Status: Enacted - Signed by Governor Newsom on October 8, 2025. Effective January 1, 2026.
Bill Number: California SB 361
Jurisdiction: California
Category: Data Broker Regulation, Biometric Privacy, Consumer Disclosure
Industries: Data Brokers, Adtech, People-Search Platforms, Identity-Resolution Vendors
Enacted Date: October 8, 2025
Effective Date: January 1, 2026
Summary: California SB 361 amends California's data broker registry law to require data brokers to register annually with the California Privacy Protection Agency and disclose, by category, the personal information they collect and share - including biometric data, precise geolocation, and inferences drawn from sensitive categories. The statute materially raises the regulatory cost of trafficking in biometric identifiers harvested without consumer consent and creates a public record of every data broker handling Californians' biometric information, accessible through the CPPA's online registry.
Key Provisions:
- Annual Registration: Every data broker must register with the California Privacy Protection Agency each year.
- Category Disclosure: Mandatory disclosure of categories of personal information collected and shared - explicitly including biometric data, precise geolocation, and inferences.
- Sensitive-Category Reporting: Additional reporting requirements for data brokers handling categories considered sensitive under the California Consumer Privacy Act.
- Enforcement: CPPA authority including civil penalties; public-facing registry creates reputational accountability.
Affected Entities: Any business meeting California's data broker definition, including identity-resolution vendors, people-search services, biometric data aggregators, and adtech platforms that share or sell consumer biometric information.
Compliance Outlook: Data brokers should expect heightened CPPA enforcement throughout 2026, with biometric-data handlers a likely first wave of audits. Organizations that purchase data broker output should audit upstream registration status to mitigate downstream compliance risk under CCPA and emerging state biometric privacy laws.
IntelliSee Relevance: Adjacent. IntelliSee does not collect or sell biometric identifiers; the platform analyzes camera streams in real time without persisting biometric templates. SB 361 nonetheless reshapes the procurement environment for any system marketed alongside identity-resolution or third-party data products. Security leaders evaluating layered platforms should confirm vendor positions on biometric template retention, identity resolution, and downstream data sharing. The State-by-State AI Security Legislation Tracker covers how biometric privacy statutes interact with physical security AI.