A single face-match login, fingerprint time clock or voice verification flow can fall under a dozen biometric privacy regimes at once, and they disagree on consent, retention, who can sue and what is banned outright. Illinois lets individuals sue for liquidated damages, Colorado imposes deletion deadlines on any business that touches a biometric identifier, the EU treats biometric identification as special category data and its AI Act prohibits some biometric uses entirely, and Quebec and Australia require organisations to prove necessity before consent even matters. This map lays the main regimes side by side, then explains how to build one biometric programme that satisfies the strictest of them. It goes beyond the three US states covered in the Illinois BIPA and Biometric Privacy Guide and does not repeat its section-by-section analysis. It is for privacy counsel, identity architects, HR technology owners and product teams deploying biometrics. Status as of 11 November 2026.
Sources: each row is attributed to the official text or regulator guidance we could read (Colorado General Assembly, AI Act Service Desk, ICO, OAIC, Quebec CAI, FTC, EUR-Lex), to the DigiChina translation for China's PIPL, and to our Illinois BIPA guide sources for Illinois, Texas and Washington. GDPR article wording and fine levels are summarised from the Regulation itself. Confirm against the official text before relying on it.
Key takeaways
- Identification purpose is what triggers most laws. The GDPR, UK GDPR, the Australian Privacy Act and Colorado all treat a photo or voice recording as biometric data only when it is processed to identify or verify a person, so the same camera can be in or out of scope depending on what the software computes.
- Consent is necessary but often not sufficient. Quebec's regulator says consent cannot replace necessity, the Australian regulator says convenience does not justify collection, and the UK ICO expects a non-biometric alternative for people who refuse.
- Retention deadlines are now statutory in several places. Illinois sets three years after the last interaction, Texas one year after the purpose expires, and Colorado the earliest of purpose fulfilment, 24 months after the last interaction or 45 days after the data is no longer needed.
- Some biometric uses are banned, not regulated. Since 2 February 2025 the EU AI Act prohibits untargeted scraping of facial images, emotion recognition in workplaces and education (with medical and safety exceptions) and biometric categorisation that infers sensitive traits.
- Machine access is the leak path. Templates are read by pipelines, verification vendors and backup jobs through API keys and service accounts; every one of those credentials is a disclosure path a regulator or plaintiff will ask about.
Regulations and frameworks at a glance
| Jurisdiction and law | When biometrics are covered | Core requirement | Enforcement | Status (11 November 2026) |
|---|---|---|---|---|
| EU GDPR, Articles 4(14) and 9 | Biometric data processed for the purpose of uniquely identifying a person | Prohibited unless an Article 9(2) condition applies (usually explicit consent); DPIA expected; member states may add conditions (Article 9(4)) | Data protection authorities; fines up to EUR 20 million or 4% of worldwide turnover | In force |
| EU AI Act, Article 5 and Annex III | AI systems using biometric data | Bans on facial image scraping, workplace and education emotion recognition, sensitive-trait categorisation and (with narrow exceptions) real-time remote biometric identification by police; remote biometric identification and other biometric systems listed as high-risk | Market surveillance authorities | Prohibitions apply since 2 February 2025; Annex III high-risk rules from 2 December 2027 after the Digital Omnibus |
| UK GDPR and Data Protection Act 2018 | Special category biometric data used for unique identification | Lawful basis plus an Article 9 condition; explicit consent usually most appropriate; alternative for those who refuse; DPIA | ICO | In force; ICO guidance under review after the Data (Use and Access) Act 2025 |
| Illinois BIPA, 740 ILCS 14 | Any collection or possession of biometric identifiers by a private entity | Public retention policy, written notice and written release, no profiting, strict disclosure limits | Private right of action: $1,000 negligent, $5,000 intentional or reckless, per person per violation type since 2024 | In force |
| Texas Bus. and Com. Code 503.001 | Capture for a commercial purpose | Inform and obtain consent; destroy within one year after the purpose expires | Attorney General, up to $25,000 per violation | In force |
