Recording Law for Voiceprints & Biometric Data in California

California makes it illegal to record or store a voiceprint—or any other audio of a conversation—unless every person taking part in the conversation agrees first. This rule comes from California Penal Code §632, which calls such recordings “confidential communications.” The law does not care whether the conversation is in person, on the phone, or through another device; if the speaker has an objectively reasonable expectation the exchange is not being overheard or recorded, §632 applies. The California Supreme Court spelled out this test in Flanagan v. Flanagan: a conversation is confidential if a party could reasonably expect it was not being intercepted in the moment. The statute excludes communications made in a public gathering, in an open government meeting, or in any other circumstance in which the parties may reasonably expect that the communication may be overheard or recorded—these exclusions are written directly into the statute’s text and are narrow carve-outs, not a broad public exception. In plain terms, if you capture a voiceprint for identification without getting everyone’s okay first, you are breaking California’s wiretap law.

California goes further than most states. In People v. Gibbons, a California appeals court ruled that secretly videotaping someone in a closed bedroom violated §632 because the video recorded the “communication” itself. The court extended §632 to hidden video cameras used to record communications, meaning the statute is not purely an audio-only restriction when video captures a communication. This means if your system’s camera records a face or body language while a voiceprint is being captured, you could be on the hook under §632 if the visual capture records the exchange, even if the audio track is cleanly separated. The law looks at whether the recording captures the exchange, not just the sound, and Gibbons arose from exactly that fact pattern: secret videotaping of sexual encounters in a closed bedroom with the door shut and curtains drawn.

California’s privacy statutes treat a voiceprint as “biometric information,” which is a type of “sensitive personal information” under the California Consumer Privacy Act as amended by the CPRA. That triggers two duties: first, you must tell people at or before you collect the voiceprint what categories of sensitive data you are gathering, why you need it, and how long you will keep it. Second, California consumers have the right to direct you to limit use of their sensitive data to only what is “reasonably necessary and proportionate” for specified permitted purposes; this is an opt-out-style right, not a prior-consent requirement. Enforcement is primarily administrative: the California Privacy Protection Agency brings actions under §1798.155 with penalties up to $2,500 per violation (up to $7,500 for intentional violations or those involving a minor), and the Attorney General may bring civil actions under §1798.199.90 with the same penalty tiers. There is no separate law like Illinois’ BIPA that forces you to destroy voiceprints after a set time or pay statutory damages for each capture; a private right of action exists only for data breaches under §1798.150, and even then the statute’s biometric examples are limited to fingerprints, retina, or iris images used to authenticate, not voiceprints.

Not every conversation in California is protected by §632. The law says a conversation is not confidential if it happens in a public gathering, in an open government meeting, or in any setting where people should reasonably expect to be overheard or recorded. Courts ask whether a speaker had an objectively reasonable expectation the exchange itself was shielded. In a crowded restaurant or on a busy sidewalk, that expectation can disappear if unrelated people are close enough to overhear, but California’s all-party-consent rule creates fact-specific ambiguity rather than a bright-line public exception. If speakers lower their voices, step aside, or explicitly say they do not want to be overheard, courts treat the conversation as confidential even in a public place. The safest practice is to assume the conversation is confidential unless you can point to clear, observable signs that unrelated people nearby could actually hear it.

California has a specific statute, Penal Code §148(g), that says recording or photographing a public officer while the officer is performing public duties in a public place does not by itself violate §632. The same bill added Penal Code §69(b) to protect against separate charges like resisting an executive officer. These protections apply because such exchanges are not “confidential communications” under §632(c), applying the objective-reasonable-expectation test from Flanagan v. Flanagan. They do not override §632 for private conversations with police; they only cover the officer’s public-facing duties. If you are speaking privately with an officer away from the public eye, §632’s all-party consent rule still applies. Federal courts have also recognized that photographing or recording matters of public interest is protected by the First Amendment, but that does not change California’s wiretap statute.

Violating California’s wiretap law (§632) is a “wobbler,” meaning it can be charged as either a misdemeanor or a felony. Penal Code §647(j) criminalizes secretly viewing or recording a person inside a bedroom, bathroom, changing room, or similar space where they have a reasonable expectation of privacy. The wiretap statute also allows a person whose conversation was recorded without consent to sue for damages and injunctive relief. California’s privacy laws are enforced primarily by the California Privacy Protection Agency and the Attorney General, with a narrow private right of action limited to data-breach claims under §1798.150.

Imagine you run an app that lets users unlock it with their voice. Before the app captures a voiceprint for identification, it must tell the user what biometric data is being collected, why, and how long it will be stored. The user does not have to sign a separate consent form, but the app must honor a request to stop using that voiceprint for anything beyond unlocking the app. If the app also turns on the camera to capture the user’s face while speaking, the hidden-video rule means the company must get consent for that visual capture too, because it records the “communication.” If the user is in a private home or office with the door closed, the conversation is almost certainly confidential under §632, and California’s home is not a source of any statutory recording exception—if anything the opposite is true. Courts have treated closed-door home settings as heightened-confidentiality environments, not privacy-reduced ones.