State Biometric Privacy Laws

There is no single state biometric privacy law that governs every fingerprint scan, facial-recognition system, voiceprint, or other use of biometric information in the United States.

Instead, biometric privacy is governed through a developing combination of biometric-specific statutes, broader state consumer privacy laws, data breach laws, and other legal protections.

The differences can be substantial.

A biometric practice that creates a private claim under one state’s law may be subject primarily to government enforcement in another. Definitions of biometric data vary. So do consent requirements, disclosure restrictions, retention rules, exceptions, and available remedies.

For someone whose biometric information may have been improperly collected or used, location is therefore only the beginning of the analysis. It can also matter where the collection occurred, what company collected the information, how the technology worked, why the information was used, and which state law applies to the conduct.

Net Law Advocates represents individuals nationwide in matters involving biometric privacy.

Why Do Biometric Privacy Rights Differ by State?

The United States has developed biometric privacy protections through multiple legal frameworks rather than one uniform rule for private businesses.

Some states have enacted laws specifically directed at biometric identifiers.

Others regulate biometric information as sensitive personal data within broader consumer privacy statutes. Biometric information can also be covered by state data breach notification laws when it is compromised in a security incident.

Those laws do not necessarily use the same definitions.

One statute might expressly identify fingerprints, voiceprints, and scans of face geometry. Another may define biometric data more generally as information generated through technological processing of biological characteristics for identification.

A photograph may be excluded while information generated by analyzing that photograph for identification is covered.

These distinctions can determine whether a particular technology falls within a statute at all.

Illinois BIPA Provides Some of the Nation’s Most Specific Biometric Protections

Illinois’ Biometric Information Privacy Act, commonly known as BIPA, has played a particularly significant role in biometric privacy litigation.

BIPA defines a “biometric identifier” to include a retina or iris scan, fingerprint, voiceprint, and scan of hand or face geometry. The statute separately defines “biometric information” as certain information based on an individual’s biometric identifier that is used to identify that individual.

The definitions also contain important exclusions. Photographs, for example, are excluded from the statutory definition of a biometric identifier, as are various other categories identified in the Act.

That means the mere use of a photograph or camera does not automatically establish that BIPA applies. The way technology processes information can matter.

What Does Illinois BIPA Require?

BIPA regulates several stages in the lifecycle of covered biometric information.

Before a covered private entity collects, captures, purchases, receives through trade, or otherwise obtains biometric identifiers or biometric information, it generally must provide written notice that the information is being collected or stored, explain the specific purpose and length of time for which it is being collected, stored, and used, and receive a written release.

The Act also addresses:

• Retention and permanent destruction
• Sale, lease, trade, or other profiting from biometric information
• Disclosure, redisclosure, and dissemination
• Storage, transmission, and protection of biometric information

Illinois therefore does not treat biometric privacy as solely a consent issue. Obligations can continue after the information has been collected.

Net Law Advocates addresses these stages individually through its content concerning biometric collection without consent, third-party sharing, and biometric retention and destruction.

Illinois BIPA Includes a Private Right of Action

One of the most important differences between BIPA and some other state biometric statutes is enforcement.

Illinois law provides a right of action to a person aggrieved by a violation of BIPA.

The statute provides for liquidated damages of $1,000 or actual damages, whichever is greater, for negligent violations and $5,000 or actual damages, whichever is greater, for intentional or reckless violations. It also provides for reasonable attorneys’ fees and costs and other relief a court deems appropriate.

The Illinois legislature amended BIPA in 2024 to address repeated collection and disclosure.

Under the amended law, repeated collection of the same person’s biometric identifier or biometric information using the same method, when performed in violation of Section 15(b), constitutes a single violation for which the person is entitled to at most one recovery under that provision.

Similarly, repeated disclosures of the same biometric information from the same person to the same recipient using the same method, when in violation of Section 15(d), constitute a single violation for purposes of recovery under that provision.

This is particularly relevant to technologies such as biometric time clocks, where the same employee may interact with a scanner many times.

BIPA Does Not Apply to Every Use of Biometric Technology in Illinois

BIPA contains statutory definitions, limitations, and exclusions that can materially affect whether it applies.

For example, the Act excludes certain information captured from patients in healthcare settings and certain information collected, used, or stored for healthcare treatment, payment, or operations under HIPAA. It also excludes specified anatomical and medical imaging and other categories from its definition of biometric identifiers.

BIPA also contains exclusions affecting certain financial institutions and government-related contractors, among others.

As a result, the fact that biometric technology was used in Illinois does not by itself establish a BIPA violation.

The information and entity must fall within the statute, and the conduct must be evaluated under the relevant provisions.

Texas Has Its Own Biometric Identifier Law

Texas regulates biometric identifiers through Chapter 503 of its Business and Commerce Code.

The statute defines a biometric identifier as a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry.

A person generally may not capture an individual’s biometric identifier for a commercial purpose without first informing the individual and receiving consent to the capture.

