Biometric Privacy

Biometric privacy is the legal and operational practice of protecting biometric identifiers — face geometry, fingerprints, voiceprints, iris scans — collected from customers or employees. In the United States, biometric privacy is governed by a patchwork of state laws rather than a single federal statute. The most-cited regimes are Illinois (BIPA, 740 ILCS 14 — generally regarded as the strictest, and the only one with a private right of action), Texas (CUBI, Tex. Bus. & Com. Code § 503.001), and Washington (RCW 19.375); newer state privacy laws (California, Colorado, Connecticut, Virginia, and others) treat biometrics as sensitive personal data with heightened consent rules.

How it works

Compliant programs typically require: written notice that biometrics are being collected, written consent before collection, a published retention and destruction schedule, and a prohibition on selling biometric data. Some states also require a security standard appropriate to the data's sensitivity.

Operators who deploy face-based age estimation, voice-controlled kiosks, or fingerprint-based employee timeclocks need to map their data flows against each applicable state's rules. "Biometric template" handling is usually treated more strictly than handling of raw images.

Why it matters for independent retailers

Indie retailers experimenting with face-based age estimation, voice ordering, or fingerprint timeclocks can incur six- and seven-figure liability under state biometric statutes if they skip the notice-and-consent step. The same statutes generally allow private rights of action, meaning customers and employees can sue directly.

The safe path is to default to non-biometric flows where possible (ID-scan age verification rather than face-based) and only enable biometric features after legal review and a documented consent flow. None of this is unique advice — it's how the entire industry approaches the topic. This is general guidance, not legal advice; consult counsel for the jurisdictions where you operate.

Related terms

• BIPA Compliance — Illinois-specific framework
• CCPA Retail — California privacy regime that touches biometrics
• Age Verification — common biometric use case
• Retail PCI Compliance — adjacent compliance domain

See also

• Remi product page — Remi defaults to non-biometric flows
• Liquor Stores — frequent biometric-use context