Biometric Data Collection Without Consent
A fingerprint scan can take seconds. Facial-recognition technology may operate through a camera. A voice-biometric system can analyze speech during an ordinary interaction.
In each situation, the person may provide information that can be used to recognize or authenticate them. Whether they knowingly agreed to that biometric collection is a separate question.
Biometric privacy laws in some states regulate when and how businesses may collect this information. The requirements vary substantially. Some statutes require particular disclosures and consent before covered biometric data is obtained. Others regulate narrower uses of biometric identifiers or provide exceptions based on how and why the technology operates.
For someone concerned that their biometric information was collected without permission, the important questions include what technology was used, what information it generated, what disclosures were provided, what the person agreed to, where the collection occurred, and which law applies.
Net Law Advocates represents individuals nationwide in matters involving biometric privacy.
What Does It Mean to Collect Biometric Data?
Biometric collection involves obtaining or generating information based on physical or biological characteristics that can be used to identify an individual.
Depending on the technology and applicable law, this can involve:
- Fingerprints
- Scans of hand geometry
- Scans of face geometry
- Voiceprints
- Retina or iris scans
- Other measurements of biological characteristics used for identification
The visible interaction with the technology does not necessarily reveal what information is actually being created.
A fingerprint scanner, for example, may analyze characteristics of a finger and create a digital biometric template. Facial-recognition software may analyze face geometry rather than merely save a photograph. Voice-authentication technology can analyze characteristics of speech to generate a voiceprint.
Determining whether legally protected biometric information was collected may therefore require understanding what happened after the initial image, scan, or recording was captured.
Being Aware of a Scanner Is Not Necessarily the Same as Providing Legally Sufficient Consent
People frequently know that some type of technology is being used.
An employee can see the fingerprint scanner used to clock in. A consumer may know that a mobile application is accessing a camera. A customer might intentionally look into a device for identity verification.
That awareness does not necessarily answer whether the person received whatever notice or provided whatever consent an applicable biometric law requires.
The reverse is also true. The absence of a traditional signed paper consent form does not automatically establish that biometric information was unlawfully collected.
Consent requirements differ among jurisdictions, and some laws recognize electronic consent or use different notice-and-consent standards.
The actual statutory requirements must be compared with what occurred.
Illinois BIPA Requires Specific Disclosures Before Covered Collection
Illinois’ Biometric Information Privacy Act provides one of the country’s most specific statutory frameworks for biometric collection.
BIPA defines biometric identifiers to include retina or iris scans, fingerprints, voiceprints, and scans of hand or face geometry. It separately defines biometric information as certain information based on an individual’s biometric identifier and used to identify that individual.
Before a private entity covered by BIPA collects, captures, purchases, receives through trade, or otherwise obtains a person’s biometric identifier or biometric information, the statute generally requires the entity to:
- Inform the person or legally authorized representative in writing that a biometric identifier or biometric information is being collected or stored.
- Inform the person in writing of the specific purpose and length of time for which the information is being collected, stored, and used.
- Receive a written release.
These are distinct requirements.
A document stating only that biometric technology will be used may therefore present a different issue from one explaining both the purpose of the collection and how long the information will be collected, stored, and used.
Whether a particular disclosure and release satisfy BIPA depends on their contents and the circumstances.
What Counts as a Written Release Under BIPA?
BIPA’s definition is broader than a handwritten signature on a paper document.
The statute defines a written release as informed written consent or an electronic signature. In the employment context, it also includes a release executed by an employee as a condition of employment.
That distinction matters because biometric collection frequently occurs digitally.
A company might present a consent process through an application, employee onboarding system, electronic account enrollment, or another digital interface.
The legal question is not simply whether paper was involved. It is whether the process satisfied the applicable requirements for notice and release.
Workplace Biometric Collection Presents Its Own Consent Issues
Employment is one of the most common settings in which people encounter biometric technology.
Workers may use fingerprints, hand scans, facial recognition, or other systems for timekeeping, building access, equipment access, authentication, or security.
An employer can require employees to use a biometric system as part of their jobs without that fact alone resolving whether applicable privacy requirements have been satisfied.
Illinois BIPA expressly recognizes releases executed by employees as a condition of employment. At the same time, covered collection remains subject to the statute’s written notice and release requirements.
