Modern technologies found in sensors, software, and readers make it increasingly possible to use fingerprints, facial recognition, retinal or iris scans, voiceprint reading, gait analysis, or keystroke analysis to identify a person.

In response to these technologies, some state legislatures (Arkansas, California, Illinois, New York, Texas, Washington) have enacted biometric information privacy laws that govern the collection and use of this data.

For example, in Illinois, the Biometric Information Privacy Act (BIPA) provides a set of rules for companies collecting biometric data—and unlike the biometric data privacy statutes in Texas and Washington, it creates a private cause of action, allowing Illinois residents whose biometric data is improperly collected or used to file a lawsuit for the violation of the statute.

There are essentially five key features of the Illinois law known as BIPA:

• it requires informed consent prior to collection;

• it prohibits any profiting from biometric data;

• it allows only a limited right to disclose the data;

• it sets forth both protection obligations and data retention guidelines for businesses; and

• it creates a private cause of action for those harmed by BIPA violations.

In California, the handling of biometric information is governed by the California Consumer Privacy Act (CCPA) and starting January 1, 2023, by the California Privacy Rights Act (CPRA), which enhances the CCPA. These laws provide California residents with the right to know about and control their personal information, including biometric data, that businesses collect. The CCPA and CPRA require businesses to inform consumers before collecting their personal information, give consumers the right to access their data, and the ability to delete it. Businesses are also prohibited from selling personal information without consumer consent, which includes biometric data. Additionally, the CPRA establishes the California Privacy Protection Agency, which is empowered to enforce the law and issue fines for violations. Unlike Illinois' BIPA, California's laws do not create a private cause of action specifically for biometric data violations, but they do allow consumers to sue for certain unauthorized access and exfiltration, theft, or disclosure of personal information due to a business's failure to maintain reasonable security procedures.