Is voice data sensitive personal information under the CCPA?

Only when it is used to identify a consumer. The California Consumer Privacy Act (CCPA) lists voice recordings as biometric information, which is a broad category. Biometric information becomes sensitive personal information, the narrower and more protected category, only when it is processed for the purpose of uniquely identifying a consumer. This page covers that biometric route only. A dictation tool that only produces text usually does not do that, but a feature that recognizes who is speaking does.

The CCPA names voice recordings as biometric information

The CCPA's definition of biometric information includes "voice recordings, from which an identifier template, such as a faceprint, a minutiae template, or a voiceprint, can be extracted" ¹. The test is whether a template can be extracted from the recording, not whether the company has extracted one. That makes the broad category wider than most people expect.

Because of that test, the audio of a dictation session can be biometric information under the CCPA even when the product never builds a voiceprint, if the recording is capable of yielding a template.

Sensitive personal information turns on the purpose

The narrower category depends on what the processing is for. The CCPA lists as sensitive personal information "the processing of biometric information for the purpose of uniquely identifying a consumer" ². The purpose is the trigger. Converting speech to text is not processing for that purpose. Speaker identification, voice login and any feature that matches a voice to a known person is.

The same audio can therefore be biometric information in the broad sense and not sensitive personal information in the narrow sense. Which label applies depends on the product's use, and the product's privacy notice should say what it does.

The penalties use two sets of figures

The statute sets administrative fines of up to $2,500 for each violation and $7,500 for each intentional violation ³. The California Privacy Protection Agency adjusted those amounts for inflation from January 1, 2025. The adjusted figures are up to $2,663 for each violation and $7,988 for each intentional violation ⁴.

The adjusted amounts are the ones in effect now. The statute's printed text still shows the original figures, so a reader who checks only the statute will see the older numbers. The agency adjusts these amounts periodically, so check its announcements for the current figures.

It depends: sensitive data is a stricter category for the business

For a consumer, the practical signal is simple: if a product says it recognizes or verifies voices, treat that voice data as sensitive, and ask what it keeps.

The CCPA protects California consumers. If you live elsewhere, the law where you live may define biometric or sensitive data differently, and this page does not cover it.

What to do

1. Ask the product whether it uses voice to identify or verify a person. If it does, the sensitive category applies to that use.
2. Read its privacy notice for the words "biometric" and "sensitive personal information", and check whether it says how the data is used and kept.
3. Ask whether any template or voiceprint is extracted from your recordings, even if the feature is off.
4. If you are a business, map each voice feature to the purpose it serves, because the purpose decides which category and which duties apply.

Related questions

• Does speech to text collect biometric data?
• Is a voice recording personal data under GDPR?
• Does Illinois BIPA cover voiceprints?

For the definitions, see the biometric data and voiceprint terms. For the full comparison of the three laws, read the guide to whether your voice is biometric data.