| Washington RCW 19.375 | Enrolment in a database for a commercial purpose | Notice and consent or a mechanism to prevent commercial use | Attorney General under the Consumer Protection Act | In force |
| Colorado Privacy Act as amended by HB24-1130 | Any controller that processes any amount of biometric identifiers, regardless of the general CPA thresholds | Consent before collection; written retention and incident policy; deletion deadlines; no sale, lease or trade; limits on employer-required consent | Under the Colorado Privacy Act | Effective 1 July 2025 |
| California CCPA/CPRA and other US comprehensive state laws | Biometric information processed to identify a consumer is sensitive personal information | Notice; right to limit use of sensitive personal information (California); opt-in consent for sensitive data in most other state laws | State regulators and attorneys general | In force (varies by state) |
| US FTC Act Section 5 | Biometric information used by businesses | Policy statement of 18 May 2023 on unfair or deceptive biometric practices | FTC | Policy statement in force |
| China PIPL, Articles 26, 28, 29 and 55 | Biometric characteristics are sensitive personal information | Separate consent; impact assessment in advance; public-place recognition equipment only for public security, with signs | Up to CNY 50 million or 5% of prior-year revenue for serious violations | In force since 1 November 2021 |
| Quebec Act to establish a legal framework for information technology, ss. 43 to 45 | Biometrics used to verify or confirm identity | Necessity, express consent, minimum characteristics, alternative method; disclose use to the CAI; disclose a biometric database at least 60 days before it goes into service | Commission d'accès à l'information (CAI) | In force |
| Australia Privacy Act 1988, APP 3 | Biometric information and templates used for automated verification or identification are sensitive information | Reasonably necessary plus consent, or a narrow exception; signage alone generally insufficient | OAIC; tribunal review | In force; Kmart determination (August 2025) under review; Bunnings tribunal decision 4 February 2026 |
For a law-by-law treatment of Illinois, Texas and Washington, including Section 15 duties and the 2024 BIPA damages amendment, see the Illinois BIPA and Biometric Privacy Guide. For comprehensive state laws, see the US State Privacy Laws Guide.
Scope: who and what is covered
Three questions decide whether a deployment is in scope, and the answers differ by regime.
| Question | Broad answer (more in scope) | Narrow answer (less in scope) |
|---|---|---|
| Does the data have to be used for identification? | Illinois BIPA covers collection or possession of identifiers whatever the purpose | GDPR special category status, Colorado and Australia require use to identify or verify; photos and audio excluded otherwise |
| Is there a size or revenue threshold? | Colorado's biometric provisions apply to any controller handling any amount; BIPA and Texas have none | Most US comprehensive laws apply only above consumer volume or revenue thresholds |
| Who is protected? | Employees and consumers alike (BIPA, Colorado, GDPR, Quebec) | Some state comprehensive laws exclude employee and business-to-business data |
| Who can enforce? | Individuals (Illinois) | Regulators only (Texas, Washington, Colorado, EU and UK authorities) |
On-device matching changes the analysis. Platform authenticators used with passkeys keep the template on the user's device and send only a signed assertion; the relying party never possesses biometric data. Server-side face match for onboarding or time-and-attendance does possess it. Prefer the first where it meets the requirement. See the Biometrics Guide.
Key obligations
Consent and necessity
- Written or express consent: Illinois requires a written release before collection; Quebec expects express consent that is free, informed, specific and time-limited, with writing the best evidence; China requires separate consent for sensitive personal information.
- Necessity first: the CAI states that consent cannot suffice on its own and the organisation must document a concrete problem; the OAIC says convenience, affordability or desirability do not establish reasonable necessity.
- Employees: the ICO and CAI both question whether employee consent is freely given. Colorado lets employers require consent only for listed purposes such as secure access, recording work hours and safety, bars retaliation for refusal, and excludes location tracking. See the Employee Monitoring and Privacy Guide.
