Biometric Screenings: Consent, Retention, and Breach Rules

Biometric screening privacy laws in the United States are a patchwork rather than a single rule. No federal statute is dedicated to fingerprints, facial scans, iris patterns, voiceprints, or similar identifiers collected in a screening. Instead, a handful of federal laws reach biometric data in specific contexts, the Federal Trade Commission polices deceptive and unfair biometric practices under Section 5, and a small group of states — led by Illinois — impose the strictest and most enforceable obligations. What applies to any given screening turns on where it happens, who runs it, and why the data is being collected.

What Federal Law Reaches

Federal law touches biometric screenings only around the edges. The Americans with Disabilities Act bars employers from requiring medical examinations that are not job-related and consistent with business necessity.¹ Wellness screenings that measure blood pressure, cholesterol, or body composition can qualify as medical examinations, and the EEOC has said such screenings are permissible only when part of a voluntary wellness program or otherwise job-related.²

The Genetic Information Nondiscrimination Act separately prohibits employers from requesting, requiring, or purchasing genetic information about applicants or employees except in narrow circumstances.³ A screening program cannot fold in DNA analysis or family medical history for employment decisions. GINA uses the same remedies as Title VII, including compensatory and punitive damages capped by employer size.⁴

When a screening is run through an employer-sponsored health plan and the results qualify as protected health information, HIPAA imposes administrative, physical, and technical safeguards, with civil penalties that scale by culpability and rise sharply for willful neglect.⁵

For children, a 2025 amendment to the Children’s Online Privacy Protection Rule adds biometric identifiers — fingerprints, iris patterns, voiceprints, facial templates, gait patterns, and genetic data usable for automated recognition — to the definition of personal information. Sites and services directed at children under 13, or with actual knowledge they are collecting from them, must obtain verifiable parental consent before capturing any of it, with no biometric-specific carveouts.⁶

Outside those specific contexts, federal statutes do not directly regulate a fingerprint clock-in or a facial-recognition entry system. That is why the state laws below carry most of the weight.

State Biometric Privacy Laws

Roughly twenty states have comprehensive privacy laws that reach biometric data to some degree, with Indiana, Kentucky, and Rhode Island among the most recent to come online.⁷ A few states go further with statutes written specifically for biometric identifiers.

Illinois BIPA

The Illinois Biometric Information Privacy Act is the strongest law in the country and the only one giving individuals a private right of action. Liquidated damages start at $1,000 per violation for negligent conduct and rise to $5,000 per violation for intentional or reckless conduct, with attorney’s fees and costs on top.⁸ The Illinois Supreme Court held in 2023 that a separate claim accrues each time a company scans or transmits biometric data without proper consent, not just once per person.⁹ For an employer running fingerprint timekeeping every workday, exposure compounds quickly, and BIPA has driven class settlements worth hundreds of millions of dollars.

Texas

Texas takes the opposite enforcement route. Its Capture or Use of Biometric Identifier statute has no private right of action; only the attorney general can sue, with civil penalties up to $25,000 per violation. It requires notice and consent before capture for a commercial purpose, prohibits sale of biometric data, and requires destruction within one year after the collection purpose expires. For employer-collected data, that purpose is presumed to expire at the end of the employment relationship.¹⁰

Washington

Washington regulates commercial uses of biometric identifiers, requiring notice and consent before enrolling one in a database and barring sale or disclosure without consent.¹¹ Like Texas, it lacks a private right of action and enforcement runs through the attorney general.

California

California treats biometric identifiers, including facial recognition data, as sensitive personal information under its consumer privacy framework.¹² Residents can limit how the data is used and disclosed, ask what has been collected, request deletion, and opt out of sale. Inadequate security can expose a business to private suits and to civil penalties from the attorney general.

A single screening system compliant in one state can generate serious liability in another. Employers and vendors have to look at the map, not a single rulebook.

Notice and Consent Before a Screening

Where biometric screenings are regulated, the pattern is consistent. Before collection, the organization must give written notice of what data is being taken, the purpose, and how long it will be kept. BIPA requires disclosure of the specific purpose and the length of time for collection and use.⁸ Texas requires that the person be informed before capture and that consent be obtained.¹⁰

The consent itself has to be a written release signed by the individual or an authorized representative. Burying the language inside a general employee handbook or privacy policy does not satisfy the requirement. A standalone form that identifies the biometric data at issue and states that authorization is voluntary is the safer route, and an electronic signature with a date stamp generally works. If a third-party vendor will receive the data — a timekeeping service, a wellness platform — the notice has to say so before collection begins. Skipping that step is how per-scan liability piles up in Illinois.

Can You Refuse a Biometric Screening?

