Biometric data is any measurable physical or behavioral trait that can identify a specific person, from fingerprints and facial geometry to the rhythm of your keystrokes. Because these traits are permanently tied to your body, they cannot be reset the way a password can, and that permanence is what drives the laws around them. There is no comprehensive federal statute governing how companies collect or use this information in the United States, so your rights depend on a patchwork of state laws led by Illinois, Texas, Washington, and California.
What Biometric Data Actually Is
At its core, a biometric identifier is a measurement of something about your body or behavior that can distinguish you from everyone else. A fingerprint scanner at a gym, the face unlock on your phone, and an iris scanner at a corporate office all capture biometric data.
The legal significance is not in the raw image but in what happens next. The sensor’s reading is processed by an algorithm into a mathematical representation called a biometric template. That template is what gets stored, and it is what future scans are compared against to confirm your identity.
This distinction matters. A photograph of your face in an album is just a picture. That same face run through facial-geometry software to produce a unique numerical map becomes biometric data subject to privacy regulation. The template is what makes the data actionable for identification, and it is what most privacy laws target.
The Two Types of Biometric Identifiers
Biometric identifiers fall into two broad families: physiological traits, which measure fixed physical structure, and behavioral traits, which measure patterns in how you move or act.
Physiological Biometrics
Physiological biometrics are based on the anatomy of your body:
- Fingerprints, the most widely deployed biometric, used in phone unlocking, workplace time clocks, and law enforcement databases.
- Facial geometry, where software maps the distances and angles between features like your eyes, nose, and jawline. Airports, banking apps, and phone manufacturers rely on this.
- Iris and retina scans. The colored ring around your pupil and the blood vessel pattern at the back of your eye are both highly unique, and both show up in high-security environments and some border control systems.
- Hand geometry, meaning the shape and proportions of your hand and fingers, used in some access-control systems.
- Voiceprints, the acoustic properties of your voice, which depend on the physical structure of your vocal cords and throat.
Behavioral Biometrics
Behavioral biometrics identify you by how you do something rather than by a fixed body part. They are newer, and they often run in the background without your awareness:
- Keystroke dynamics, meaning the speed, rhythm, and pressure of your typing.
- Gait analysis, the way you walk, including stride length and posture, which can identify you on camera even when your face is not visible.
- Touch patterns, meaning how you swipe, scroll, and tap on a touchscreen, including finger pressure and angle.
Banks and financial platforms increasingly use behavioral biometrics to detect fraud. If someone logs in with your credentials but types and navigates differently than you do, the system flags the session. The tradeoff is that this monitoring happens continuously, often without explicit notice.
Where Your Biometric Data Is Being Collected
Collection is far more common than most people realize. Your smartphone almost certainly stores a fingerprint or face template. Many airports use facial recognition at security checkpoints and boarding gates, comparing your face to the photo in your passport. Employers use fingerprint or facial-recognition time clocks to track attendance. Banks and financial apps use voice recognition on customer service calls and behavioral biometrics to flag suspicious logins. Smart home voice assistants process voiceprints to distinguish household members.
The practical concern is not one high-profile scan but the quiet accumulation across dozens of services. Each enrollment creates another copy of an identifier you can never change, stored on a server you do not control.
Why the Law Treats Biometric Data Differently
A stolen credit card number is a headache. Stolen biometric data is a permanent vulnerability, and that difference drives every major biometric privacy law in the country.
When a password leaks, you change it. When a Social Security number is compromised, you can freeze your credit and, in extreme cases, get a new number. You cannot reset your fingerprints, replace your irises, or redesign the geometry of your face. Once a biometric template is stolen, the person it belongs to is exposed for life across any system that relies on that same biometric, from banking apps to building access controls.
The risk is not theoretical. Printed photos and 3D-printed fingerprint molds can fool basic scanners, and advances in artificial intelligence have made deepfake attacks on facial recognition systems disturbingly effective. Research has found that fewer than one in a thousand people can accurately spot an AI-generated deepfake. A breach also does not just expose an account; it exposes the individual to tracking, surveillance, and identity fraud that no password reset can undo.
Your Rights Under State Biometric Privacy Laws
Because Congress has not passed a comprehensive biometric privacy statute, the states that have acted set the rules. Three enacted dedicated biometric statutes, and others fold biometric protections into broader consumer privacy laws. Your rights depend heavily on where you live or where the company collecting the data operates.