- Alternatives: the ICO and CAI expect a non-biometric route for people who refuse or withdraw.
Retention and deletion
| Regime | Deadline |
|---|---|
| Illinois BIPA | When the purpose is satisfied or three years after the last interaction, whichever is first |
| Texas | Reasonable time, no later than one year after the purpose expires |
| Colorado | Earliest of purpose satisfied, 24 months after the last interaction, or no more than 45 days after determining the data is no longer needed (extendable once by 45 days); review at least annually |
| GDPR, UK GDPR, Quebec, Australia | No fixed period; storage limitation and destruction once the purpose is achieved |
Assessments, disclosure and security
- Impact assessments: GDPR Recital 91 names biometric data among the processing that requires a DPIA; PIPL Article 55 requires an assessment in advance for sensitive information; the OAIC and CAI recommend one before deployment. See the DPIA Guide.
- Regulator notice: Quebec requires disclosure of biometric verification to the CAI and of a biometric database 60 days before it goes live, the only advance filing in this map.
- No sale: Illinois and Colorado prohibit selling, leasing or trading biometric identifiers.
- Incident protocol: Colorado requires a written protocol for security incidents affecting biometric data and requires processors to notify the controller.
Timeline and current status
- 1 November 2021: China PIPL takes effect.
- 18 May 2023: FTC policy statement on biometric information under Section 5.
- 2024: Illinois amends BIPA so repeated collection or disclosure of the same identifier counts as one violation per person.
- 2 February 2025: EU AI Act prohibitions, including the biometric bans, apply.
- 19 June 2025: the UK Data (Use and Access) Act becomes law; the ICO biometric guidance is under review.
- 1 July 2025: Colorado HB24-1130 biometric provisions take effect.
- August 2025 and 4 February 2026: Australian retail facial recognition decisions (Kmart determination, Bunnings tribunal decision) set the boundary between consent and the permitted general situations.
- 2 December 2027: EU AI Act Annex III high-risk obligations, including biometric systems, apply under the amended timeline. Dates set by the Digital Omnibus may move again; check the Commission's AI Act Service Desk.
Enforcement and penalties
- Private litigation (Illinois): class size times $1,000 or $5,000 per violation type. Litigation exposure, not regulators, drives most US biometric compliance spending.
- Regulator fines (EU, UK, China): GDPR fines up to EUR 20 million or 4% of worldwide turnover; PIPL up to CNY 50 million or 5% of the previous year's revenue, plus suspension and personal fines on responsible managers.
- Orders to stop and delete: regulators can order deletion of unlawfully collected templates, and data protection authorities can order processing to stop, which can cost more than a fine.
- Attorney General actions (Texas, Washington, Colorado): per-violation civil penalties under each state's statute or consumer protection law.
Biometric data cannot be reissued after a breach. The Global Privacy Regulatory Map covers general breach and privacy obligations that apply alongside these rules.
What it means for AI agents and non-human identities
- Vendor integrations are disclosures: every API key or service account that sends face images, fingerprints or voice to a verification or speech provider is a disclosure under BIPA and Colorado and a processor relationship under GDPR. Inventory those credentials, give each an owner and map each to the consent that covers it.
- AI voice and video agents can create biometrics: speaker identification, face matching or emotion inference by an agent is biometric processing; emotion inference at work is banned in the EU.
- Training on templates: vendors that reuse your users' templates to improve their models risk breaching sale and purpose limits; contracts should prohibit it and require deletion on termination.
- Least privilege for template stores: pipelines, analytics jobs and backups that read templates should use scoped, short-lived credentials with every read logged. See the Deepfake-Resistant Identity Verification Guide for liveness checks, which are biometric collection too.
