Biometric Time Clock Privacy Lawyer

For many employees, clocking in no longer means punching a paper card or entering an identification number. A worker may instead place a finger or hand on a scanner or stand in front of a device that uses biometric technology to verify identity.

The interaction takes only a few seconds. What happens to the information behind that interaction can be considerably more complicated.

A biometric timekeeping system may capture information from an employee, create a digital template, associate it with an employee record, store it locally or remotely, and compare future scans against that template every time the worker begins or ends a shift. An outside technology or payroll company may also be involved.

Those practices can raise questions about employee notice and consent, storage, disclosure to vendors, retention after employment, and data security.

Net Law Advocates represents individuals nationwide in matters involving timekeeping systems and other forms of biometric privacy.

What Is a Biometric Time Clock?

A biometric time clock identifies employees using a physical or biological characteristic rather than relying solely on something such as a badge, password, or employee number.

Fingerprint scanners are a familiar example, but timekeeping technology can use other biometric characteristics as well.

Depending on the system, an employee might:

• Scan a finger
• Place a hand on a reader
• Use facial recognition
• Look into a device using iris or other biometric technology

The system then determines whether the biometric information presented matches information associated with the employee.

The important privacy issue is not simply the physical device hanging on the wall. It is the information the device generates and what happens to that information throughout the employment relationship.

How Does a Fingerprint Time Clock Work?

A fingerprint time clock does not necessarily store a conventional image of an employee’s fingerprint.

During enrollment, the system may analyze characteristics of the fingerprint and convert them into a digital or mathematical representation. That template can then be associated with the employee’s record.

On later shifts, the employee scans a finger again. The system analyzes the new scan and compares it with the enrolled information to determine whether there is a match.

This distinction matters because a company does not necessarily need to save an ordinary fingerprint image for biometric privacy law to become relevant.

Illinois BIPA, for example, expressly identifies a fingerprint as a biometric identifier and separately protects certain information based on a biometric identifier when that information is used to identify an individual.

The underlying technology therefore matters more than whether an employer describes the device simply as a “time clock.”

Enrollment and Daily Timekeeping Are Different Stages

A useful way to understand biometric timekeeping is to separate enrollment from everyday use.

Enrollment generally occurs when an employee first begins using the system. The device obtains biometric information that allows the worker to be recognized later.

Daily use occurs when the employee presents the same biometric characteristic while clocking in or out and the system attempts to match it against the enrolled information.

That creates an ongoing relationship with the employee’s biometric data.

The information may remain in the system for months or years while the employee continues working. Each shift may involve additional interaction with the technology.

This is one reason biometric time clocks raise different privacy concerns from a one-time identity-verification process.

Why Do Employers Use Biometric Time Clocks?

Employers may use biometric timekeeping for legitimate business reasons.

Traditional systems can allow one employee to clock in using another employee’s card, PIN, or credentials. Biometric systems are intended to associate a time entry with the individual employee.

They can also integrate directly with scheduling, payroll, attendance, and workforce-management platforms.

The usefulness of the technology does not itself determine whether applicable biometric privacy requirements have been satisfied.

An employer may have a legitimate reason for adopting biometric timekeeping while still being required to follow laws governing how covered biometric information is collected, stored, disclosed, retained, or destroyed.

Illinois BIPA Has Been Particularly Important for Biometric Time Clocks

Illinois’ Biometric Information Privacy Act has played a major role in disputes involving workplace timekeeping.

BIPA expressly defines fingerprints and scans of hand geometry as biometric identifiers. It also establishes requirements concerning certain private entities’ collection and handling of biometric identifiers and biometric information.

Before collecting or otherwise obtaining covered biometric information, a private entity subject to BIPA generally must first:

• Inform the individual in writing that a biometric identifier or biometric information is being collected or stored
• Inform the individual in writing of the specific purpose and length of time for which it is being collected, stored, and used
• Receive a written release

BIPA defines a written release to include informed written consent or an electronic signature and, in the employment context, a release executed by an employee as a condition of employment.

