On February 17, 2022, the California Legislature introduced a biometric privacy law (SB 1189) similar to the Illinois Biometric Information Privacy Act (“BIPA”). SB 1189 would dramatically increase biometric privacy protection for California consumers, expand regulation among private business, and add to the flurry of biometric privacy class action litigation that has taken hold of U.S. courts.

Introduced by State Senator Bob Wieckowski, SB 1189 would broaden the definition of biometric data under California law to include a person’s physiological, biological, and behavioral characteristics used to establish individual identity. If passed, the Act would prohibit any private entity from selling, leasing, trading, using for advertising purposes, or otherwise profiting from a person’s biometric information. And all private companies would be required to obtain the consumer’s consent before collecting their biometric information—in addition to publishing a written policy establishing a retention schedule and guidelines for permanently erasing the biometric information.

SB 1189 would supplement the CCPA/CPRA^*, which includes an opt-out for the sale of an individual’s personal information, along with other protections. Notably, SB 1189 is even broader than the current California privacy statutes; it would cover any “private entity” (defined as “an individual, partnership, corporation, limited liability company, association, or similar group, however organized” but does not include the University of California).

Like BIPA, SB 1189 includes a private right of action. This would certainly fuel significant class action litigation like its Illinois counterpart. If enacted, SB 1189 would go into effect January 1, 2023, potentially putting significant time pressure on companies doing business in California to prepare compliance programs before the end of the year. Companies should watch SB 1189 closely, prepare proactively to establish compliant biometric policies, and simultaneously pursue other avenues—including effective class action waivers—to mitigate against the potential for costly private biometric class action litigation.

^* California Consumer Privacy Act / California Privacy Rights Act