Compliance steps
Choosing the design target
Single US state workforce use: design to Illinois and Colorado rules even if you are not there yet, because both apply with no size threshold. Global consumer product: design to GDPR explicit consent plus a necessity record that would satisfy Quebec and Australia, and check the AI Act bans before any emotion or categorisation feature. Small organisations should first ask whether a non-biometric control (badge, PIN, passkey with on-device biometrics) meets the need, which removes most obligations. Large organisations need a central biometric register because business units buy time clocks, ID verification and voice analytics separately.
- Find every touchpoint: time clocks, door readers, identity verification SDKs, call centre voice systems, CCTV analytics and contractor-run systems.
- Classify each: what is computed (template or not), where matching happens (device or server), purpose, and the jurisdictions of data subjects.
- Record necessity: the problem solved and the less intrusive options considered, in a DPIA.
- Implement consent and alternatives: written or express consent captured and stored with version and timestamp; a non-biometric path tested end to end.
- Set retention by the strictest rule: automate deletion against the Colorado and Illinois deadlines, including vendor copies and backups.
- File where required: Quebec CAI disclosures before go-live.
- Pilot and roll back: pilot with volunteers, verify deletion jobs on test identities, and keep the ability to switch the flow to the non-biometric path without data loss.
Detection and measurement
- Consent coverage: share of enrolled templates with a stored, valid consent record (target 100%).
- Deletion latency: days between deletion trigger and confirmed deletion, including at processors.
- Template access: reads of template stores by identity, with alerts on new service accounts or unusual volumes.
- Alternative usage: share of people using the non-biometric path, which shows the choice is real.
- Register completeness: biometric systems found by procurement or network discovery that were not in the register.
Framework mapping
| Framework | Reference | How it relates |
|---|---|---|
| NIST SP 800-53 Rev 5 | PT-2, PT-3 | Authority to process PII; processing purposes |
| NIST CSF 2.0 | GV.OC-03, PR.DS-01 | Legal requirements understood and managed; data at rest protected |
| ISO/IEC 27001:2022 | Annex A 5.34 | Privacy and protection of PII |
| ISO/IEC 27701 | PII controller and processor controls | Privacy information management extension |
Common failure patterns
- Vendor holds templates you forgot: deletion runs in your systems but not at the time-clock or verification provider.
- Consent without necessity: a signed form, but no record of why a badge or PIN would not do.
- Employee consent as a condition of hire for any purpose: allowed in Colorado only for listed purposes.
- Feature creep: a verification system later used for attendance analytics or emotion scoring, outside the consented purpose.
- Shared credentials to template stores: one long-lived key used by several jobs, so access cannot be attributed.
Practitioner checklist
- Keep a biometric register covering every system, vendor and jurisdiction.
- Record for each system whether matching is on-device or server-side.
- Complete a DPIA with a necessity record before deployment.
- Capture written or express consent and offer a tested non-biometric alternative.
- Automate deletion to the strictest applicable deadline, including processors.
- Check AI features against the EU AI Act prohibitions before release.
- File Quebec CAI disclosures before go-live where Quebec residents are enrolled.
- Scope, own and log every machine credential that can read templates.
- Re-check status twice a year (UK guidance review, AI Act dates, new US state laws).
Standards and references
- European Commission AI Act Service Desk: Article 5 Prohibited AI practices
- ICO: How do we process biometric data lawfully?
- Colorado General Assembly: HB24-1130 Privacy of Biometric Identifiers and Data (signed act)
- Illinois General Assembly: 740 ILCS 14/15 Retention, collection, disclosure and destruction
- Commission d'accès à l'information du Québec: Biométrie
- OAIC: Facial recognition technology, a guide to assessing the privacy risks
- DigiChina, Stanford: Translation of the Personal Information Protection Law of the PRC
- FTC: Policy Statement on Biometric Information and Section 5 of the FTC Act
Related NHI Mgmt Group resources: Illinois BIPA and Biometric Privacy Guide · Biometrics Guide · Global Privacy Regulatory Map · Biometric Liveness and Presentation Attack Detection Guide · EU AI Act Compliance Guide. This guide summarises biometric privacy laws in selected jurisdictions and is not legal advice.