Whether those requirements were satisfied depends on the actual documents, technology, and circumstances involved.

Knowing That You Use a Fingerprint Clock Is Not Necessarily the Entire Consent Question

An employee obviously may know that a fingerprint scanner is present.

That does not necessarily answer every question about biometric notice and consent.

The employee may understand that the scanner records working hours without knowing what biometric information is generated, why it is stored, how long it will be kept, or whether another company receives it.

Where BIPA applies, the statute specifically requires written information about collection or storage as well as the purpose and length of time for which the information is being collected, stored, and used.

A legal review may therefore focus on what the employee actually received before enrollment, not simply whether the worker could see the scanner.

The 2024 BIPA Amendment Changed the Treatment of Repeated Scans

Biometric time clocks are unusual because the same employee may interact with the system repeatedly.

A worker could scan a finger when arriving, leaving for lunch, returning, and ending a shift. Over several years of employment, that can result in thousands of scans.

Illinois amended BIPA in 2024 to address how repeated collection is treated for purposes of recovery.

Under the current statute, when a private entity collects or otherwise obtains the same person’s biometric identifier or biometric information more than once using the same method of collection in violation of BIPA’s collection provision, those repeated instances constitute a single violation for which the person is entitled to, at most, one recovery under that provision.

The law similarly treats repeated disclosure of the same person’s biometric information to the same recipient using the same method as a single violation for recovery under the disclosure provision.

That change is particularly important for biometric time-clock cases because older discussions of BIPA litigation may describe every clock-in or clock-out as creating a separately recoverable violation.

That is not how the current statute treats repeated collection using the same method.

A Time Clock Vendor May Also Handle the Biometric Information

The employer whose name appears on a worker’s paycheck may not operate the entire timekeeping system.

Employers frequently purchase time clocks and workforce-management software from outside vendors. Those companies may provide the scanner, software, cloud infrastructure, payroll integration, or data storage.

An employee could therefore interact with one device while information moves through systems controlled by several organizations.

Relevant questions can include:

Who created the biometric template? Where was it stored? Did the employer possess it? Did the timekeeping vendor receive it? Was another payroll or cloud provider involved?

Those details can matter because biometric laws may separately regulate disclosure in addition to collection.

The broader legal issues surrounding transfers to outside companies are addressed through Net Law Advocates’ biometric data sharing with third parties content.

What Happens to Biometric Time Clock Data After an Employee Leaves?

Timekeeping provides a clear reason for using employee identification information while someone is actively working.

That reason can change once employment ends.

Retention is therefore particularly important for biometric time-clock information.

Illinois BIPA requires a private entity possessing covered biometric identifiers or biometric information to develop a publicly available written policy establishing a retention schedule and guidelines for permanent destruction.

Under the statute, covered biometric information generally must be destroyed when the initial purpose for collecting or obtaining it has been satisfied or within three years of the individual’s last interaction with the private entity, whichever occurs first, subject to the statute’s terms.

An employee leaving a job may not know whether the biometric information associated with the timekeeping system was deleted from the employer’s system, the vendor’s system, or both.

Those questions fit within the broader issue of biometric data retention and destruction.

Time Clock Data Can Also Be Involved in a Security Incident

A biometric time clock creates information that must be stored somewhere for the system to recognize employees later.

That creates a security issue separate from consent.

An employer could potentially comply with requirements surrounding the initial enrollment yet later experience a cybersecurity incident involving stored biometric information.

Illinois BIPA requires covered private entities to use a reasonable standard of care within their industry when storing, transmitting, and protecting biometric identifiers and biometric information. It also requires biometric information to be protected at least as carefully as other confidential and sensitive information.

The practical consequences of an incident depend on what information was actually exposed. A biometric template is not necessarily equivalent to an ordinary fingerprint image, and exposure does not automatically mean the data can be used against every biometric system.