Illinois Gives You the Right to Sue
Illinois enacted the Biometric Information Privacy Act (BIPA) in 2008, and it remains the strongest biometric privacy law in the country, largely because it lets individuals sue companies directly. Before a private company can collect your fingerprint, faceprint, iris scan, or other biometric identifier, BIPA requires it to inform you in writing of what is being collected and why, disclose how long the data will be stored, and obtain your written consent.
Companies that hold biometric data must also publish a written policy setting out a retention schedule and guidelines for permanently destroying the data once its original purpose has been fulfilled or within three years of the individual’s last interaction with the company, whichever comes first.1Illinois General Assembly. Illinois Code 740 ILCS 14 – Biometric Information Privacy Act
What makes BIPA uniquely powerful is its private right of action. Any person whose biometric data is mishandled can file suit in state or federal court and recover $1,000 per negligent violation or $5,000 per intentional or reckless violation, plus attorney’s fees and litigation costs.2Illinois General Assembly. Illinois Code 740 ILCS 14/20 – Right of Action Those damages are per person, per violation, which is why BIPA class actions have produced enormous settlements against major technology companies.
Texas and Washington Rely on the Attorney General
Texas and Washington each have dedicated biometric privacy laws, but neither allows individuals to sue. The Texas Capture or Use of Biometric Identifier Act requires companies to provide notice and obtain consent before collecting biometric identifiers, and mandates destruction of the data within a reasonable time, no longer than one year after the purpose for collecting it ends. Violations carry civil penalties of up to $25,000 each, but only the Texas Attorney General can bring an enforcement action.
Washington’s biometric privacy law similarly prohibits enrolling a biometric identifier in a commercial database without notice and consent, and bars selling or disclosing biometric data without permission. Enforcement runs through the state Attorney General under Washington’s Consumer Protection Act, with no private right of action.
The enforcement gap is significant. In Illinois, a single aggrieved employee can launch a class action that costs a company hundreds of millions of dollars. In Texas and Washington, enforcement depends on the attorney general choosing to prioritize a particular case, which means many violations go unchallenged.
California Treats It as Sensitive Personal Information
California does not have a standalone biometric statute. Instead, the California Consumer Privacy Act classifies biometric information processed to identify a consumer as sensitive personal information, alongside genetic data, precise geolocation, and other high-risk categories.3State of California – Department of Justice – Office of the Attorney General. California Consumer Privacy Act (CCPA) California residents can direct businesses to limit their use of sensitive personal information to what is necessary to provide the requested service, ensure security, prevent fraud, and comply with legal obligations.4California Privacy Protection Agency. LOCKED Series: Right to Limit and Opt-Out Consumers also have the right to request deletion of their biometric data.
What Federal Law Does and Does Not Do
There is no comprehensive federal biometric privacy law. Congress has introduced bills over the years, including the National Biometric Information Privacy Act of 2020, which would have created BIPA-like protections nationwide, but none have become law.5Congress.gov. S.4400 – National Biometric Information Privacy Act of 2020
The Federal Trade Commission has some authority through its general power to police unfair and deceptive business practices, and it issued a policy statement specifically addressing biometric information under Section 5 of the FTC Act.6Federal Trade Commission. Policy Statement of the Federal Trade Commission on Biometric Information and Section 5 of the Federal Trade Commission Act FTC enforcement is reactive and case by case. It does not create the structured notice-and-consent framework the state statutes provide, so for the foreseeable future, biometric privacy in the United States remains a state-by-state matter.
Steps You Can Take Now
The most practical protection is limiting how much biometric data you hand out in the first place. Before enrolling a fingerprint or face scan with a new service, consider whether the convenience is worth creating another copy of an identifier you can never revoke. Ask what the company’s retention and deletion policies are.
If you live in California, use the “Limit the Use of My Sensitive Personal Information” link that covered businesses are required to display on their websites, and submit a deletion request for biometric data already collected. If you live in Illinois, know that any company collecting your biometric data without written notice and written consent is violating BIPA, and you can pursue damages individually or through a class action. If you live in Texas or Washington, you can report violations to your state Attorney General, though you cannot sue on your own behalf. For everyone else, pay attention to which state laws may apply to the companies you interact with, since some statutes reach beyond their state borders when a covered company handles the biometric data of out-of-state residents.