Workplace Biometric Privacy Lawyer

A growing number of employees interact with biometric technology simply by going to work.

A fingerprint may be used to clock in for a shift. Facial recognition can control access to a building or computer system. Other technologies may use hand geometry, voiceprints, or similar biometric characteristics to verify identity or improve security.

These systems can offer employers convenient alternatives to badges, passwords, and identification numbers. They also create a different privacy relationship between workers and the organizations employing them.

An employee may be required to provide biometric information repeatedly over months or years. The technology may be operated by an outside vendor. Biometric data may remain stored after the worker changes jobs. And unlike a password, the physical characteristic underlying biometric information cannot simply be replaced.

For these reasons, workplace biometrics have become an important area of biometric privacy.

Net Law Advocates represents employees and other individuals nationwide whose biometric information may have been collected, stored, shared, or otherwise handled in violation of applicable privacy law.

How Is Biometric Technology Used in the Workplace?

Employers can use biometric systems anywhere they need to establish identity or connect an action to a particular worker.

Timekeeping is one of the most familiar examples, but it is not the only one.

Workplace biometric systems may be used for:

• Clocking employees in and out
• Entering secured buildings or work areas
• Accessing computers or software
• Authenticating employees before transactions
• Controlling access to equipment
• Preventing unauthorized account use
• Verifying workers in remote environments
• Security and identity management

Different systems can collect different types of biometric information.

A warehouse might require workers to scan fingerprints before starting shifts. A secured facility could use facial recognition at an entrance. A call-center or remote-work system might use voice or facial technology for authentication.

The legal analysis depends on the technology, information generated, jurisdiction, and what the employer and any outside vendors do with that information.

Workplace Biometrics Can Include More Than Fingerprints

Fingerprint systems have been central to workplace biometric litigation, but biometric technology is broader than fingerprint scanning.

Depending on the system and applicable law, biometric identifiers may include:

• Fingerprints
• Scans of hand geometry
• Scans of face geometry
• Voiceprints
• Retina or iris scans

The terminology matters.

An ordinary photograph of an employee is not necessarily the same as a scan of face geometry. A recorded telephone conversation is not automatically a biometric voiceprint. A photograph of a hand is not necessarily a biometric hand-geometry scan.

What the technology actually creates or measures can determine whether a biometric privacy statute applies.

That is why evaluating a workplace biometric issue often requires looking beyond what the employer calls the system and examining how the technology actually operates.

Fingerprint Systems Are Common in the Workplace

Fingerprints are frequently used because they provide a convenient way to associate an employee with a particular action.

Workers may encounter fingerprint scanners when entering a facility, accessing equipment, authenticating their identity, or recording work hours.

The scan may be converted into a biometric template that can later be compared against future scans.

This means an employer does not necessarily need to store an ordinary fingerprint image for biometric privacy concerns to arise. Depending on the law, information generated from the fingerprint and used to identify an employee may itself receive protection.

The broader legal issues surrounding this technology are addressed through Net Law Advocates’ fingerprint privacy content.

Biometric Timekeeping Raises Recurring Privacy Questions

Timekeeping is one of the most widespread workplace uses of biometrics.

Employers may adopt fingerprint or other biometric time clocks to prevent employees from clocking in for one another, improve payroll accuracy, or simplify workforce management.

From the employee’s perspective, the process can seem straightforward: scan a finger or hand when arriving and leaving.

Behind that interaction, however, several things may happen.

The system may generate a biometric template, associate it with an employee record, transmit information to a payroll or workforce-management vendor, store the information in a remote database, and retain it for future authentication.

Those practices can raise questions about notice, consent, disclosure, storage, security, and destruction.

Because biometric time clocks present a particularly concentrated set of issues and have generated substantial litigation, timekeeping is a narrower subject within the broader category of workplace biometric privacy.

Employees May Have Little Practical Choice About Workplace Systems

Biometric technology at work differs from many consumer applications because employees often do not choose which systems their employer uses.

A consumer can sometimes decide not to use a biometric feature on an application. An employee may be told that scanning a fingerprint or using another biometric system is part of the workplace process.

That does not necessarily make the collection unlawful.

In fact, Illinois BIPA’s definition of a written release expressly recognizes the employment context and includes a release executed by an employee as a condition of employment.

But requiring biometric technology as part of a job does not eliminate other statutory requirements that may apply.

Under Illinois BIPA, for example, a covered private entity generally must provide written notice that biometric information is being collected or stored, explain the specific purpose and length of time for which it is being collected, stored, and used, and obtain a written release before covered collection occurs.