Still, incidents involving stored biometric information can create additional legal issues beyond the original timekeeping process.

Net Law Advocates addresses those situations through its biometric data breach content.

Biometric Time Clock Privacy Is Narrower Than Workplace Biometric Privacy

Biometric timekeeping is one use of biometrics at work.

Employers may also use fingerprints, facial recognition, voiceprints, or other biometric systems for building access, computer authentication, security, identity verification, or other purposes unrelated to recording working hours.

Those broader employment uses belong within workplace biometric privacy.

The distinction matters because a worker searching specifically for information about a fingerprint or biometric time clock is usually trying to understand a particular system they interact with every day.

This page focuses on that timekeeping relationship: enrollment, repeated scans, payroll and workforce vendors, consent, storage, retention, and destruction.

Is Every Fingerprint Time Clock Covered by BIPA?

Not necessarily.

Whether BIPA applies requires more than simply establishing that an employee touched a device with a finger.

The statute contains definitions, exclusions, and limitations that can affect whether particular information is covered. The technology used by the system can also matter.

Likewise, BIPA applies in Illinois and should not be treated as a nationwide biometric statute.

Other states have their own biometric and consumer privacy laws, with different definitions, requirements, exceptions, enforcement mechanisms, and available remedies.

A timekeeping system that creates a potential claim under one state’s law may produce a different legal result elsewhere.

Proposed Illinois Legislation Should Not Be Confused With Current Law

Biometric time clocks remain an active subject of legislative debate in Illinois.

Bills introduced during the 2025–2026 General Assembly have proposed changes to BIPA involving biometric time clocks, security uses, private lawsuits, notice requirements, and other provisions.

As of September 2026, those proposals have not replaced the current BIPA provisions described above. For example, HB 2838 was re-referred to the House Rules Committee in March 2026, and SB 3122 remained a proposed amendment rather than enacted law.

This distinction matters because proposed statutory language should not be presented to employees as though it already governs their rights.

Does Using a Biometric Time Clock Mean an Employee Has a Lawsuit?

No.

Biometric time clocks can be used lawfully.

The presence of a fingerprint, hand, or facial timekeeping system does not by itself establish that an employer or vendor violated biometric privacy law.

A potential claim may require examining:

• What biometric technology the time clock uses
• What information the system actually creates
• Where the employee worked
• Which law applies
• What notice the employee received
• Whether consent or a written release was required
• Whether legally sufficient authorization was obtained
• Which companies received or possessed the biometric information
• How long the information was retained
• Whether applicable destruction requirements were followed
• Whether the data was adequately protected
• Whether the applicable statute permits an individual lawsuit

The specific facts surrounding the system are therefore more important than the presence of the scanner alone.

Documents Can Help Explain What Happened to an Employee’s Biometrics

Workers may not have access to the technical systems behind a time clock, but they often possess useful records.

Potentially relevant materials include biometric consent forms, employee handbooks, timekeeping policies, emails announcing a new system, onboarding documents, privacy notices, screenshots from employee portals, and information identifying the timekeeping or payroll vendor.

An employee may also remember when the biometric system was introduced, whether a consent form was provided before the first scan, and whether the system continued to be used throughout employment.

Workers should preserve records they lawfully possess rather than attempting to access employer or vendor systems without authorization.

Those materials can help an attorney determine what additional technical or business records may be important.

Speak With Net Law Advocates About Biometric Time Clock Privacy

An employee may scan a fingerprint or other biometric identifier several times every workday without knowing what information the time clock creates, where it is stored, which companies receive it, or how long it remains after employment ends.

Whether those practices create a viable legal claim depends on the technology, notice and consent process, employer and vendor conduct, jurisdiction, and applicable biometric privacy law.

Net Law Advocates represents plaintiffs nationwide in biometric privacy matters. If you believe an employer or timekeeping provider improperly collected, stored, shared, retained, or otherwise handled your biometric information, contact Net Law Advocates at 888-913-2318 to schedule a free, confidential consultation.