California Consumer Privacy Act (CCPA, as amended by the CPRA)

2020

CCPA in force

Cal. Civ. Code 1798.198

2023

CPRA amendments and the CPPA take over

Proposition 24 (2020)

$7,988

Maximum fine per intentional violation, 2025 adjustment

CPPA

What does the CCPA cover?

The Act applies to for-profit businesses that do business in California and meet one of three thresholds: more than $25 million in annual revenue (indexed), buying, selling or sharing the personal information of 100,000 or more consumers or households, or deriving half or more of revenue from selling or sharing personal information. Personal information is anything that identifies or could reasonably be linked with a consumer, which includes a photograph of a face and anything derived from it.

Since the CPRA amendments, biometric information processed for the purpose of uniquely identifying a consumer is sensitive personal information. Consumers can direct a business to limit the use of sensitive personal information to what is necessary to provide the requested service, and businesses must offer a "Limit the Use of My Sensitive Personal Information" link where they use it beyond that.

Who enforces it?

The California Privacy Protection Agency, created by Proposition 24, writes the regulations and brings administrative enforcement; the Attorney General brings civil actions. Early enforcement targeted Sephora (2022), DoorDash (2024), Honda and Todd Snyder (2025) over opt-out mechanics. There is no general private right of action; consumers may sue only when non-encrypted personal information is breached because of a failure to maintain reasonable security.

What does it mean for face search?

Two provisions matter. First, the Act excludes publicly available information, defined to include information lawfully made available from government records or that a business has a reasonable basis to believe the consumer lawfully made available to the general public. Face search engines argue that photos on public web pages are publicly available and so outside the Act. Critics note that the exclusion is for information the consumer made public, not for biometric templates a third party derives from it, and that "publicly available" does not include biometric information collected without the consumer's knowledge. Second, the sensitive-information rules apply to any covered business that computes face templates to identify people, whether PimEyes, Clearview AI or a consumer engine such as FaceSearch, once the size thresholds are met. In practice the CCPA has produced disclosure and opt-out obligations for face search engines rather than the bans or damages seen under Illinois BIPA.

What are the penalties?

Administrative fines run per violation and per consumer, so a practice affecting many Californians scales quickly: $2,663 for each violation and $7,988 for each intentional violation or violation involving a consumer under 16, at the 2025 adjustment. Fines are paid into the Consumer Privacy Fund. The breach private right of action allows statutory damages of $107 to $799 per consumer per incident, also adjusted.

What is pending or unsettled?

• CPPA regulations on risk assessments, cybersecurity audits and automated decision-making technology were adopted in 2025 with phased compliance dates through 2027; they treat processing of biometric data as a high-risk activity requiring a risk assessment.
• Whether scraped face templates fall within the publicly available exclusion has not been decided by a California court.
• The California Delete Act (2023) created a one-stop deletion mechanism for data brokers through the CPPA's DROP platform, with broker deletion duties starting in 2026; whether face search engines are data brokers under that law is contested.