Modern technologies found in sensors, software, and readers make it increasingly possible to use fingerprints, facial recognition, retinal or iris scans, voiceprint reading, gait analysis, or keystroke analysis to identify a person.

In response to these technologies, some state legislatures (Arkansas, California, Illinois, New York, Texas, Washington) have enacted biometric information privacy laws that govern the collection and use of this data.

For example, in Illinois, the Biometric Information Privacy Act (BIPA) provides a set of rules for companies collecting biometric data—and unlike the biometric data privacy statutes in Texas and Washington, it creates a private cause of action, allowing Illinois residents whose biometric data is improperly collected or used to file a lawsuit for the violation of the statute.

There are essentially five key features of the Illinois law known as BIPA:

• it requires informed consent prior to collection;

• it prohibits any profiting from biometric data;

• it allows only a limited right to disclose the data;

• it sets forth both protection obligations and data retention guidelines for businesses; and

• it creates a private cause of action for those harmed by BIPA violations.

In New York, the use of biometric information is regulated under the New York State SHIELD Act (Stop Hacks and Improve Electronic Data Security Act) and the New York City Biometric Identifier Information Law. While New York does not have a comprehensive biometric privacy law like Illinois' BIPA, these laws provide certain protections. The SHIELD Act requires businesses to implement reasonable safeguards to protect the security of private information, which may include biometric data. The New York City law, which took effect in July 2021, requires commercial establishments to post clear signage if they collect biometric identifier information from customers and prohibits them from selling this data. Violations of the New York City law can lead to penalties. However, unlike Illinois' BIPA, New York's regulations do not provide a private right of action for individuals to sue for statutory damages if their biometric data is mishandled. Instead, enforcement is typically handled by the state attorney general or city agencies.