Biometric Consent: What It Means and When It's Required

Your face, fingerprint, and voice are not passwords you can reset. Once a company captures them, the data is tied to you for life. That is why biometric consent matters, and why you should know exactly what you are agreeing to when an employer, app, or retailer asks to scan you.

Here is the short answer. Biometric consent is your informed, voluntary permission for an organization to collect, store, and use data drawn from your body, such as a face template, fingerprint, or voiceprint. Under laws like the GDPR and Illinois' BIPA, that permission usually has to be written, specific, and given before collection starts. In many cases, you can say no without being punished for it.

This article explains what valid consent requires, when employers and other organizations must get it, and what a proper notice or consent form should include. We also cover your right to refuse or withdraw. At the Human Authenticity Registry, we build around consent-first identity, so we treat these questions as the baseline, not a footnote.

Why biometric consent matters

Your body cannot be reset

A leaked password costs you an afternoon. You change it and move on. A leaked face template or fingerprint cannot be changed, so biometric data is permanent by nature. A stored template can also be used to impersonate you, and AI tools can now clone a voice from a few seconds of audio. Once the data leaves your control, you cannot recall it.

Think about how routine the requests have become. Your employer wants a fingerprint for the time clock. A gym scans your face at the door. A banking app asks for a voiceprint. Each request looks small, but together they put a map of your body in the hands of companies you may never hear from again.

What consent actually changes

So what does biometric consent mean in practice? It means an organization cannot simply take the data. It must tell you what it collects, why, and for how long, then wait for your clear yes. That is the heart of any biometric consent definition: information first, permission second, collection last. Without that order, a scan is surveillance, not service.

Biometric consent turns a scan you never chose into a decision you actually made.

Valid biometric data consent also has to be specific. A single checkbox buried in a handbook does not cover everything. Consent to use biometric data should address each of these separately:

• Collection: what is captured, such as a face geometry template or a voiceprint

• Purpose: the exact use, such as door access or fraud checks

• Sharing: which vendors or affiliates receive the data

• Retention: when the data is destroyed

This is also why regulators treat it as a special category. Under the GDPR, an organization needs a lawful basis to handle sensitive data, and for biometrics that is often explicit consent to process biometric data and sensitive data together.

What goes wrong without it

Enforcement is real, and it is expensive. Illinois lets individuals sue directly, which is why BIPA cases produce the largest numbers. Other laws rely on regulators, but the exposure is still serious.

Meta paid $650 million to settle a BIPA class action over face tagging in 2021. In 2024 it agreed to pay Texas $1.4 billion over the same kind of conduct. Those cases started with missing or inadequate consent.

Money is only part of the damage. Employees who feel scanned without a say lose trust in their employer, and customers walk away from brands that treat their faces as free inventory. If you are the person being scanned, the same logic works in your favor: a company that cannot show you clear consent has not earned your data. Ask for the notice before you hand anything over.

How to get biometric consent that holds up

Getting biometric consent right is a process, not a checkbox. If you run HR, build an app, or manage a venue, the steps below hold up under BIPA, the GDPR, and most other regimes. Sequence matters more than clever wording, and proof matters as much as permission. This is general guidance, so have counsel review your final forms.

Give notice before you collect anything

Notice comes first. Tell people in plain language what you will capture, why, who will see it, and when you will delete it. Deliver the notice before the scan, not during onboarding week two. Illinois requires a written notice and a public retention schedule, so a verbal explanation at the door will not protect you. Keep the language short enough that a new hire can read it in two minutes.

Make the choice a real one

Consent only counts when it is freely given. Do not bundle it into an employment contract or a blanket terms-of-service click. Offer a non-biometric alternative, such as a PIN or badge for the time clock, so declining carries no penalty. European regulators doubt that employees can freely consent to an employer, so many organizations there rely on a different lawful basis or skip biometrics for staff altogether.

A yes means nothing if a no costs the person their job.

The same rule applies to customers. If a store refuses entry to anyone who will not be scanned, you have a condition, not consent.

Record it and keep it current

Finally, keep evidence. A consent you cannot prove is one a regulator or court will treat as missing. Store the signed or clearly affirmative electronic record with a timestamp and the version of the notice the person saw. Then revisit it when anything changes. New purposes, vendors, or retention periods need fresh permission, because the old yes covered the old terms only.

