California does not have one comprehensive law governing every use of facial recognition. Instead, businesses and public agencies must navigate privacy statutes, consumer-protection rules, local restrictions, and—in some settings—rules for law enforcement. The central compliance question is how facial data is collected, converted into a template, used to identify someone, and shared. Understanding those distinctions helps organizations assess notice, consent, security, retention, and consumer-rights obligations.
How California Regulates Facial Recognition
Facial recognition uses software to analyze facial characteristics and compare them with an image or mathematical representation, often called a faceprint or facial template. It can support one-to-one verification, such as checking a person’s face against an account photo, or one-to-many identification, such as searching a collection of faces for a match.
California’s rules depend on the organization, the purpose, and the data involved. The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), is especially important for covered businesses. Other relevant rules may include the California Constitution’s privacy protections, the state’s data-breach law, laws governing medical information, and local limits on government surveillance.
There is no general California statute requiring every private company to obtain written consent before using facial recognition. That does not mean facial recognition is unregulated. Notice, purpose limits, consumer rights, security duties, contracts, and restrictions on particular uses may still apply.
When Facial Data Is Biometric Information
Under the CCPA, personal information includes information that identifies, relates to, describes, or could reasonably be linked with a consumer or household. The law’s definition of biometric information covers data generated from a person’s biological, physical, or behavioral characteristics when it can be used to establish identity. Examples include facial geometry, fingerprints, voiceprints, and certain facial images processed for identification.
The distinction between an ordinary photograph and biometric information matters. A photograph is not automatically a biometric identifier simply because it shows a face. But when software analyzes facial features to identify or authenticate a person, the resulting measurements or template may qualify as biometric information. A faceprint used for unique identification may also be sensitive personal information under the CCPA.
Organizations should assess the full data lifecycle, not just the image file. Relevant information may include the source image, extracted facial measurements, match scores, identity records, and logs showing when a comparison occurred. Data can remain personal information even if an organization calls it a “template” or replaces a name with an identifier.
CCPA and CPRA Obligations for Covered Businesses
The CCPA applies to for-profit businesses that do business in California, determine the purposes and means of processing personal information, and meet at least one statutory threshold. The thresholds include annual gross revenue above the amount set in the law and adjusted over time, buying, selling, or sharing personal information of at least 100,000 California consumers or households annually, or deriving at least half of annual revenue from selling or sharing consumers’ personal information. The rules also cover certain entities controlled by or sharing common branding with a covered business.
Thresholds and definitions should be checked against current California Privacy Protection Agency guidance. A company outside the thresholds may still have obligations under other laws, contracts, or local rules. A service provider or contractor handling facial data for a covered business may also have duties under its contract and the CCPA’s restrictions on service-provider processing.
Notice and purpose limits
A covered business generally must provide a notice at or before collection that explains the categories of personal information collected and the purposes for which they will be used. If facial data is collected, the notice should describe it accurately rather than hiding it within a vague reference to “technical information.” The business should not use personal information for materially different purposes without giving any required notice and choice.
For facial recognition, a useful notice identifies whether the system performs verification or identification, what data it analyzes, why the processing is necessary, how long the data is kept, and whether it is disclosed to vendors or other parties. These details also help make the stated purpose meaningful and support internal accountability.
Consumer rights and sensitive personal information
Depending on the circumstances, California consumers may have rights to know, access, delete, correct, and receive information about personal information collected or disclosed about them. They may also opt out of the sale or sharing of personal information. A business that sells or shares data must provide the required methods for exercising that choice and honor recognized opt-out preference signals where applicable.
Consumers can also limit certain uses and disclosures of sensitive personal information. The right is not a blanket ban on all processing: the CCPA permits specified uses, including uses necessary to provide requested services and certain other purposes described in the statute and regulations. A company should determine whether its particular facial-recognition purpose fits a permitted category and provide the required limit mechanism when the law requires one.
Security, retention, and risk assessment
Covered businesses must use reasonable security procedures appropriate to the nature of the personal information. Facial templates can be difficult or impossible to replace if compromised, so security measures should address access control, encryption, vendor access, monitoring, and incident response. The CCPA also requires businesses to disclose retention periods or criteria for retaining personal information, and to avoid keeping it longer than reasonably necessary for the disclosed purpose.
California privacy regulations require risk assessments for certain processing activities that present significant risks to consumers’ privacy, including specified processing of sensitive personal information. The details depend on the activity and current regulations. Organizations should check California Privacy Protection Agency rules for applicable assessment, documentation, and submission requirements rather than assuming that a generic privacy review is sufficient.
