Law / United States / 
California
CCPA/CPRA sensitive personal information categories and biometric information definition
Cal. Civ. Code section 1798.140(c), (ae); section 1798.121
In force since .
A sensitive categories rule binding private bodies.
- Excludes recording-derived identifiers
- No
- Obligation class
- Consent, Biometric, Data subject rights
- Audit expectation
- none
What it requires
- Treat any faceprint or voiceprint your app captures, stores, or derives from a California consumer, including one extracted from a photo, video, or audio recording, as CCPA sensitive personal information.
- Honor a California consumer's request to limit your use of sensitive personal information, including biometric information, to what is necessary to provide the requested service.
- Do not treat a biometric identifier as publicly available just because the source photo, video, or audio recording was public; the CCPA's publicly-available exemption does not reach biometric information collected without the consumer's knowledge.
These lines are LexLint's reading of the law's text. Also read by: California Privacy Protection Agency (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
Civ. Code section 1798.155(a): an administrative fine of not more than $2,500 for each violation, or $7,500 for each intentional violation or one involving the personal information of a consumer known to be under 16, as enacted, adjusted for inflation by the California Privacy Protection Agency under section 1798.199.95(d) to $2,663 and $7,988 effective (the higher figure is the one for an intentional violation). This is the Act's general civil penalty, reaching any CCPA violation including the sensitive personal information and biometric duties this row describes; it is not a duty-specific penalty. The Attorney General holds a parallel civil-penalty power at the same amounts under section 1798.199.90(a).
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 7,988
Who enforces it
Enforcement body
California Privacy Protection Agency (administrative enforcement) and the California Attorney General (civil actions), sharing enforcement of the CCPA/CPRA.
Enforcement record
Count of distinct, dated CCPA enforcement announcements (a fine, order, or settlement against a named respondent) in the twelve months from to , read from the California Privacy Protection Agency's own newsroom archive (CalPrivacy moved its announcements from cppa.ca.gov/announcements/ to privacy.ca.gov/about-us/newsroom/ on ; both archives were read to cover the full window): Tractor Supply Company, $1.35 million (); a marketing firm fined for selling audiences without data broker registration (); a round of data broker enforcement actions announced together (, individual count not itemized in the headline read); Youth Sports Media Company (PlayOn Sports), a $1.10 million fine (); Ford Motor Company, ordered to change practices and pay a fine (); a $12.75 million General Motors settlement led by the Attorney General, described by the agency as the largest CCPA penalty in California to date (); a data broker action brought under both the CCPA and the Delete Act, LocateSmarter (); a second data broker enforcement action the same week (); and an action against a Virginia data broker (). This counts public administrative and Attorney General actions only; no private CCPA filings are tallied by any register found. Enforcement advisories, the Data Broker Enforcement Strike Force launch, and the sectoral audit announcement are excluded as not themselves completed actions. The register text does not give a dollar figure for every action; the figures above (Tractor Supply, PlayOn Sports, General Motors) are not totaled against the remainder. The newsroom is paginated: the to entries are on its first page, the Ford and PlayOn Sports decisions on its second, and the 2025 entries on the pages beyond and in the retired cppa.ca.gov/announcements/ index; only the first page is stored as the source snapshot for this count.
- As of
- Trend
- Rising
- Source link
- https://privacy.ca.gov/about-us/newsroom/
- Actions per year
- 9
Settledness
The guidance is the Agency's implementing regulation on requests to limit, which is a binding rule rather than advisory guidance.
- As of
- Guidance link
- https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf
- Guidance body
- California Privacy Protection Agency
- Open questions
- When is biometric information "collected or processed without the purpose of inferring characteristics about a consumer" under Civil Code section 1798.121(d), such as a voiceprint used only to match a speaker to an enrolled account?
What it makes you log
Logging duty
Section 1798.140(c) and (ae) define biometric and sensitive personal information, and section 1798.121 gives the consumer a right to limit its use. Neither names a log, a record the business keeps, a retention period or a reader of a record. The sections state no territorial reach; the does-business test sits in the definition of business in section 1798.140(d), which this row does not cite, so no hook is written.
- Kind
- None
- As of
What this law does
Defines biometric information to expressly include faceprints extracted from facial imagery and voiceprints extracted from voice recordings, with no exclusion for an identifier derived from a recording.
Sensitive personal information is personal information that reveals a consumer's social security, driver's license, state identification card, or passport number; a consumer's account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account; precise geolocation; racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership; the contents of a consumer's mail, email, and text messages unless the business is the intended recipient of the communication; genetic data; or neural data, together with the processing of biometric information for the purpose of uniquely identifying a consumer, personal information collected and analyzed concerning a consumer's health, and personal information collected and analyzed concerning a consumer's sex life or sexual orientation.
A consumer may direct a business to limit use of sensitive personal information, including biometric information, to what is necessary to provide the requested goods or services. California has no dedicated biometric capture-consent or retention-and-destruction statute comparable to Illinois's Biometric Information Privacy Act (BIPA); biometric data is regulated only as a CCPA sensitive-information category, and the CCPA's private right of action does not reach this provision.
When LexLint raises it
When your app profile says your app processes biometric data.
Back to the example · Lint your app
Page updated .