Sometimes, yes. Under Title VII, an employer must offer a reasonable accommodation when a sincerely held religious belief conflicts with a work requirement like fingerprint scanning or facial recognition. The alternative might be a PIN or a manual time sheet. The employer can refuse only if the accommodation would create an undue hardship, meaning a substantial burden in the overall context of the business, and the employee does not need to use magic words or file a written request to trigger the duty.¹³

For wellness screenings that measure health indicators like cholesterol or blood glucose, the EEOC’s GINA rule adds a layer. A program that requests health-related information counts as voluntary only when employees give prior, knowing, written authorization. Employers cannot cut off health insurance benefits or retaliate against workers who decline. A program also fails the “reasonably designed” standard if it uses unreasonably intrusive procedures or exists mainly to shift healthcare costs based on employee health status.¹⁴

How Long the Data Can Be Kept and How It Must Be Stored

Every biometric privacy statute demands that stored data get at least the same protection as the organization’s other sensitive records. BIPA sets the reasonable standard of care within the industry, at a level no less protective than the methods used for other confidential information.⁸ Texas uses nearly identical language.¹⁰ In practice that means encryption at rest and in transit, access controls, and regular audits.

Retention limits vary. Illinois requires permanent destruction when the initial collection purpose has been satisfied or within three years of the individual’s last interaction with the entity, whichever comes first, and the written retention and destruction policy must be publicly available.⁸ Texas requires destruction within one year after the purpose expires, with employer collection presumed to expire at termination.¹⁰ Washington requires only that identifiers not be retained longer than reasonably necessary for the enrollment purpose.¹¹ Documenting each destruction event creates the audit trail that proves compliance later.

If Biometric Data Is Breached

A biometric breach is not like losing a password. You can change a password. You cannot change your fingerprints or the geometry of your face, and that permanence is part of why legislatures treat this data separately.

Notification rules vary. Some biometric-specific laws require expedient notice; other states rely on their general breach statutes, most of which now include biometric identifiers in the definition of protected personal information. Timelines run from “as soon as practicable” to specific day counts depending on the state.

If your data is compromised, monitor accounts that use biometric authentication and move to alternative verification where possible. Depending on where the collection happened, you may be able to sue under a state biometric privacy law, especially where a private right of action exists. In states without one, the attorney general is the enforcement channel. A complaint to the FTC is also an option, since the Commission has said failing to secure biometric data can be an unfair practice.¹⁵

FTC Enforcement as the Federal Backstop

Without a biometric-specific federal statute, the FTC uses Section 5 to reach unfair and deceptive practices. Its 2023 policy statement describes what draws enforcement. A practice is deceptive when a company makes marketing claims about accuracy, reliability, or fairness without a reasonable basis, or misleads about how it collects or uses the data, including “half-truths” that disclose some purposes and hide others. On unfairness, the Commission expects companies to assess foreseeable harms before deploying biometric technology, test for accuracy gaps across demographic groups, disclose collection clearly, evaluate vendors, and train employees who handle the data. Discriminatory outcomes tied to biometric systems, especially where they gate access to benefits or services, are flagged as potentially unfair.¹⁵

Vendors and Third Parties

Outsourcing the screening does not transfer legal responsibility. The organization that collected the data generally retains liability for how it is handled downstream. The FTC’s biometric policy statement tells businesses to evaluate the practices of affiliates and vendors, obtain contractual assurances, and maintain oversight.¹⁵

A workable vendor contract identifies the types of biometric data involved, limits processing to the stated purpose, and forbids repurposing for the vendor’s own analytics or product work. Incident notification should carry a specific hour count rather than vague language. Audit rights, indemnification for breaches caused by vendor negligence, and clear destruction obligations at contract end round out the essentials.

Illinois BIPA prohibits selling, leasing, trading, or otherwise profiting from a person’s biometric data and limits disclosure to a narrow set of circumstances: the individual’s consent, completion of a financial transaction the individual requested, legal requirements, and court orders.⁸ Texas similarly bars sale, lease, or disclosure except in limited circumstances such as law enforcement requests or consumer-authorized financial transactions.¹⁰ Vendors receiving the data inherit those restrictions whether the contract spells them out or not, so both sides have reason to get the terms right up front.

1
Office of the Law Revision Counsel. 42 USC 12112 – Discrimination
2
U.S. Equal Employment Opportunity Commission. Enforcement Guidance on Disability-Related Inquiries and Medical Examinations of Employees under the ADA
3
U.S. Equal Employment Opportunity Commission. Fact Sheet – Genetic Information Nondiscrimination Act
4
Office of the Law Revision Counsel. 42 US Code 2000ff-6 – Remedies and Enforcement
5
eCFR. 45 CFR 160.404 – Amount of a Civil Money Penalty
6
Federal Register. Childrens Online Privacy Protection Rule
7
MultiState. All of the Comprehensive Privacy Laws That Take Effect in 2026
8
Justia Law. Illinois Code 740 ILCS 14 – Biometric Information Privacy Act
9
Supreme Court of Illinois. Cothron v White Castle System Inc, 2023 IL 128004
10
State of Texas. Texas Business and Commerce Code Section 503.001 – Capture or Use of Biometric Identifier
11
Washington State Legislature. RCW 19.375.020
12
California Privacy Protection Agency. What Is Personal Information
13
U.S. Equal Employment Opportunity Commission. Fact Sheet – Religious Accommodations in the Workplace
14
U.S. Equal Employment Opportunity Commission. EEOCs Final Rule on Employer Wellness Programs and the Genetic Information Nondiscrimination Act
15
Federal Trade Commission. Policy Statement of the Federal Trade Commission on Biometric Information and Section 5 of the Federal Trade Commission Act