Question 1

What are biometric privacy laws?

Accepted Answer

Biometric privacy laws regulate the collection, storage, use, and sharing of biometric data such as fingerprints, facial geometry, voiceprints, retina scans, and other unique biological identifiers. These laws typically require businesses to obtain consent before collecting biometric data, maintain written retention policies, and provide individuals with rights regarding their biometric information. Illinois BIPA is the most well-known, but over 20 states now have biometric-relevant privacy laws.

Question 2

Which states have biometric privacy laws?

Accepted Answer

Three states have dedicated biometric privacy laws: Illinois (BIPA), Texas (CUBI), and Washington (Biometric Privacy Law). Additionally, over 17 states have comprehensive privacy laws that classify biometric data as sensitive data requiring opt-in consent, including California (CCPA/CPRA), Colorado (CPA), Connecticut (CTDPA), Virginia (VCDPA), Montana, Oregon, Delaware, New Jersey, Nebraska, Maryland, Minnesota, New Hampshire, Indiana, Kentucky, Rhode Island, Tennessee, and Iowa.

Question 3

What is Illinois BIPA and why is it important?

Accepted Answer

The Illinois Biometric Information Privacy Act (BIPA) is the strongest biometric privacy law in the United States. Enacted in 2008, it is critical because it includes a private right of action, meaning individuals can sue companies directly for violations. Penalties range from $1,000 per negligent violation to $5,000 per intentional violation. BIPA has led to landmark settlements including Meta ($1.4 billion), Google ($100 million), and Clearview AI, making it the most consequential biometric privacy law for businesses.

Question 4

Do I need written consent to collect fingerprints?

Accepted Answer

In Illinois, yes — BIPA requires informed written consent before collecting any biometric identifiers, including fingerprints. In Texas and Washington, you must obtain consent (though not necessarily written) before capturing biometric identifiers. In states with comprehensive privacy laws like California, Colorado, and Virginia, biometric data is classified as sensitive data requiring opt-in consent. If you operate across multiple states, implementing written consent for fingerprint collection is a best practice that satisfies the strictest requirements.

Question 5

What are the penalties for violating biometric privacy laws?

Accepted Answer

Penalties vary by state. Illinois BIPA allows $1,000–$5,000 per violation with a private right of action (individuals can sue directly). Texas CUBI penalties are up to $25,000 per violation enforced by the Attorney General. Washington allows up to $7,500 per violation under the Consumer Protection Act. Most comprehensive privacy laws impose $7,500–$20,000 per violation through AG enforcement. The cumulative exposure can be massive — Meta settled a BIPA class action for $1.4 billion, and many companies face multi-million-dollar claims.

Biometric Privacy Law Compliance Checker

Where Does Your Organization Operate?