California's Privacy Rules for Face and Palm Checkout, Explained
By Yan Payments
Does California require a customer’s consent before you scan their face or palm?
Not the way you might expect. Illinois’ Biometric Information Privacy Act requires written, opt-in consent before a business collects someone’s faceprint or palm print. California’s privacy law doesn’t work that way. The CCPA, as amended by the CPRA, doesn’t require you to get sign-off before the scan happens. What it does do is classify a face or palm scan as “sensitive personal information,” which comes with its own notice and opt-out obligations you still need to handle before you turn on a feature like Clover’s Wink-powered face-and-palm checkout.
What actually counts as biometric information here
Under California’s rules, biometric information “processed to identify a consumer” is sensitive personal information, in the same category as a Social Security number, a precise location, or account login credentials, according to the California Attorney General’s own CCPA guidance. A face scan or palm scan used to authenticate someone at checkout clearly falls into that bucket. It doesn’t matter that Wink’s vault reportedly keeps the biometric template separate from the card data; the classification is about what the data is, not where it’s stored.
The notice you have to give before the first scan
Before you collect that scan, California requires a “notice at collection”: a clear, specific disclosure of what you’re collecting, why, and how long you’ll keep it. A generic line buried in your terms of service that says you “may collect data to process payments” doesn’t meet this bar for biometric data. If you’re enrolling customers in face or palm checkout, the sign-up flow needs its own plain-language notice naming the scan specifically, not a byproduct of your existing checkout terms.
The “right to limit,” and when it actually applies
California gives consumers a right to limit the use and disclosure of sensitive personal information, but that right is triggered by what you do with the data, not by the fact that you collected it. If the scan is used only to complete the one transaction the customer asked for, that specific use generally falls inside the uses California already treats as necessary to deliver the service, and you likely don’t need to post the “Limit the Use of My Sensitive Personal Information” link for it. The moment you use that same scan for anything beyond the transaction itself, marketing, ad targeting, or building a loyalty profile, you’re in territory where the opt-out right applies and you need a way to honor it.
This matters more if you’re stacking loyalty or age checks on the same scan
Clover and Wink have pitched the same enrollment as a way to also handle loyalty tracking and age verification, not just payment. That’s exactly the kind of secondary use that pulls you into opt-out territory. If you’re running quick-service or retail and considering this, keep the uses separated in your own head and in your privacy notice: say plainly whether the scan is used only for payment, or also tied to loyalty and age verification, because those are different obligations under the law.
New 2026 rules on automated decision-making
California’s Privacy Protection Agency finalized a separate set of rules on risk assessments and automated decision-making technology, which took effect January 1, 2026. Legal summaries of those final rules put the compliance deadline for automated decision-making technology at January 1, 2027, for businesses using it to make what the law treats as a “significant decision,” things like profiling for behavioral advertising or certain eligibility determinations. A straightforward payment authorization probably doesn’t trigger this on its own, but if you’re layering automated age-verification or profiling decisions onto the same biometric enrollment, it’s worth getting in front of that January 2027 date rather than finding out about it afterward.
A practical checklist before you turn it on
- Write a specific notice-at-collection disclosure that names the face or palm scan directly, separate from your general payment terms.
- Decide up front whether the scan will be used for anything beyond completing that one transaction, like loyalty or age verification, since that changes your obligations.
- If it will be used for more than the transaction, post the “Limit the Use of My Sensitive Personal Information” link and have a real process to honor requests.
- Ask your POS vendor exactly how long the scan data is retained and where, and get that answer in writing, not just a verbal assurance from a sales rep.
- If you’re combining the scan with any automated decision-making, start tracking the January 2027 compliance date now instead of waiting.
This is general information about how California’s privacy law currently treats biometric data, not legal advice for your specific business. If you’re considering Clover’s face-and-palm checkout or a similar system, talk to a lawyer who handles CCPA compliance before you launch, especially if payment isn’t the only thing the scan will be used for.
Sources:
← Back to all posts