Modern technologies found in sensors, software, and readers make it increasingly possible to use fingerprints, facial recognition, retinal or iris scans, voiceprint reading, gait analysis, or keystroke analysis to identify a person.

In response to these technologies, some state legislatures (Arkansas, California, Illinois, New York, Texas, Washington) have enacted biometric information privacy laws that govern the collection and use of this data.

For example, in Illinois, the Biometric Information Privacy Act (BIPA) provides a set of rules for companies collecting biometric data—and unlike the biometric data privacy statutes in Texas and Washington, it creates a private cause of action, allowing Illinois residents whose biometric data is improperly collected or used to file a lawsuit for the violation of the statute.

There are essentially five key features of the Illinois law known as BIPA:

• it requires informed consent prior to collection;

• it prohibits any profiting from biometric data;

• it allows only a limited right to disclose the data;

• it sets forth both protection obligations and data retention guidelines for businesses; and

• it creates a private cause of action for those harmed by BIPA violations.

As of my knowledge cutoff date in early 2023, Florida has not enacted a comprehensive biometric information privacy law similar to the Biometric Information Privacy Act (BIPA) in Illinois. While Florida has laws that address privacy and data security in general, there is no specific statute that governs the collection, use, and storage of biometric data in the same manner as BIPA. This means that in Florida, there are no specific requirements for informed consent prior to the collection of biometric data, no prohibition on profiting from such data, no limited right to disclose the data, and no specific protection obligations or data retention guidelines for businesses regarding biometric information. Additionally, Florida residents do not have a private cause of action under state law specifically for biometric data privacy violations, unlike in Illinois. However, it is important for businesses operating in Florida to be aware of federal laws and any applicable sector-specific regulations that may impact the use of biometric data, as well as to monitor for any changes in state legislation regarding biometric privacy.