Use this checklist when you build your process:

1. Present the written notice before any capture.

2. Collect an affirmative, separate opt-in for biometrics.

3. Offer an alternative that carries no penalty.

4. Log the date, notice version, and signer.

5. Re-ask when purpose, vendor, or retention changes.

6. Honor withdrawal and delete data on the stated schedule.

When consent is legally required in the US

The United States has no single federal biometric consent law. Instead, you get a patchwork of state rules, so the answer depends on where the person being scanned lives, works, or shops. Some states write rules just for biometrics. Others fold biometrics into broader privacy statutes.

States with dedicated biometric laws

Three states regulate biometrics directly. Illinois is the strictest, because it requires a written release and lets individuals sue. Texas and Washington require notice and consent too, but only their attorneys general can enforce.

Illinois amended BIPA in 2024. Damages now count per person, not per scan, and an electronic signature satisfies the written release. Employers are covered, which is why fingerprint time clocks have drawn so many lawsuits.

Broader privacy laws and local rules

Comprehensive state privacy laws in Colorado, Connecticut, and Virginia classify biometric data as sensitive data. They require opt-in consent before a company processes it. Colorado's biometric amendment took effect July 1, 2025, and it extends to employees, so employers need a written policy and consent there. California takes a different route. Businesses must give notice and let you limit how they use sensitive information. New York City adds its own rule: many commercial businesses must post a sign if they collect customers' biometric data.

So who needs consent in practice? Almost anyone who captures a face, fingerprint, or voiceprint from a resident of these states, whether the person is an employee, a customer, or a visitor. Exemptions exist, but they are narrow and change often.

When state laws differ, the strictest standard is the safest one to follow.

If you operate in more than one state, build one process to the Illinois standard. Written notice, a separate opt-in, and a published retention schedule will satisfy most of the other rules too. If you are the person being scanned, look up your own state first, then ask the organization which law it relies on.

Biometric consent under GDPR and other regimes

The GDPR sets the highest bar outside Illinois. Here is how it works, and how other regimes compare.

How the GDPR handles biometric data

Under Article 9 of the GDPR, biometric data is a special category when it is used to identify a person uniquely. Processing is banned by default. An organization needs a narrow exception, and the one you will meet most often is explicit consent. That is the biometric consent meaning in Europe: a clear, affirmative statement from you, not silence or a pre-ticked box.

Under the GDPR, a biometric scan is banned by default, and explicit consent is one of the few exceptions that allows it.

Consent must also be freely given, specific, informed, and unambiguous under Article 7. Not every photo counts. A snapshot in an HR file is ordinary data until software turns it into a template that identifies you. A face-recognition door lock crosses that line.

Employment is the tricky case. Regulators doubt that employees can freely consent to a boss, because refusing may feel risky. Some organizations lean on the employment-law exception in Article 9(2)(b) instead, but only where national law allows it. Whatever the basis, withdrawal must be as easy as giving consent, so a one-click opt-in cannot hide behind a ten-step opt-out.

Other regimes at a glance

Most privacy laws outside the US follow the same logic. Biometrics are sensitive, so permission has to be stronger than for an email address.

If you operate across borders, do not assume a US-style notice satisfies a European regulator. The GDPR asks whether the organization truly needs biometrics at all, and whether a PIN or badge would do. Treat necessity and proportionality as a second test that sits beside consent. A valid yes cannot rescue a scan that was never justified.

What a valid notice and consent form includes

A notice and a consent form do different jobs. The notice informs you, and the form records your yes. Many organizations merge them on one page, which works if both jobs get done. Use the elements below to judge whether biometric consent on paper is complete.

What the notice must say

Start with the facts. A good notice states what is collected, why, who receives it, and when it is destroyed, in plain language you can read in two minutes. Illinois and the GDPR both expect this before any scan happens.

What the consent form must capture

Next comes your permission. The form needs a separate, affirmative action, such as a signature or an unticked box you check yourself. It should also name the notice version you saw, so the record ties your yes to specific terms.

A consent form that hides the no-penalty alternative hides the choice itself.

Here is a short template you can adapt:

I have read the biometric notice (version [X], dated [date]).
I agree that [Company] may collect my [face template] for [door access] only.
I understand I can refuse or withdraw at any time by contacting [email],
and that [PIN or badge] is available with no penalty.
Name: ________  Date: ________  Signature: ________

I have read the biometric notice (version [X], dated [date]).
I agree that [Company] may collect my [face template] for [door access] only.
I understand I can refuse or withdraw at any time by contacting [email],
and that [PIN or badge] is available with no penalty.
Name: ________  Date: ________  Signature: ________

I have read the biometric notice (version [X], dated [date]).
I agree that [Company] may collect my [face template] for [door access] only.
I understand I can refuse or withdraw at any time by contacting [email],
and that [PIN or badge] is available with no penalty.
Name: ________  Date: ________  Signature: ________

Red flags when you are the one signing

Before you sign, read for what is missing. A vague form usually means vague practices, and missing details are the biggest warning sign. If an organization cannot answer a simple question, ask for the policy in writing.

