Biometric identifiers cannot be reissued, and the law has responded by treating the collection of a face, fingerprint, or voiceprint as conduct that must be disclosed and consented to before it happens, with penalties severe enough to bankrupt a careless company. This UpLaw research article maps that terrain for the two kinds of business that keep colliding with it: the deployer that buys a face-scanning product and the developer that builds one on a diet of harvested faces. It works through the Illinois Biometric Information Privacy Act and the litigation wave that Rosenbach and Cothron unleashed, the 2024 amendment that capped the per-scan damages theory, Texas CUBI and the record $1.4 billion Meta settlement, Washington's enrollment trigger, the comprehensive state and local regimes, and the European framework under GDPR Article 9 and the EU AI Act. It examines the collector-versus-possessor divide, federal-standing quirks, the insurance-coverage fight, model-inversion risk in trained systems, and closes with a life-of-the-data compliance program. Throughout, two invented companies illustrate how the same statute can mean a routine feature to one firm and an existential threat to another.