The broader use of biometrics in employment is addressed through Net Law Advocates’ workplace biometric privacy content.
For employees specifically using fingerprint, hand, facial, or similar systems to record working hours, biometric time clock privacy presents a narrower set of recurring issues.
Facial Recognition Can Make Collection Less Obvious
Not all biometric collection requires a person to touch a scanner.
Facial-recognition systems can potentially analyze images captured through cameras. Depending on the technology, a person’s facial geometry may be analyzed for identification or verification.
This creates an important distinction between photographs and biometric information.
A photograph of a face is not necessarily a biometric scan. The legal issue can depend on whether technology analyzes the image to generate information covered by the applicable biometric statute.
The collection can also be less apparent to the individual than fingerprint enrollment.
Someone who deliberately presses a finger against a scanner generally knows that a physical characteristic is being captured. A person walking into a building, using an application, or interacting with a camera may have less understanding of whether facial-recognition technology is operating.
Those distinctions are examined more specifically in Net Law Advocates’ facial recognition privacy content.
Voice Recordings and Voiceprints Are Not the Same Thing
Similar issues arise with voice technology.
A company may record a customer-service call without necessarily creating a biometric voiceprint.
Voice-biometric technology goes further by analyzing characteristics of a person’s voice for identification or authentication.
Illinois BIPA specifically identifies a voiceprint as a biometric identifier.
Washington law provides another useful illustration of the distinction. Its commercial biometric statute defines biometric identifiers to include certain data generated through automatic measurement of biological characteristics, such as voiceprints, when used to identify a specific individual. The definition excludes physical or digital photographs, videos, audio recordings, and data generated from them.
Whether a company recorded someone’s speech and whether it created protected biometric information can therefore be two different questions.
Net Law Advocates addresses that distinction through its voiceprint privacy content.
Consent Requirements Are Not the Same in Every State
There is no single national biometric-consent rule that applies identically to every private company and every biometric system.
State laws differ in what they define as biometric information, when notice is required, what constitutes consent, which uses are exempt, how information may be disclosed, and who can enforce the law.
Texas
Texas law defines biometric identifiers to include retina or iris scans, fingerprints, voiceprints, and records of hand or face geometry.
For commercial capture, the statute generally requires a person to inform the individual before capturing the biometric identifier and receive the individual’s consent. Texas amended the law effective January 1, 2026 to clarify, among other things, that the mere existence of an image or other media containing biometric identifiers on the internet or another publicly available source does not by itself establish notice and consent for commercial capture or storage, unless the individual made the material publicly available.
Texas’ statute has its own enforcement structure and should not be treated as equivalent to Illinois BIPA.
Washington
Washington takes another approach.
Its commercial biometric statute regulates enrollment of biometric identifiers in databases for a defined “commercial purpose.” It provides that a person may not enroll a biometric identifier for that commercial purpose without first providing notice, obtaining consent, or providing a mechanism to prevent subsequent use for the commercial purpose.
The precise notice and type of consent required are context-dependent under the statute. Washington also contains exclusions and a security-purpose provision that materially affect its scope.
These differences illustrate why a statement such as “the company never got my written consent” cannot be evaluated without first determining which law governs the collection.
Consent to One Use Does Not Necessarily Resolve Every Later Use
Biometric information can move through several stages after collection.
A person may authorize biometric authentication for one reason, while questions later arise about another use of the same information.
For example, someone might provide biometric information to gain access to an account or workplace. The information might then be stored, processed by an outside technology provider, retained for an extended period, or potentially used for another purpose.
Whether the original authorization covers those later activities depends on the consent provided and applicable law.
Washington’s biometric statute, for example, restricts certain uses or disclosures that are materially inconsistent with the terms under which the biometric identifier was originally provided unless consent is obtained for the new terms.
Illinois BIPA separately regulates disclosure of covered biometric identifiers and biometric information, subject to statutory exceptions.
Collection consent should therefore not automatically be treated as unlimited permission for every future use or transfer.
Collection, Sharing, and Retention Are Separate Issues
Biometric privacy does not end once information has been collected.
An organization may satisfy requirements governing the initial collection but later face different questions concerning what it does with the information.
For example:
A company might obtain a valid release but disclose biometric information to another organization under circumstances not permitted by applicable law.
