Biometric Data Privacy: Fingerprints, Face Recognition, and the Law

Biometric data, including fingerprints, facial geometry, iris patterns, voiceprints, and gait patterns, is uniquely sensitive because it is permanent. A stolen password can be changed; a stolen fingerprint cannot. As biometric authentication becomes ubiquitous in phones, offices, airports, and retail environments, the privacy implications of collecting and storing this data demand careful consideration.

How Biometric Data Is Collected and Used

Device authentication. Apple’s Face ID and Touch ID, Samsung’s fingerprint sensors, and Windows Hello create mathematical representations (templates) of your biometric data stored in secure hardware enclaves on your device. These templates do not leave your device and cannot be reverse-engineered into an actual fingerprint or face image.

Surveillance and identification. Law enforcement agencies use facial recognition systems like Clearview AI, which has scraped over 30 billion photos from social media and the open web to create a searchable database. Retail stores use facial recognition for loss prevention. Airports use it for boarding verification. These systems operate without your active consent and create persistent identification capability.

Employer biometrics. Companies collect fingerprints for building access and time-and-attendance tracking. Without proper legal basis and security, these databases become targets. A breach of employer biometric data is particularly harmful because the data cannot be changed.

Legal Landscape

Illinois BIPA (Biometric Information Privacy Act) is the strongest US biometric privacy law. It requires informed written consent before collecting biometric data, prohibits selling biometric information, requires a publicly available retention and destruction policy, and provides a private right of action (individuals can sue). BIPA has generated billions in settlements: Facebook/Meta paid $650 million, Google paid $100 million, and TikTok paid $92 million.

Texas and Washington have biometric privacy laws but without the private right of action that makes BIPA so impactful.

GDPR classifies biometric data as a “special category” requiring explicit consent for processing.

No federal US biometric privacy law exists as of 2025, though proposals have been introduced in Congress.

Protecting Your Biometric Privacy

Understand where your biometrics are stored. On-device storage (Apple Face ID, Windows Hello) is significantly safer than cloud-based biometric databases because the data never leaves hardware you control.

Be cautious with employer biometric systems. Understand your rights under state law before providing biometric data. Request information about how data is stored, who has access, and the retention policy.

Limit social media photo exposure. Facial recognition systems like Clearview AI scrape public photos to build their databases. Restricting your profile photos to friends-only reduces this exposure.

For the legal framework around biometric data, see our privacy legislation worldwide guide. To understand how biometrics enhance device security, explore our mobile device security checklist.

Making Informed Decisions About Biometrics

When evaluating whether to use biometric authentication, consider where the data is stored. On-device biometrics (Apple Face ID, Windows Hello) store your biometric template in hardware security modules that never transmit the data to external servers. These implementations are generally safe and significantly improve security by replacing weak PINs with stronger biometric verification.

Cloud-based biometric systems, where your biometric data is transmitted to and stored on remote servers, carry higher risk. If the server is breached, your biometric data is permanently compromised. Ask providers specifically where biometric data is stored, whether it is encrypted, and what their breach notification policy covers.

For workplace biometric systems, understand your state’s legal protections before providing biometric data. If you are in Illinois, your employer must obtain written consent and provide a retention policy. Document the consent you provide and any representations made about data handling.

The Growing Regulatory Landscape

Beyond Illinois’s BIPA, biometric privacy regulation is expanding. The EU AI Act includes provisions for facial recognition in public spaces. Several US cities including San Francisco, Boston, and Portland have banned government use of facial recognition. The trajectory suggests increasing regulation of biometric data collection and use, particularly for surveillance applications, as public awareness of the technology’s capabilities and risks grows.