---
title: "Assess a retail facial-recognition collection under the sensitive-information rules"
url: "https://ailawframework.com/practice/privacy-data-protection-and-cyber/assess-a-retail-facial-recognition-collection-against-the-sensitive-info/united-states"
type: "task_jurisdiction_version"
site: "AI Law Framework"
id: "A25-QU20261022-3-US"
practice_area: "Privacy, Data Protection & Cyber"
tier: "yellow"
lawyer_review: "required"
jurisdictions: ["US"]
last_reviewed: "2026-10-22"
---

# Assess a retail facial-recognition collection under the sensitive-information rules

> State whether the images are used or stored to identify a consumer, whether the business's notice lists biometric information, and whether the consumer has directed the business to limit use of sensitive personal…

Canonical page: https://ailawframework.com/practice/privacy-data-protection-and-cyber/assess-a-retail-facial-recognition-collection-against-the-sensitive-info/united-states  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Privacy, Data Protection & Cyber](https://ailawframework.com/practice/privacy-data-protection-and-cyber.md) |
| Human involvement | Yellow: Lawyer and AI draft together |
| How AI is used | State whether the images are used or stored to identify a consumer, whether the business's notice lists biometric information, and whether the consumer has directed the business to limit use of sensitive personal information. Do not treat an ordinary photograph, with no recognition use, as that category. |
| What the lawyer must review | The Attorney General's CCPA page includes fingerprints, retina or iris images, and other unique biometric data used to identify a person, and it says photographs are not included unless they are used or stored for facial recognition. The same page treats biometric information processed to identify a consumer as sensitive personal information, which the consumer can direct the business to use only for limited purposes. The California Privacy Protection Agency's FAQ likewise lists biometric information used to identify a consumer as sensitive personal information and states the right to limit that use and disclosure. Both pages are California law for California residents of a covered business. They are not a national biometric statute. |
| Written for | United States |
| Applies to | [Assess a retail facial recognition collection against the sensitive information rules](https://ailawframework.com/practice/privacy-data-protection-and-cyber/assess-a-retail-facial-recognition-collection-against-the-sensitive-info.md) |

## Checking plan

- What the AI does: State whether the images are used or stored to identify a consumer, whether the business's notice lists biometric information, and whether the consumer has directed the business to limit use of sensitive personal information. Do not treat an ordinary photograph, with no recognition use, as that category.
- Basis: Checked against the linked sources on 22 October 2026. Confirm the current instrument before reliance.

## Notes

- A retail system that only stores a photograph, and does not use it to identify a person, is outside the photograph clause the Attorney General states.
- Illinois and other states have their own biometric statutes. Those were not the sources for this entry.

## Sources

- [California Attorney General: California Consumer Privacy Act (CCPA)](https://oag.ca.gov/privacy/ccpa) (checked 2026-10-22)
- [California Privacy Protection Agency: Frequently Asked Questions](https://cppa.ca.gov/faq.html) (checked 2026-10-22)

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*