What Is the CCPA?

The California Consumer Privacy Act (CCPA), effective January 2020 and amended by the California Privacy Rights Act (CPRA) in 2023, is a comprehensive privacy law granting California residents specific rights over their personal information. The CCPA gives consumers the right to know what personal information businesses collect about them, the right to delete that information, the right to opt out of the sale or sharing of their data, and the right to non-discrimination for exercising these rights.

For the AI digital identity market, the CCPA is significant because many of the leading avatar and digital twin platforms are headquartered in California (HeyGen is in Los Angeles, for example), and a substantial portion of their creator and consumer base resides in the state. The CPRA amendments specifically classified biometric information as sensitive personal information requiring additional protections and consumer rights, directly impacting how platforms handle the facial, vocal, and behavioral data used to create digital twins.

Key Characteristics

  • Sensitive personal information: The CPRA amendment created a category of sensitive personal information (including biometrics) that consumers can limit businesses from using beyond what is strictly necessary.
  • Right to delete: Consumers can request deletion of their personal information, creating obligations for platforms to remove biometric data used in digital twin creation.
  • Opt-out of sale/sharing: Consumers can direct businesses not to sell or share their personal information with third parties.
  • Revenue threshold: The CCPA applies to for-profit businesses that meet specific thresholds — $25 million annual revenue, data on 100,000+ consumers, or 50%+ revenue from data sales.
  • Private right of action: Consumers have a limited private right of action for data breaches involving their unencrypted personal information.

Why It Matters

The CCPA and its CPRA amendments represent the leading edge of US biometric data regulation. For AI digital twin platforms operating in or targeting the California market — which includes most of Silicon Valley and the entertainment industry — CCPA compliance is a baseline requirement. The law’s treatment of biometric data as sensitive personal information establishes an important precedent that other US states are following in their own privacy legislation.

See also: Data Privacy, GDPR, Biometric Data, Consent Management, Personality Rights