Face Recognition Compliance for U.S. Businesses: BIPA and State Privacy Laws

What Is Facial Recognition Compliance?

Facial recognition compliance means ensuring that a business's use of facial recognition technology follows applicable privacy laws, data protection requirements, and relevant organizational policies.

Facial recognition systems generally analyze facial characteristics to verify or identify individuals. Depending on the system, the process may involve capturing an image, generating a mathematical representation of facial features, and comparing that representation with stored data.

Not every photograph or camera recording is automatically biometric information under every law. The legal treatment depends on factors such as whether facial characteristics are converted into biometric data, whether the data is used to identify a person, and the specific statutory definitions and exceptions.

Businesses may use facial recognition in several situations:

• Employee attendance: Verifying employee identities for timekeeping.
• Building access: Allowing authorized individuals to enter restricted areas.
• Customer authentication: Confirming identity during account access or transactions.
• Fraud prevention: Helping detect suspicious identity-related activity.
• Security monitoring: Identifying individuals in particular security environments.

Each use case can create different privacy and compliance considerations. An organization should assess the technology and its intended use before implementation rather than assuming that every application follows the same rules.

What information does BIPA cover?

Under BIPA, biometric identifiers include scans of hand or face geometry, fingerprints, retina scans, iris scans, and voiceprints. Biometric information generally refers to information based on a biometric identifier that is used to identify an individual, subject to the law's definitions and exclusions.

Ordinary photographs are excluded from the statutory definition of biometric identifiers. However, businesses should not assume that a facial recognition system is outside BIPA simply because it begins with a photograph. The way the system processes and uses facial information matters.

What does BIPA require businesses to do?

BIPA establishes several important obligations for covered private entities.

Provide written notice and obtain written consent

Before collecting or otherwise obtaining covered biometric identifiers or information, a business must provide written notice that the data is being collected or stored, explain the specific purpose and duration of collection, storage, and use, and obtain a written release from the individual or their legally authorized representative.

Publish a retention and destruction policy

Businesses must develop a publicly available written policy describing their retention schedule and guidelines for permanently destroying covered biometric data. The statute generally requires destruction when the initial purpose has been satisfied or within three years of the individual's last interaction with the entity, whichever occurs first, subject to applicable legal exceptions.

Protect biometric information

Covered entities must use reasonable industry-standard care and protect biometric information at least as carefully as other confidential and sensitive information.

Restrict disclosure and commercial use

BIPA restricts selling, leasing, trading, or otherwise profiting from biometric identifiers and information. It also limits disclosure and redistribution, subject to specified exceptions.

Understand potential legal exposure

BIPA provides a private right of action for individuals alleging violations, along with statutory damages and other possible remedies under the law. Businesses should therefore treat compliance as an ongoing responsibility rather than a one-time consent form.

These requirements are set out in the Illinois statute, particularly Sections 10, 15, and 20. Businesses should review the current statutory text and obtain legal guidance when applying it to a specific system or workflow.

Illinois: Biometric Information Privacy Act

Illinois BIPA is a major consideration for private businesses collecting covered biometric data. Its requirements include written notice, written release, retention and destruction policies, security safeguards, and restrictions on disclosure and commercial use.

Businesses should pay particular attention to employee timekeeping systems, access control tools, and customer-facing applications that use facial geometry or other covered biometric information.

Texas: Capture or Use of Biometric Identifier Act

Texas regulates the capture and use of biometric identifiers for commercial purposes under Chapter 503 of the Texas Business and Commerce Code.

The law generally requires businesses to inform individuals before capturing covered biometric identifiers and obtain consent. It also addresses disclosure restrictions, reasonable protection of the information, and destruction requirements.

Texas law includes exceptions and specific enforcement provisions, so organizations should assess their particular circumstances rather than relying on a general checklist alone.

Washington: Biometric Identifiers

Washington's biometric identifier law, under RCW 19.375, regulates the collection and use of biometric identifiers in specified circumstances. It addresses notice and consent requirements, restrictions on certain disclosures, reasonable care in protecting biometric identifiers, and retention and destruction obligations.

The law includes definitions, exclusions, and exceptions that can affect how a particular facial recognition system is treated.

Colorado: Consumer Privacy and Sensitive Data

Colorado's Privacy Act treats biometric data used or intended to identify a specific individual as sensitive data within its statutory framework.

Depending on the circumstances, businesses subject to the law may need to meet requirements concerning sensitive-data consent, transparency, data protection assessments, and consumer rights. Colorado's broader privacy framework differs from BIPA and should not be treated as interchangeable with it.

Other states and local requirements

Additional states have enacted biometric privacy laws or broader privacy laws that can affect the collection and use of facial recognition data. Requirements may differ in scope, exemptions, enforcement, consent, and retention.

For example, some state laws focus on biometric identifiers, while others address sensitive personal data more broadly. Local ordinances and employment-related rules may also be relevant in particular locations.

Businesses operating across state lines should maintain a current legal inventory rather than relying on a static list of laws. The applicable rules can depend on the individual's location, the business's activities, the technology involved, and the purpose of processing.

Notice and Consent

Businesses should clearly explain when facial recognition is used, what information is collected, why it is needed, and how long it will be retained.

Where a law requires consent, the business should obtain it in the form and before the activity required by that law. A general privacy policy may not be sufficient.

For example, a company using facial recognition for employee attendance should evaluate the applicable employment and biometric privacy rules before activating the system.

Data Collection and Purpose Limitation

Organizations should collect only the information needed for the stated purpose and avoid reusing it for unrelated activities without evaluating the applicable legal requirements.