Texas also restricts certain sales, leases, and disclosures of biometric identifiers and establishes requirements concerning their storage and destruction.

The framework resembles Illinois law in some respects, but the statutes should not be treated as interchangeable.

Texas Clarified Its Law Beginning in 2026

Texas amended its biometric statute effective January 1, 2026.

The law now specifies that an individual is not considered informed of, and has not provided consent for, commercial capture or storage merely because an image or other media containing the person’s biometric identifier exists on the internet or another publicly available source, unless the individual made the material publicly available.

That distinction is increasingly relevant as facial-recognition and artificial-intelligence technologies make it possible to process images and other media available online.

The existence of a photograph on the internet should therefore not automatically be equated with consent to every form of biometric processing under Texas law.

Texas and Illinois Differ Significantly in Enforcement

For an affected individual, the enforcement mechanism can be as important as the substantive privacy rule.

Illinois BIPA expressly provides a private right of action.

Texas’ biometric-specific statute uses a different enforcement model. The Texas Attorney General may bring an action to enforce Chapter 503 and seek civil penalties authorized by the statute.

That means conduct regulated by Texas biometric law does not necessarily give an individual the same type of direct statutory lawsuit available under Illinois BIPA.

Other legal theories or statutes may be relevant depending on the facts, but the biometric-specific laws themselves should not be treated as providing identical remedies.

Washington Regulates Enrollment of Biometric Identifiers

Washington has another distinct biometric framework.

Its law defines a biometric identifier as data generated through automatic measurements of an individual’s biological characteristics, such as a fingerprint, voiceprint, retina, iris, or other unique biological pattern or characteristic, when used to identify a specific individual.

Washington expressly excludes physical or digital photographs, video or audio recordings, and data generated from them from that definition. It also contains a healthcare-related exclusion.

The statute defines “enroll” more specifically as capturing a biometric identifier, converting it into a reference template that cannot be reconstructed into the original output image, and storing it in a database that matches the identifier to a specific individual.

Those definitions demonstrate why determining how a particular biometric system works can be critical.

Washington Uses a Different Notice-and-Consent Structure

Washington generally prohibits enrolling a biometric identifier in a database for a commercial purpose without first providing notice, obtaining consent, or providing a mechanism to prevent subsequent use for a commercial purpose.

The statute also regulates certain disclosures and uses of enrolled biometric identifiers and limits how long covered information may be retained.

But Washington’s definition of “commercial purpose” is narrower and more specific than an ordinary understanding of commercial activity. The statute defines it in connection with sale or disclosure to a third party for marketing goods or services unrelated to the initial transaction and excludes security and law-enforcement purposes.

That is one reason statutory language matters more than simply asking whether a company used biometrics in its business.

Washington Does Not Mirror BIPA’s Private Lawsuit Structure

Washington also differs from Illinois in enforcement.

Violations of Washington’s biometric statute are treated as matters affecting the public interest under the state’s Consumer Protection Act, but the biometric statute specifies that it may be enforced solely by the Washington Attorney General.

A person should therefore not assume that because conduct would potentially be regulated under Washington’s biometric statute, the individual automatically has the same direct statutory claim that BIPA provides in Illinois.

The underlying facts may implicate other laws, but that requires a separate analysis.

Broader State Privacy Laws Can Also Protect Biometric Data

Biometric-specific statutes are only part of the legal landscape.

A growing number of states regulate biometric information through comprehensive consumer privacy laws.

These statutes may classify certain biometric information as “sensitive data” and impose additional requirements on covered businesses that process it.

Colorado provides one example.

The Colorado Privacy Act requires covered controllers to obtain affirmative consent before collecting and processing sensitive data. The Colorado Attorney General explains that valid consent must be affirmative, freely given, specific, informed, and unambiguous. Acceptance of broad terms of service or agreement obtained through deceptive interface design does not by itself satisfy that standard.

These comprehensive privacy laws can differ substantially in who is covered, which consumers receive rights, what exemptions apply, and how violations are enforced.

They should not be treated as interchangeable with BIPA merely because both regulate some form of biometric information.

Biometric Data Can Also Be Protected by Data Breach Laws

Another layer becomes relevant when biometric information is compromised in a cybersecurity incident.

State breach-notification statutes define the types of personal information that can trigger notification obligations. Some expressly include qualifying biometric information.

That creates a distinction between biometric privacy law and data breach law.

A company could potentially face questions about whether it properly collected or retained biometric information even though no breach occurred.

Conversely, biometric information could be lawfully collected and later become involved in a cybersecurity incident.

Net Law Advocates addresses that intersection through its biometric data breach content.

The Same Technology Can Be Treated Differently Across State Lines

Consider an employer that uses fingerprint authentication at facilities in several states.

The physical scanner might be identical at each location. The vendor may be the same. The biometric template may be created using the same technology.

The employees’ legal rights may still differ.

Illinois may impose BIPA’s written notice, release, retention, disclosure, and security requirements.

