California
California Consumer Privacy Act, as amended by the California Privacy Rights Act
California folded biometric data into the broadest consumer privacy law in the country. Under CCPA as amended by CPRA, biometric information processed to identify a person is "sensitive personal information": consumers can demand to know what is held, have it deleted, and limit its use, and businesses must honor those requests within statutory deadlines. There is no biometric-specific private right of action, but the CPPA is a dedicated regulator with rulemaking power, and it has been active.
Key Provisions
- Biometric information is sensitive personal information with enhanced protections
- Right to know, right to delete, and right to limit use of sensitive personal information
- Right to opt out of sale and sharing of personal information
- Businesses must respond to verified consumer requests within 45 days
- Dedicated regulator (CPPA) with rulemaking and enforcement authority
Penalties & Enforcement Record
$2,500 per violation, $7,500 per intentional violation or violations involving minors, enforced by the CPPA and AG. The private right of action is limited to data breaches, at $100 to $750 per consumer per incident.
What this means for your face
CCPA deletion requests are the workhorse for California residents: verifiable, deadline-bound, and backed by an agency that fines. Our removals for Californians are filed as verified CCPA requests to each face-search operator.
Get Protected