What are the rules for biometric data in the United States?
Biometric data is regulated by state law, and Illinois is the sharpest of them: written notice and a written release before collection, with a private right of action for the individual.
The answer differs between the federal level and the states, see the rows below.
The answer by level
Illinois
Illinois requires written notice and a written release before collecting a biometric identifier, and the act gives the individual a private right of action.
740 ILCS 14Texas
Texas requires informed consent before capturing a biometric identifier for a commercial purpose, enforced by the Attorney General.
Tex. Bus. & Com. Code § 503.001Washington
Washington covers biometric data used to identify a health status under the consumer health data act, with consent required before collection and sharing.
RCW 19.373Colorado
Colorado classifies biometric data as sensitive data, which may not be processed without consent.
Colo. Rev. Stat. §§ 6-1-1301 to 6-1-1313
Source lines
- Illinois requires written notice and a written release before a private entity collects a biometric identifier, and gives the individual a private right of action.
- Texas requires informed consent before capture for a commercial purpose, enforced by the Attorney General rather than by private suit.
- Colorado and the later comprehensive state acts treat biometric data as sensitive data that may not be processed without consent.
What it means for the company
Face recognition, fingerprint time clocks and voice prints need consent captured before the first scan, not in an employment handbook signed later.
| Level | Requirement | Source |
|---|---|---|
| Illinois | Illinois requires written notice and a written release before collecting a biometric identifier, and the act gives the individual a private right of action. | 740 ILCS 14 |
| Texas | Texas requires informed consent before capturing a biometric identifier for a commercial purpose, enforced by the Attorney General. | Tex. Bus. & Com. Code § 503.001 |
| Washington | Washington covers biometric data used to identify a health status under the consumer health data act, with consent required before collection and sharing. | RCW 19.373 |
| Colorado | Colorado classifies biometric data as sensitive data, which may not be processed without consent. | Colo. Rev. Stat. §§ 6-1-1301 to 6-1-1313 |
What it means for the individual
In Illinois you may sue on your own behalf, which is why the largest US biometric settlements come from that state.
Source lines
- Illinois Biometric Information Privacy Act740 ILCS 14 · read 2026-08-25 · proof b18cdae02af9594c
- Texas Capture or Use of Biometric Identifier ActTex. Bus. & Com. Code § 503.001 · read 2026-08-25 · proof b18cdae02af9594c
- Washington My Health My Data ActRCW 19.373 · read 2026-08-25 · proof b18cdae02af9594c
- Colorado consumer data privacy actColo. Rev. Stat. §§ 6-1-1301 to 6-1-1313 · read 2026-08-25 · proof b18cdae02af9594c
Next step
Inventory every sensor that produces an identifier, then match each one to the consent record that existed before it was switched on.
This page reports what the sources say, with the identifier and address of the publisher. It is not legal advice and does not decide an individual matter.
Next step
Three ways to put the register to work in your own practice.
Start with your task
Litigation
Find support in a judgment
Search guiding decisions, see what became final and follow changes in the law.
In-house, deals
Map the rules in a transaction
Move from theme to act and on to the article that carries the duty.
Compliance
Assess the risk in a process
Risk scoring per legal area, with the sources behind every score.