover the full window): Tractor Supply Company, $1.35 million (2025-09-30); a marketing firm fined for selling audiences without data broker registration (2025-12-03); a round of data broker enforcement actions announced together (2026-01-08, individual count not itemized in the headline read); Youth Sports Media Company (PlayOn Sports), a $1.10 million fine (2026-03-03); Ford Motor Company, ordered to change practices and pay a fine (2026-03-05); a $12.75 million General Motors settlement led by the Attorney General, described by the agency as the largest CCPA penalty in California to date (2026-05-08); a data broker action brought under both the CCPA and the Delete Act, LocateSmarter (2026-08-11); a second data broker enforcement action the same week (2026-08-13); and an action against a Virginia data broker (2026-09-01). This counts public administrative and Attorney General actions only; no private CCPA filings are tallied by any register found. Enforcement advisories, the Data Broker Enforcement Strike Force launch, and the sectoral audit announcement are excluded as not themselves completed actions. fines_per_year is not recorded because not every action's dollar figure was confirmed from the register text itself; the confirmed figures above (Tractor Supply, PlayOn Sports, General Motors) are not totaled against the unconfirmed remainder. The newsroom is paginated: the 2026-05-08 to 2026-09-01 entries are on its first page, the Ford and PlayOn Sports decisions on its second, and the 2025 entries on the pages beyond and in the retired cppa.ca.gov/announcements/ index; only the first page is stored as the source snapshot for this count.
- As of
- 2 September 2026
- Trend
- Rising
- Source link
- https://privacy.ca.gov/about-us/newsroom/
- Actions per year
- 9
What it reaches
Excludes recording-derived identifiersNo
Obligation class
Consent, Biometric, Data subject rights
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Defines biometric information to expressly include faceprints extracted from facial imagery and voiceprints extracted from voice recordings, with no exclusion for an identifier derived from a recording, and classifies biometric information processed to uniquely identify a consumer as sensitive personal information. A consumer may direct a business to limit use of sensitive personal information, including biometric information, to what is necessary to provide the requested goods or services.
California has no dedicated biometric capture-consent or retention-and-destruction statute comparable to Illinois's Biometric Information Privacy Act (BIPA); biometric data is regulated only as a CCPA sensitive-information category, and the CCPA's private right of action does not reach this provision.
When LexLint raises it
crawls_webtrains_modelsprocesses_voiceprocesses_biometrics
Read the law
Official codified statute text, California Legislative Information (leginfo.legislature.ca.gov)
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.