Biometric Privacy Law and the AI Systems That Read Faces and Voices

36 questions on biometric privacy law and the AI systems that read faces and voices, answered and cited by the UpLaw editorial team.

• Are there city or local laws regulating facial recognition?
• Are voiceprints covered by biometric privacy laws?
• Can a BIPA claim be brought in federal court?
• Can a European employer use a fingerprint time clock if employees consent?
• Can we train an AI model on faces scraped from the internet?
• Does a BIPA claim accrue every time a fingerprint is scanned, or only the first time?
• Does a security camera that records video violate biometric privacy laws?
• Does BIPA apply to banks and financial institutions?
• Does commercial general liability insurance cover BIPA claims?
• Does the 2024 BIPA amendment make my company's earlier biometric collection lawful?
• Do I have to prove I was actually harmed to sue under BIPA?
• Do I need written consent to collect biometric data, or is verbal consent enough?
• How can a developer build biometric AI without collecting protected identifiers?
• How does Texas's biometric statute differ from Illinois BIPA?
• How does the GDPR treat biometric data?
• If I delete the source images, have I deleted the biometric data?
• Is a photograph biometric data?
• Is emotion-detection technology legal?
• Is there a federal biometric privacy law in the United States?
• We license biometric technology from a vendor — isn't compliance their problem?
• What biometric practices does the EU AI Act prohibit outright?
• What counts as a biometric identifier under the Illinois Biometric Information Privacy Act?
• What damages can a plaintiff recover under BIPA?
• What did the 2024 BIPA amendment change?
• What does a biometric compliance program look like in practice?
• What does Washington's biometric privacy law require?
• What is data provenance, and why does it matter for biometric AI?
• What is the difference between one-to-one verification and one-to-many identification, and does it matter legally?
• What is the statute of limitations for a BIPA claim?
• What must a company do before collecting biometric data under BIPA?
• What should a contract for biometric technology include?
• When do the EU AI Act's high-risk obligations for biometric systems apply?
• Which states regulate biometric data even though they have no dedicated biometric statute?
• Who can be held liable under BIPA — the company that collects the data or the one that just stores it?
• Why did Meta pay Texas $1.4 billion over facial recognition?
• Why does the law treat biometric data differently from other personal information?