It might retain biometric information after the original reason for keeping it has ended.
Or it could fail to adequately protect biometric information and later experience a security incident.
These issues correspond to different stages of the biometric data lifecycle.
Net Law Advocates separately addresses biometric information shared with third parties, biometric retention and destruction, and biometric data breaches.
Does a Privacy Policy Count as Consent?
The answer depends on the law and what the policy actually says.
The mere existence of a privacy policy does not automatically establish that every biometric collection satisfies every applicable statute.
A legal analysis may consider where the disclosure appeared, what it said, when the person received it, what action the individual took, whether the law required affirmative authorization, and whether the disclosure addressed the information required by the statute.
Under Illinois BIPA, for example, covered collection requires the written disclosures and written release specified in Section 15(b).
A general statement buried in a broad privacy policy should therefore not automatically be assumed to satisfy those requirements.
At the same time, whether a particular digital consent process is legally sufficient depends on the actual interface and documentation rather than the label attached to it.
What If You Did Not Know Biometric Technology Was Being Used?
Sometimes the central issue is not whether a person signed something. It is whether the person knew biometric information was being generated at all.
This can arise with technologies that operate in the background or that appear to perform an ordinary function.
A person might believe a camera is simply capturing an image without knowing that facial geometry is being analyzed. Someone speaking with a call center may not realize that voice-biometric authentication is operating. An employee may know a fingerprint scanner records working hours without understanding that biometric information is being generated and stored.
Whether that lack of awareness creates a legal claim depends on the technology and law.
The first task is usually determining what information was actually created and what disclosures, if any, were provided before the collection occurred.
Evidence of the Consent Process Can Matter
Consent disputes often depend heavily on documents.
Someone concerned about biometric collection may want to preserve materials such as:
- Biometric consent or release forms
- Employee onboarding documents
- Screenshots of enrollment screens
- Privacy policies
- Terms presented during account creation
- Emails announcing biometric technology
- Workplace timekeeping policies
- Application permission screens
- Notices displayed near biometric devices
- Communications identifying a biometric technology provider
The timing of those materials can matter.
A consent form signed after biometric collection began presents a different factual situation from authorization obtained before enrollment. Likewise, a current privacy policy may not establish what disclosure was presented when the person originally provided biometric information.
Technical evidence may also be needed to determine what the system actually collected.
Can You Sue If Biometric Data Was Collected Without Consent?
Potentially, depending on the applicable law and facts.
Illinois BIPA provides a private right of action to a person aggrieved by a violation of the Act, making Illinois particularly significant in private biometric litigation.
Other states use different enforcement models.
Texas’ commercial biometric statute, for example, places enforcement authority with the Texas Attorney General rather than creating the same private cause of action available under BIPA.
Washington applies its Consumer Protection Act to violations of its biometric statute, with the statute specifically providing that it may be enforced solely by the state Attorney General.
Even where a private right of action exists, the presence of biometric technology does not automatically establish a viable lawsuit.
Relevant questions may include what information was collected, whether it meets the statutory definition, what disclosures were provided, whether legally sufficient consent or a release was obtained, where the collection occurred, which entity collected the information, and whether an applicable statutory exclusion applies.
The Key Question Is What Happened Before the Biometric Collection
Much of biometric privacy focuses on what happens to information after a company possesses it.
Collection without consent begins earlier.
What did the person know before the biometric information was obtained? What did the company disclose? What was the stated purpose? How long did the company say it would use and store the information? What authorization did the individual provide?
Those questions can establish whether the collection process complied with the law that governed it.
They can also reveal additional issues involving later storage, sharing, retention, or security.
That makes consent the beginning of the biometric data lifecycle rather than the end of the privacy analysis.
Speak With Net Law Advocates About Biometric Data Collection
People may interact with biometric technology at work, through financial services, in applications, during identity verification, or in other everyday settings without fully understanding what information is being generated.
Whether collection without consent creates a legal claim depends on the biometric technology, disclosures, authorization process, jurisdiction, and applicable law.
Net Law Advocates represents plaintiffs nationwide in biometric privacy matters. If you believe a company or employer collected your fingerprint, facial geometry, voiceprint, or other biometric information without legally sufficient notice or consent, contact Net Law Advocates at 888-913-2318 to schedule a free, confidential consultation.