Can You Sue A Company For Collecting Your Biometrics Without Permission?
Your face, fingerprints, voice, and other biometric traits are different from things like email addresses or passwords. You can change a password after a security issue, but you cannot change your fingerprint or facial features. This difference is why biometric privacy has become a key legal concern as more businesses use these systems. If a company collected, stored, shared, or used your biometric information without the required notice or consent, you might have a claim. Whether you can sue, what you need to prove, and what compensation you could get depend on where it happened and which law applies.
At Net Law Advocates, we help people across the United States with cases involving biometric privacy, cyber law, data breaches, and identity theft. We look into how companies got biometric information, what they told those affected, how the information was used and stored, if it was shared with others, and whether privacy laws were followed.
What Is Considered Biometric Information?
Biometric information usually means physical or behavioral traits that can identify or verify a person. Depending on the technology and the law, this can include fingerprints, iris or retina scans, voiceprints, scans of face or hand shapes, and details taken from these features.
Biometric technology is now common in everyday life. Employees might scan a finger or hand to clock in. Customers may use facial recognition to access their accounts. Companies can use voice recognition for security. Businesses also use facial analysis in security systems, apps, websites, and other digital services.
Not every photograph, recording, or piece of information about a person’s physical appearance automatically qualifies as legally protected biometric information. Definitions vary among state laws, making the particular technology and the way the company processed the information important to determining whether a claim exists.
Can A Company Legally Collect Your Biometrics Without Permission?
The answer depends on the law that applies. There is no single nationwide biometric privacy statute that gives every person identical private lawsuit rights in every state. Several states regulate biometric information, but their requirements, exemptions, enforcement mechanisms, and available remedies differ.
Illinois has one of the country’s most significant biometric privacy statutes. Under the Illinois Biometric Information Privacy Act, commonly known as BIPA, a private entity generally may not collect or obtain covered biometric identifiers or biometric information unless it first provides specified written disclosures and receives a written release. The law also regulates retention, destruction, disclosure, sale, and protection of biometric information.
Other states have passed their own biometric and privacy laws. For example, Texas usually requires notice and consent before collecting a biometric identifier for business reasons, but its rules and enforcement are different from those in Illinois.
For that reason, we evaluate a potential biometric case based on the applicable state law, where the person was located, what technology was used, what the company collected, what disclosures were provided, and what happened to the information afterward.
Illinois BIPA Gives Individuals Significant Rights
Illinois BIPA is particularly important because it expressly provides a private right of action to a person aggrieved by a violation. A plaintiff therefore may be able to bring a lawsuit directly against a private entity rather than depending solely on a government agency to enforce the law.
BIPA requires covered private entities to provide written notice that biometric information is being collected or stored, explain the specific purpose and length of time for which it will be collected, stored, and used, and obtain a written release before collection. Companies possessing covered biometric information also have obligations concerning retention and destruction policies and restrictions concerning disclosure and profiting from biometric information.
These requirements can be important for employees who were required to use fingerprint or hand scanners as part of their jobs, as well as consumers whose biometric information was collected through facial recognition or other technology.
You May Have A Claim Even Without Identity Theft
One common misconception is that someone must first suffer identity theft or lose money before a biometric privacy lawsuit can be considered. That is not necessarily true.
Some biometric statutes protect the individual’s right to control how covered biometric information is collected and used. Under Illinois BIPA, for example, an aggrieved person has an express statutory cause of action. The law provides for liquidated damages of $1,000 or actual damages, whichever is greater, for negligent violations and $5,000 or actual damages, whichever is greater, for intentional or reckless violations, along with attorneys’ fees, costs, and other appropriate relief. Illinois amended BIPA in 2024 to limit recovery for repeated collection or disclosure involving the same biometric information under specified circumstances.
Whether statutory damages are available in any particular case depends on the law, facts, procedural requirements, and jurisdiction involved.
Employees May Be Affected By Workplace Biometric Collection
Workplace technology has become an important source of biometric privacy disputes. Employers may use fingerprint scanners, hand-geometry systems, facial recognition, voice authentication, or similar systems for timekeeping, security, building access, or identity verification.
The fact that biometric technology was required for work does not automatically eliminate an employee’s privacy rights. In Illinois, BIPA’s definition of a written release specifically addresses the employment context.
When evaluating an employee’s potential case, we may examine what the employee was told before enrollment, whether a valid release was obtained, why the information was collected, how long it was retained, what vendors received it, and whether legally required policies existed.
A claim may also involve a technology vendor or another business involved in collecting, processing, storing, or disclosing the information, depending on the circumstances and governing law.
What Happens If Biometric Information Is Shared With Another Company?
Collection is only one part of biometric privacy. What happens after collection can be equally important.
Businesses frequently rely on third-party technology providers to operate authentication systems, time clocks, security platforms, cloud services, and facial-recognition technologies. This can result in biometric information being transmitted beyond the company with which the individual originally interacted.
Illinois BIPA restricts disclosure and redisclosure of covered biometric identifiers and information except under specified circumstances, including consent and certain legally authorized disclosures. It also prohibits private entities from selling, leasing, trading, or otherwise profiting from a person’s covered biometric data.
We therefore investigate not only who originally collected the information but also where it went, who had access to it, and whether those transfers complied with applicable law.
What If Your Biometric Information Is Exposed In A Data Breach?
A breach involving biometric information creates a particularly serious concern because biometric characteristics can be permanent.
Illinois law requires covered private entities possessing biometric identifiers or biometric information to use the reasonable standard of care within their industry and to protect that information at least as carefully as other confidential and sensitive information.
When biometric information is involved in a breach, we examine both sides of the incident: whether the company lawfully collected and retained the information in the first place and whether reasonable measures were used to protect it.
A breach may potentially raise claims beyond a biometric privacy statute, depending on the facts. Additional issues can involve negligence, consumer protection laws, privacy statutes, contractual obligations, or other state and federal law.
What Should You Do If You Believe Your Biometrics Were Collected Without Permission?
Preserving information can make an important difference. Keep copies of privacy notices, consent forms, employment documents, emails, app disclosures, breach notifications, screenshots, and communications concerning the biometric system. Employees should consider retaining documents describing fingerprint, facial, voice, or hand-scanning requirements.
Avoid assuming that clicking a general privacy policy necessarily means legally sufficient biometric consent was given. Whether consent was adequate depends on the applicable statute and exactly what disclosures were made.
We can review these materials and determine which laws may apply, whether a private lawsuit is available, which companies may bear responsibility, and what remedies can potentially be pursued.
Net Law Advocates Represents Plaintiffs In Biometric Privacy Claims Nationwide
Companies are rapidly adopting technologies capable of identifying people through their faces, fingerprints, voices, and other unique characteristics. The convenience of those systems does not eliminate the responsibility to respect privacy rights or comply with applicable law.
At Net Law Advocates, our cybersecurity lawyers represent individuals, employees, consumers, and other plaintiffs in biometric privacy and related data litigation throughout the United States. We investigate how information was collected, whether required consent was obtained, where the information was stored, whether it was shared, and what happened when companies failed to protect it. If your think your personal data was stolen, please fill out our secure web form or call our law firm at 888-913-2318 for your free consultation. We can review what happened, determine which laws may apply, and explain whether you may have grounds to pursue a claim.
