Modern technologies found in sensors, software, and readers make it increasingly possible to use fingerprints, facial recognition, retinal or iris scans, voiceprint reading, gait analysis, or keystroke analysis to identify a person.

In response to these technologies, some state legislatures (Arkansas, California, Illinois, New York, Texas, Washington) have enacted biometric information privacy laws that govern the collection and use of this data.

For example, in Illinois, the Biometric Information Privacy Act (BIPA) provides a set of rules for companies collecting biometric data—and unlike the biometric data privacy statutes in Texas and Washington, it creates a private cause of action, allowing Illinois residents whose biometric data is improperly collected or used to file a lawsuit for the violation of the statute.

There are essentially five key features of the Illinois law known as BIPA:

• it requires informed consent prior to collection;

• it prohibits any profiting from biometric data;

• it allows only a limited right to disclose the data;

• it sets forth both protection obligations and data retention guidelines for businesses; and

• it creates a private cause of action for those harmed by BIPA violations.

As of my knowledge cutoff date in 2023, Indiana has not enacted specific biometric information privacy laws comparable to the Biometric Information Privacy Act (BIPA) in Illinois. Unlike states such as Illinois, Texas, and Washington, which have specific statutes governing the collection, use, and protection of biometric data, Indiana relies on more general privacy laws and regulations that may apply to biometric information. Companies operating in Indiana should be aware of federal privacy laws and any sector-specific regulations that might impact how they handle biometric data. Additionally, they should monitor for any changes in state law, as the legislative landscape regarding biometric data is evolving across the United States. Individuals in Indiana concerned about the use of their biometric data would need to rely on these broader privacy protections, as there is no state statute providing a private cause of action specifically for biometric data privacy violations as in Illinois.