Modern technologies found in sensors, software, and readers make it increasingly possible to use fingerprints, facial recognition, retinal or iris scans, voiceprint reading, gait analysis, or keystroke analysis to identify a person.

In response to these technologies, some state legislatures (Arkansas, California, Illinois, New York, Texas, Washington) have enacted biometric information privacy laws that govern the collection and use of this data.

For example, in Illinois, the Biometric Information Privacy Act (BIPA) provides a set of rules for companies collecting biometric data—and unlike the biometric data privacy statutes in Texas and Washington, it creates a private cause of action, allowing Illinois residents whose biometric data is improperly collected or used to file a lawsuit for the violation of the statute.

There are essentially five key features of the Illinois law known as BIPA:

• it requires informed consent prior to collection;

• it prohibits any profiting from biometric data;

• it allows only a limited right to disclose the data;

• it sets forth both protection obligations and data retention guidelines for businesses; and

• it creates a private cause of action for those harmed by BIPA violations.

In Washington State, the collection and use of biometric data are regulated under the Washington Biometric Identifiers Act (RCW 19.375). This law addresses the management of biometric identifiers, which include data from fingerprint, retina, and iris scans, as well as other unique biological patterns. The Act requires that individuals are informed and give consent before their biometric data is collected. It also restricts the sale, lease, or other disclosure of biometric data without explicit consent, except in specific circumstances such as compliance with a law or a warrant. Unlike Illinois' BIPA, Washington's law does not provide a private right of action. Instead, enforcement is primarily through the state attorney general's office, which can take action against businesses that violate the statute. The law also mandates that businesses must have a process in place to safeguard the collected biometric data and to destroy the data once it is no longer needed for the purpose for which it was collected.