• No retention date or deletion schedule

• Blanket sharing with "affiliates and partners"

• Consent folded into an employment contract or terms of service

• No named contact and no way to withdraw

Any one of these suggests the document protects the organization more than it protects you. Do not sign until it is fixed.

Can you refuse or withdraw consent?

Usually, yes. Biometric consent only means something if you can decline it, and it should also be something you can take back later. How much protection you get depends on the law and on who is asking.

When you can say no

Under the GDPR, refusal must carry no penalty when consent is the legal basis. If a gym or app offers a face scan, you can decline without losing the service, unless the scan is truly necessary to provide it. For staff, a PIN or badge alternative is the safer practice, and it is what regulators expect.

The US is less protective for workers. Illinois allows a written release to be signed "as a condition of employment," so an employer there can require a fingerprint if it follows the notice and release rules. Outside of work, a retailer or app can also set its own terms. Some scans never rest on your consent at all, such as legally mandated identity checks, so refusing there has consequences.

Refusal works best when consent is the legal basis, so ask which basis the organization is relying on.

How to withdraw consent

Withdrawal is your right under GDPR Article 7(3), and it must be as easy as giving consent. It stops future processing. It does not undo lawful use that happened before you withdrew. Pair it with a deletion request, because stopping use and erasing the stored template are separate things. Follow these steps:

1. Find the privacy contact named in the notice.

2. Send a written request that names the data and the date you consented.

3. Ask for deletion, including copies held by vendors.

4. Request written confirmation, and keep a copy of everything.

Deadlines vary. The GDPR generally gives an organization one month to respond. Illinois requires destruction once the original purpose is met, or within three years of your last interaction, whichever comes first. Texas sets a similar limit of one year after the purpose ends. If the organization stalls, file a complaint with your data protection authority or state attorney general.

Retaliation is the other risk. Many laws bar punishing someone for exercising privacy rights, but enforcement differs by state. Put your request in writing and save the replies, so you can show what you asked for and when.

Real-world examples of biometric consent in practice

When consent was missing

Cases make the rules concrete. In Rosenbach v. Six Flags, a teenager's thumbprint was scanned for a season pass with no written notice or release. In 2019, the Illinois Supreme Court ruled that you do not need to prove actual harm to sue under BIPA. A missing consent is the injury.

Employers have learned the same lesson at scale. A jury ordered BNSF Railway to pay $228 million in 2022 over fingerprint scans of truck drivers at its gates, taken without a written release. The case ended in a $75 million settlement in 2024. Fingerprint time clocks and gate scanners remain the most common source of these suits.

Regulators also act when consent never had a chance to exist. Clearview AI collected billions of face images from the web, and the Dutch data protection authority fined it €30.5 million in 2024. Nobody agreed to be in that database, which is exactly the problem.

When consent worked

Some systems get biometric consent right by design. Apple's Face ID asks you to opt in during setup, keeps your face data on the device, and lets you turn it off at any time. TSA's facial comparison at airport checkpoints is optional, and you can decline and have an officer check your ID by hand. In both cases, the alternative is real and refusing costs you nothing.

Good consent is visible, specific, and reversible.

What to take from these cases

Look at what the failures share. Each one skipped notice before capture, or made refusal impossible. Each success did the opposite. If you are the person being scanned, use the same test: can you see what is collected, say no, and change your mind later? If any answer is no, ask questions before you comply.

Putting biometric consent into practice

Biometric consent comes down to one test: can you see what is collected, say no, and change your mind later? Valid consent is informed, specific, and given before the scan. Whether you fall under BIPA, Texas CUBI, or the GDPR, the same habits hold up.

Organizations should give notice first, offer a real alternative, and keep proof of every yes. If you are the one being scanned, ask which law applies, check for a retention date, and put any withdrawal request in writing.

Your face and voice cannot be reset, so the permission you give deserves the same care as the data itself. If you want to join a registry that treats consent as the starting point, register with the Human Authenticity Registry and take part as a founding member on your own terms.