The circumstances and applicable law determine whether those requirements have been satisfied.

Notice Should Explain More Than the Existence of a Scanner

An employee may know that a fingerprint or facial scanner exists without knowing what happens to the information it generates.

That distinction can be important.

For example, an employee might understand that a fingerprint is required to clock in but still not know:

• What biometric information is created
• Why it is being stored
• How long it will be retained
• Whether an outside vendor receives it
• Whether it is used for another purpose
• What happens to it after employment ends

Where a law requires specific disclosures, merely making the physical scanner visible may not satisfy those requirements.

The actual notice and consent process can therefore become important evidence when evaluating workplace biometric practices.

Employers Often Rely on Outside Biometric Vendors

Many employers do not design their own biometric systems.

They purchase or license technology from vendors that provide time clocks, workforce-management platforms, access-control systems, payroll software, authentication tools, or cloud storage.

This can create a multi-company data flow.

An employee may scan a fingerprint at a device carrying the employer’s name while the resulting biometric information is processed through systems operated by another company.

The involvement of a vendor can raise several questions:

Who possesses the biometric information? Where is it stored? Does the vendor receive the biometric template itself? Can the vendor use the information for another purpose? Does another subcontractor have access?

The answers can matter because some biometric statutes separately regulate disclosure in addition to collection.

Issues involving outside recipients are addressed more specifically through Net Law Advocates’ biometric data sharing with third parties content.

Workplace Biometric Data Should Not Necessarily Remain Forever

An employee may use a biometric system thousands of times over several years.

Eventually, that employment relationship ends.

What happens to the biometric information then?

Retention is an important part of workplace biometric privacy because the original reason for maintaining an employee’s biometric identifier may disappear once the worker no longer needs access to the employer’s systems.

Illinois BIPA requires covered private entities possessing biometric identifiers or biometric information to maintain a publicly available written policy establishing a retention schedule and destruction guidelines.

Under the statute, covered biometric information generally must be permanently destroyed when the initial purpose for collecting or obtaining it has been satisfied or within three years of the individual’s last interaction with the private entity, whichever occurs first, subject to the statute’s terms.

Other jurisdictions use different standards.

The broader issue is addressed through Net Law Advocates’ biometric data retention and destruction content.

Biometric Information Requires Appropriate Security

Workplace biometric systems can create repositories of information associated with large numbers of employees.

That makes security an important part of the data lifecycle.

Illinois BIPA requires covered private entities possessing biometric identifiers or biometric information to store, transmit, and protect that information using a reasonable standard of care within their industry and in a manner at least as protective as the way they handle other confidential and sensitive information.

A security incident involving employee biometric information presents a different issue from a failure to obtain proper consent.

One concerns how the information was initially collected. The other concerns what happened after the employer or vendor possessed it.

When biometric information is exposed or acquired through a cybersecurity incident, the matter can overlap with biometric data breaches and broader data-breach law.

Facial Recognition Is Also Moving Into Workplace Environments

Workplace biometrics are not limited to scanners mounted next to a time clock.

Facial-recognition systems can be used to authenticate workers, control access, verify remote users, or identify individuals entering a secured area.

Unlike a fingerprint scanner, facial technology may sometimes operate through cameras without requiring an employee to physically touch a device.

That can change how obvious the biometric collection is to the worker.

Whether a particular system creates protected biometric information depends on what the technology actually does. Ordinary video surveillance does not automatically mean a biometric scan has occurred.

Where technology analyzes facial geometry for identification, however, biometric privacy protections may become relevant depending on the jurisdiction.

Net Law Advocates addresses the technology and related legal issues separately through its facial recognition privacy content.

Voice Biometrics Can Be Used for Employee Authentication

Workplace systems may also use characteristics of an employee’s voice.

Voice-biometric technology can create a voiceprint that allows a system to recognize or authenticate a speaker.

This should be distinguished from simply recording an employee’s voice.

A recorded meeting, customer-service call, or voicemail does not automatically establish that a biometric voiceprint was created. The relevant issue is whether technology analyzes characteristics of the voice to identify the individual.

Where voice biometrics are used, questions involving notice, consent, storage, vendors, and retention can resemble those presented by fingerprint and facial systems.

The distinction between audio recordings and biometric voiceprints is addressed through Net Law Advocates’ voiceprint privacy content.

