Your Face as Data: Biometric Privacy Statutes and the Written Consent Requirement
By Casey Scott McKay ·
Biometric privacy is the rare area of privacy law where a technical foul carries damages large enough to end a company, and the foul is usually a missing piece of paper. This article explains what counts as a biometric identifier and what does not, the notice, written release, retention, and destruction obligations that the leading statutes impose, and why the private right of action in one state has driven nearly all of the litigation. It covers who is liable — employers running fingerprint timeclocks, vendors supplying the systems, and platforms applying face recognition to uploaded photographs — and how damages accrue. It then turns to the newer comprehensive state privacy laws that treat biometric data as sensitive and require consent or an opt-out. It closes with what a compliant program actually looks like and what makes an existing one defensible.
IP and Technology > Privacy Data Security | Article | Published 20 January 2026 - Updated 14 May 2026 | Casey Scott McKay - marksy.us
Summary. Biometric privacy is the rare area of privacy law where a technical foul carries damages large enough to end a company, and the foul is usually a missing piece of paper. This article explains what counts as a biometric identifier and what does not, the notice, written release, retention, and destruction obligations that the leading statutes impose, and why the private right of action in one state has driven nearly all of the litigation. It covers who is liable — employers running fingerprint timeclocks, vendors supplying the systems, and platforms applying face recognition to uploaded photographs — and how damages accrue. It then turns to the newer comprehensive state privacy laws that treat biometric data as sensitive and require consent or an opt-out. It closes with what a compliant program actually looks like and what makes an existing one defensible.
Keywords: biometric privacy, biometric identifier, facial recognition, fingerprint timekeeping, voiceprint, written release, informed consent, retention schedule, destruction policy, private right of action, statutory damages, per-scan accrual, vendor liability, employer liability, photograph exception, health care exemption, financial institution exemption, comprehensive state privacy laws, sensitive data, class action exposure
This is premium Marksy content — the full document is available to subscribers.