Biometrics (Biometric Data)

Biometrics are measurements of your body used to identify you: fingerprints, face scans, hand geometry, voiceprints, and retina or iris scans. They power phone sign-in features, workplace time clocks, photo tagging, and identity checks. Unlike a password, you cannot change your face or fingerprints if the data leaks, which is why lawmakers treat biometric data as especially sensitive.

The strongest U.S. law is the Illinois Biometric Information Privacy Act (BIPA). It requires companies to give written notice, get a written release before collecting biometric identifiers, publish a retention policy, and not sell the data. BIPA lets a person recover $1,000 per negligent violation and $5,000 per intentional or reckless violation, or actual damages if greater, plus attorney's fees. Because people can sue without proving other harm, BIPA has produced many class actions and some of the largest privacy settlements.

Texas and Washington also have biometric laws, but they are enforced by the state rather than through private lawsuits, and a growing number of states cover biometrics in broader privacy laws.

Common claims involve employers using fingerprint time clocks without consent, apps that scan faces in photos, and virtual try-on tools. You generally need to have been in Illinois when your data was collected to join a BIPA case. Read our BIPA explainer, the biometric privacy lawsuit page, and the Snapchat Illinois biometric settlement.