united-states contract-law terms-of-service consent
Biometric Collection Without the Option for Deletion
<p>If I collect the face and voice properties of someone and inform them that they would not be able to request its deletion under any circumstance, would I still have to delete it under request in any US state? I know biometric collection laws are pretty strict in some places, so this is why I ask.</p>

<p>If a person or firm collects and stores personal data (PD) (which can include biometric information) of  a natural person who is located in the EU (or the UK) while offering products or services (even free services) that are &quot;targeted&quot; at the EU, then the GDPR will apply to the person or firm collecting that info, if the biometric data is associated with an identifiable natural person, or such a person can be singled out, perhaps with the aid of other available data. In that case a request made in accordance with <a href="https://gdpr-info.eu/art-17-gdpr/" rel="nofollow noreferrer">Article 17</a> of the GDPR a request for deletion of that PD may have to be honored if the need for the data is over; processing of the PD was based on consent, which has now been withdrawn; the data subject (DS) objects under GDPR article 21(1); the data was unlawfully processed; or ther data was collected in relation to an offer of Information Society services (which includes social media).</p>
<p>If a person or firm collects and stores PD  of  a natural person who is located in the state of California, the holder of that data can be requested by the DS to delete the data under section 1798.105 of the <a href="https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=201720180AB375" rel="nofollow noreferrer">California Consumer Privacy Act</a> (CCPA), and may be required to comply with such a request.</p>
<p>The CCPA does not authorize an individual lawsuit to enforce such requests, all such action is taken by the California AG's office.</p>
<p>These rights under the GDPR or the CCPA may not be waived by a terms of service (or any other) agreement</p>
<p>Several other US states have passed privacy laws similar to the CCPA, and after the effective dates of such laws, similar requirements may apply.</p>