A facial recognition system deployed for building access should not automatically be repurposed for employee productivity monitoring or customer profiling.

Clear purpose definitions also help teams determine which information must be retained and when it should be deleted.

Data Retention and Deletion

Biometric data should not be kept indefinitely simply because storage is inexpensive.

Businesses should document retention periods, assign responsibility for deletion, and establish procedures for removing information when the applicable purpose ends or a legal retention requirement is met.

Retention schedules should account for the relevant state law, contractual obligations, and any applicable legal holds.

Security and Access Controls

Facial recognition data can create significant privacy risks if exposed or misused. Businesses should apply appropriate technical and organizational safeguards.

Useful measures include:

• Encryption for data at rest and in transit.
• Role-based access controls.
• Multi-factor authentication for administrative access.
• Audit logs for sensitive data access and changes.
• Vendor security assessments.
• Incident response and recovery procedures.

Organizations should also evaluate whether biometric templates can be stored and processed in ways that reduce exposure, and whether the system provider's security practices meet their requirements.

Vendor and Third-Party Management

Businesses often rely on third-party providers for cameras, identity verification, attendance systems,cloud storage, and facial recognition software.

Before adopting a vendor, organizations should understand what data the system collects, where it is stored, how it is used, whether it is shared with other parties, and how it is deleted.

Contracts should address data use restrictions, security responsibilities, incident notification, retention, deletion, and assistance with legal compliance where appropriate.

A vendor's claim that a product is compliant does not automatically establish that every business deployment meets the law.

Transparency and Accountability

Businesses should maintain records showing why facial recognition is being used and how compliance decisions are made.

Depending on the legal framework and risk, this may include a system inventory, privacy assessment, documented consent process, data-flow diagram, retention schedule, vendor review, and incident response plan.

A clear record helps teams respond to questions from employees, customers, auditors, and regulators.

Step 1: Identify Every Facial Recognition Use Case

Create an inventory of systems that capture, analyze, or compare facial information. Include employee attendance tools, access control systems, customer authentication services, and security applications.

Ask vendors and internal teams whether the systems generate biometric templates or other information used to identify individuals.

Step 2: Map Applicable Laws

Identify the states and locations relevant to the business, the people whose information is processed, and the purpose of each system.

Compare the system's operation with the definitions, obligations, exemptions, and enforcement mechanisms of the relevant laws.

Because legal requirements change, have qualified counsel validate the analysis before deployment and when material changes occur.

Step 3: Review Data Collection and Consent

Determine whether the system requires written notice, express consent, or another specific form of authorization.

Check that the notice accurately describes the actual purpose, retention period, storage arrangements, and use of the information. Ensure the consent process occurs at the required time.

Step 4: Assess Security and Retention

Document where biometric data is stored, who can access it, how it is protected, and when it will be destroyed.

Test whether deletion procedures work across relevant applications, backups, and vendor environments, taking account of lawful retention requirements and technical limitations.

Step 5: Review Vendors and Integrations

Assess vendor contracts, system integrations, access permissions, data transfers, and third-party use.

Confirm that each provider's actual practices align with the business's legal obligations and privacy commitments.

Step 6: Train Employees and Review the System

Provide appropriate training to HR, IT, security, and operations teams. Explain how consent is collected, how questions are handled, and how privacy incidents should be reported.

Review the system periodically and reassess it when the technology, purpose, vendor, or applicable law changes.

Assuming a Photograph Is Always Exempt

A photograph and a biometric template are not necessarily treated the same way. Businesses should understand how their technology processes facial information and how the relevant law defines covered data.

Using a Generic Consent Form

A generic privacy notice may not satisfy a law that requires specific written disclosures and a written release. Consent materials should reflect the actual system and applicable requirements.

Keeping Biometric Data Indefinitely

Without a documented retention schedule and reliable deletion process, businesses may retain data longer than permitted or necessary.

Overlooking Vendor Responsibilities

Outsourcing facial recognition does not necessarily remove the business's own obligations. Organizations should examine vendor practices and contractual responsibilities before deployment.

Applying One State's Rules Nationwide Without Review

A policy designed around BIPA may not satisfy the requirements of another state. Conversely, a general privacy policy may not address BIPA's specific requirements.

A common internal standard can help simplify operations, but legal teams should validate whether it adequately addresses every applicable law.

Treating Compliance as a One-Time Task

A facial recognition system may change through software updates, new integrations, additional data uses, or changes in law. Compliance reviews should continue throughout the system's lifecycle.

Automated Data Inventory

Data discovery tools can help identify systems that store or transmit biometric information, making it easier to document data flows and locate relevant applications.

Consent and Policy Management

Workflow automation can help record consent events, associate them with the relevant use case, and alert teams when documentation needs review.

The workflow must still be designed to meet the specific requirements of the applicable law.

Retention and Deletion Workflows

Automated controls can flag data approaching its deletion date and initiate approved deletion procedures. Organizations should maintain logs and verify that the process works across connected systems.

Security Monitoring

Monitoring tools can identify unusual access patterns, configuration changes, and potential security incidents involving sensitive information.

Alerts should be routed to trained personnel who can investigate and respond.

Compliance Reporting

Centralized records can help privacy and security teams review policies, system inventories, vendor assessments, access logs, and retention activities.

For businesses modernizing their privacy and security processes, a well-governed data security strategy can help connect access controls, monitoring, and data protection practices.

AI tools can assist with documentation and analysis, but they cannot independently guarantee legal compliance. Organizations remain responsible for validating outputs, making appropriate decisions, and obtaining legal advice when needed.