Illinois BIPA Has Played a Major Role in Workplace Biometric Privacy

Illinois has been particularly significant in workplace biometric litigation because BIPA expressly regulates private entities’ handling of biometric identifiers and biometric information and provides a private right of action to people aggrieved by violations.

When BIPA applies, its requirements can affect multiple stages of the workplace biometric lifecycle.

The statute addresses written notice and releases before covered collection, retention and destruction policies, restrictions on selling or profiting from biometric information, disclosure to other parties, and standards for storing and protecting biometric data.

BIPA’s definition of “written release” specifically addresses employment and includes a release executed by an employee as a condition of employment.

Illinois amended the statute in 2024 to address repeated collection and disclosure. Under the amended law, repeated collection of the same person’s biometric identifier or biometric information using the same method constitutes a single violation of the applicable collection provision for recovery purposes. Repeated disclosure to the same recipient using the same method is likewise treated as a single violation of the applicable disclosure provision for recovery purposes.

This is an important change from older descriptions of BIPA litigation that treated each repeated scan as potentially creating a separate recoverable violation.

Workplace Biometric Privacy Extends Beyond Illinois

Illinois is important, but biometric technology is used in workplaces throughout the country.

Other states regulate biometric information differently.

Texas law, for example, defines biometric identifiers to include retina or iris scans, fingerprints, voiceprints, and records of hand or face geometry. As of January 1, 2026, its commercial biometric statute continues to require notice and consent before capture for a commercial purpose and includes provisions concerning disclosure and protection.

Washington uses a different framework. Its commercial biometric law regulates enrollment, disclosure, and retention of biometric identifiers for specified commercial purposes and contains its own definitions and exceptions, including provisions related to security purposes.

Those laws should not be treated as interchangeable with BIPA.

An employee’s rights can depend substantially on where the worker was located, what technology was used, why it was used, and which statute applies.

Does an Employer’s Use of Biometrics Automatically Create a Claim?

No.

Employers can use biometric technology for legitimate timekeeping, authentication, security, and access-control purposes.

The use of a fingerprint scanner or facial-recognition system by itself does not establish a legal violation.

A potential claim may require examining:

• What biometric identifier or information was collected
• Whether the applicable law covers that information
• Where the employee worked
• What written notice was provided
• Whether a release or consent was required
• Whether legally sufficient authorization was obtained
• Why the employer collected the information
• Which vendors received or possessed it
• How long the information was retained
• Whether applicable destruction requirements were followed
• How the information was secured
• Whether the relevant law provides an individual right to sue

These questions are highly dependent on the facts and jurisdiction.

What Should an Employee Preserve If Concerned About Workplace Biometrics?

Employees often have access to useful information even when the underlying biometric system is controlled entirely by the employer or vendor.

Potentially relevant materials can include:

• Biometric consent or release forms
• Employee handbooks
• Workplace privacy policies
• Timekeeping instructions
• Emails announcing a biometric system
• Screenshots from employee portals
• Documents identifying the technology vendor
• Policies concerning retention or deletion
• Communications provided when employment ended
• Photographs showing the type of scanner used

Employees should preserve documents they lawfully possess rather than attempting to access employer or vendor systems without authorization.

Technical evidence may later help determine what biometric information the system created, which organizations possessed it, and how long it remained stored.

Workplace Biometrics Involve an Entire Data Lifecycle

The employee’s interaction with a scanner may take only a second.

The biometric information generated through that interaction can exist much longer.

It may be collected, converted into a template, associated with an employee record, stored by an employer or vendor, used repeatedly for authentication, disclosed to another company, retained after employment, and eventually destroyed or exposed.

Different legal requirements may apply at different stages.

Biometric data collection without consent addresses the authorization surrounding the initial collection. Third-party sharing raises disclosure issues. Retention concerns what happens after the employer no longer needs the information. A security incident presents another set of questions entirely.

Viewing workplace biometrics as a lifecycle rather than merely a fingerprint scan helps identify what actually happened to an employee’s information.

Speak With Net Law Advocates About Workplace Biometric Privacy

Employees may know that they used a biometric system every day without knowing what information it created, where that information was stored, whether a vendor received it, or what happened to it after their employment ended.

Determining whether a potential claim exists can require examining the technology, notice and consent process, employer and vendor practices, retention policies, security, and the biometric law that applies in the employee’s jurisdiction.

Net Law Advocates represents plaintiffs nationwide in biometric privacy matters. If you believe an employer improperly collected, stored, shared, retained, or otherwise handled your biometric information, contact Net Law Advocates at 888-913-2318 to schedule a free, confidential consultation.