Law Enforcement and Public-Sector Restrictions
California has had a specific statewide restriction on facial recognition technology in law enforcement body-worn cameras. Assembly Bill 1215 prohibited law enforcement agencies from installing or using facial recognition or other biometric surveillance technology in officers’ body-worn cameras during the law’s operative period, which ended on January 1, 2023. Because that provision included a sunset date, agencies and vendors should verify current law before relying on it as a present-day statewide prohibition.
The sunset does not eliminate other limits. Local governments may have ordinances governing government use of facial-recognition technology, and agency policies, procurement rules, constitutional protections, and other state or federal laws may apply. Some California cities have adopted restrictions on municipal use of facial recognition, but local rules differ in scope, exemptions, and enforcement.
Government agencies should identify the specific authority for each proposed use, examine applicable local ordinances, and document the legal basis for collection and matching. A vendor contract alone does not establish that an agency has authority to conduct surveillance or that a particular deployment complies with local law.
Other California Laws That May Apply
Data-breach notification
California’s breach-notification statute requires notice to affected residents when specified personal information is acquired, or reasonably believed to have been acquired, by an unauthorized person. The law includes biometric data in defined circumstances, such as biometric information used to authenticate a specific individual in combination with other data elements. Whether a facial template is covered depends on the statutory definition and the facts of the incident.
Organizations should have an incident-response plan that can identify whether compromised facial data meets the law’s definition, determine who is affected, and meet notification deadlines. The CCPA also provides a limited private right of action for certain data breaches involving specified personal information when a business failed to maintain reasonable security. It does not create a general private lawsuit for every alleged CCPA violation.
Medical and employment contexts
Facial data collected in a healthcare setting may intersect with the Confidentiality of Medical Information Act or other health privacy rules, depending on who collects it, the information involved, and the purpose. A face scan used for access control is not automatically medical information, but a system tied to a patient’s medical record or care may raise additional issues.
Employers using facial recognition for timekeeping, access control, or monitoring should review privacy notices, employment rules, labor agreements, and applicable restrictions on workplace data collection. The CCPA contains specific provisions affecting employment-related information, and those provisions have changed over time. Companies should confirm the current statutory text and avoid treating employee data as categorically exempt from privacy obligations.
Practical Compliance Checklist
- Map the data. Identify images, facial templates, match results, identity links, and logs. Record the source, location, vendor, and retention period for each.
- Classify the processing. Determine whether the system verifies a claimed identity, identifies people from a group, or merely detects a face without identifying anyone. The purpose and output affect the legal analysis.
- Check coverage and applicable laws. Assess CCPA thresholds, business roles, local government restrictions, sector-specific rules, and any contractual requirements.
- Set a specific purpose. Document why facial recognition is used and whether a less intrusive method could achieve the same goal. Do not reuse the data for a new purpose without reviewing notice and choice requirements.
- Update notices and rights processes. Describe facial-data collection plainly, provide required rights channels, and establish a process to find and respond to relevant records.
- Review vendors. Contracts should define permitted purposes, prohibit unauthorized reuse or sale, set security and retention expectations, and address deletion and incident reporting.
- Limit and secure data. Restrict access, protect templates, test security controls, and delete data when it is no longer needed for the stated purpose or legally required retention.
- Assess accuracy and impact. Test performance across relevant conditions and populations, provide a way to address mistaken matches, and require human review for consequential decisions.
- Recheck changes. Laws, regulations, thresholds, and local ordinances can change. Assign responsibility for periodic legal and technical reviews.
Common Compliance Mistakes
One frequent mistake is treating facial data as ordinary website analytics. A system that converts a face into a persistent identifier may process biometric information even if it never stores a conventional photograph. Another is assuming that a vendor’s claim of “anonymous” processing resolves the issue. If the data can reasonably be linked to a person or used to identify one, that label may not determine its legal status.
Organizations also risk over-retaining templates, using them for undisclosed purposes, or relying on broad consent language that does not explain the actual practice. A notice should match the system’s real behavior, including whether data is used for identification, shared with a vendor, or retained after an account closes.
Finally, a technically accurate match is not necessarily a legally or operationally appropriate decision. Facial recognition can produce false matches, and performance may vary with image quality and other conditions. Human review, clear escalation procedures, and an alternative way to access essential services can reduce the consequences of error.
Where to Verify California Requirements
For current requirements, organizations should consult the California Attorney General’s CCPA resources, the California Privacy Protection Agency regulations, and the official California Legislative Information site for the text of the California Civil Code and applicable bills. Local government use should also be checked against the ordinances of the city or county involved. Legal review is particularly important for public-sector deployments, sensitive personal information, and systems that affect access to employment, healthcare, housing, or essential services.