CA SB1189

Requires private entities to develop and publish a written policy by September 1, 2023 establishing retention schedules and guidelines for permanently destroying biometric information on the earliest of: initial purpose satisfaction, one year after last interaction, or within 30 days of a verified deletion request.

Prohibits private entities from collecting biometric information without written consent from the subject (or legally authorized representative) and prior written notice of what data is being collected and the specific purpose and duration of use.

Prohibits private entities from selling, leasing, trading, or profiting from disclosure of biometric information, and restricts disclosure unless authorized by written release, needed to complete a financial transaction, or required by law or court order.

Prohibits conditioning provision of a service on collection or use of biometric information unless strictly necessary to provide that service, and prohibits charging different prices or denying service to individuals exercising rights under this title.

Establishes civil liability allowing individuals to sue for violations and recover statutory damages between $100-$1,000 per day or actual damages (whichever is greater), plus punitive damages, attorney's fees, and other relief as appropriate.