Another state’s biometric-specific law may use different consent language and provide government rather than private enforcement.

A third state might regulate the information principally through a comprehensive consumer privacy statute, employment law, data breach statute, or another legal theory.

The technology alone therefore does not determine the legal outcome.

Where You Live Is Not Always the Only Relevant Location

Determining which state’s law applies can become complicated when biometric systems cross state lines.

An individual may live in one state, interact with biometric technology in another, and have the resulting information processed or stored by a vendor somewhere else.

An employer may operate nationally. A mobile application may serve users throughout the country. A cloud-based biometric provider may process information remotely.

Courts may need to consider where the relevant conduct occurred and whether a particular state’s statute applies to that conduct.

Someone should not assume that a law applies solely because the company has operations in that state or because the individual currently lives there.

What Types of Biometric Practices Can State Laws Regulate?

Depending on the state and statute, biometric privacy requirements may affect several different activities:

• Collecting or capturing biometric information
• Providing notice before collection
• Obtaining consent or a written release
• Using biometric information for identification or authentication
• Selling or profiting from biometric information
• Sharing or disclosing information to another company
• Retaining information after its original purpose has ended
• Destroying stored biometric information
• Protecting biometric information against unauthorized access

Not every state regulates every one of these activities.

That is why identifying the particular privacy concern is usually more useful than simply asking whether a state “has a biometric law.”

A Fingerprint, Photograph, and Facial Template May Receive Different Treatment

Definitions are one of the most important differences among state laws.

A fingerprint scan used for identification may clearly fit within several biometric statutes.

A photograph presents a more complicated issue.

Illinois BIPA expressly excludes photographs from its definition of biometric identifiers, while separately protecting certain information based on covered biometric identifiers.

Washington likewise excludes photographs and video or audio recordings from its biometric-identifier definition.

Other state privacy statutes use their own definitions of biometric or sensitive data.

As a result, saying that a company “has my face” does not provide enough information to determine which biometric law applies. The analysis may depend on whether the company merely possessed an image or technologically processed biological characteristics to identify the person.

Do All State Biometric Privacy Laws Allow Individuals to Sue?

No.

This is one of the most important distinctions for consumers and employees.

Illinois BIPA expressly provides a private right of action to an aggrieved person.

Texas’ biometric statute relies on enforcement by the Texas Attorney General.

Washington’s biometric statute likewise specifies Attorney General enforcement.

Broader state consumer privacy statutes have their own enforcement provisions, which may or may not permit private litigation for the conduct at issue.

The fact that a statute regulates biometric information therefore does not, by itself, establish that an affected individual can file a lawsuit under that statute.

What Determines Whether You May Have a Biometric Privacy Claim?

The answer usually requires more than identifying a state.

An attorney evaluating a potential biometric privacy matter may need to determine:

• What physical or biological characteristic was involved
• What information the technology actually generated
• Whether that information falls within the applicable statutory definition
• Where the collection or processing occurred
• What notice was provided
• What consent or release was obtained
• Why the information was collected
• Whether another company received it
• How long it was retained
• Whether the information was compromised in a breach
• Whether a statutory exclusion or exemption applies
• Which state’s law governs the conduct
• Whether that law allows the affected individual to bring a claim

These issues can be particularly important with national employers and technology companies because the same system may affect thousands of people in different jurisdictions.

Biometric Privacy Law Continues to Change

State biometric privacy law is an active area of legislation.

For example, Illinois lawmakers have continued to introduce proposals in the 2025–2026 General Assembly that would alter portions of BIPA, including proposals addressing security uses and biometric time clocks. As of September 2026, those proposals remain legislation rather than amendments that have taken effect.

This distinction matters.

Proposed legislation should not be confused with current law, and older descriptions of biometric statutes may no longer accurately reflect amendments that have already taken effect.

The legal analysis should be based on the law in effect during the relevant conduct.

Understanding Your Rights Starts With the Specific Biometric Practice

There is no meaningful answer to whether biometric collection is “legal in the United States” without additional facts.

Fingerprint timekeeping presents different issues from facial recognition. Collection raises different questions from disclosure. Retention is different from a data breach.

And Illinois law can provide materially different rights and remedies from those available under the biometric laws of Texas or Washington.

The starting point is therefore the specific conduct: what biometric information was collected, what happened to it, where the conduct occurred, and which law governs it.

From there, the applicable state framework can determine what duties existed and whether the affected person may have a legal remedy.

Speak With Net Law Advocates About State Biometric Privacy Laws

Biometric privacy rights vary significantly from state to state, and the existence of a biometric privacy statute does not necessarily mean every person affected by the technology has a private lawsuit.

Net Law Advocates represents plaintiffs nationwide in biometric privacy matters. If you believe a company or employer improperly collected, used, retained, disclosed, or failed to protect your fingerprint, facial geometry, voiceprint, or other biometric information, contact Net Law Advocates at 888-913-2318 to schedule a free, confidential consultation.