On July 24, Meta launched Facebook Verified, a free badge that confirms a user is a real human by running a facial-recognition selfie against their existing profile photos. Dr. Alex Wissner-Gross flagged it in The Innermost Loop on July 26, 2026 with a line worth sitting with: it is a badge that confirms you exist, not that you are trustworthy. When the largest consumer platform on earth normalizes face scanning as the price of proving you are not a bot, biometric privacy law stops being a technology-sector problem and becomes an operating question for ordinary businesses.
What Meta’s Face-Scan Badge Means for Business
Meta’s stated reason is fraud. Generative AI has made fake profiles cheap, convincing, and scalable, so the company is using a biometric check to separate humans from synthetic accounts. To qualify you must be over 18 and in good standing, and the badge then follows you across Marketplace, Dating, and other surfaces. Notably, Meta chose facial recognition despite having paid Texas $1.4 billion to settle biometric collection claims and having pulled face-recognition code from its smart glasses app.
That choice matters far beyond Facebook. Platforms set defaults, and defaults become customer expectations. Once “scan your face to prove you’re real” feels ordinary, vendors will sell it to you as an off-the-shelf feature — for age verification at checkout, identity proofing on high-value orders, contractor check-in on a job site, or replacing badge readers at the front door.
Most business owners will evaluate that decision as an IT purchase or a fraud-loss calculation. It is neither. It is a regulated data-collection decision, and the moment you capture the scan, a specific set of statutory duties attaches. Unlike most privacy rules, several of these come with statutory damages and, in Illinois, a private right of action — which means plaintiffs do not have to prove they lost a dollar to file a class action.
The Legal Impact: 5 Critical Risks Under Biometric Privacy Law
Here is where the exposure actually sits for a business considering, or already running, a face or fingerprint system.
1. Consent is a document, not a checkbox
The Illinois Biometric Information Privacy Act requires a private entity to inform the subject in writing that biometric data is being collected, state the specific purpose and the length of term, and obtain a written release before collection. Texas’ Capture or Use of Biometric Identifier statute similarly requires informed consent for commercial capture.
The overwhelming majority of claims under biometric privacy law are not about a breach or misuse. They are about a business that deployed the scanner and never papered the consent. A clickwrap “I agree” buried in an app, or a line in an employee handbook nobody signed, has repeatedly proven to be a weak substitute for a standalone written release.
2. Your vendor’s compliance is not your compliance
Businesses routinely assume the timeclock company, the POS provider, or the identity-verification SaaS carries the risk. The statutes generally attach the duty to the entity that collects or possesses the data — which is you. Vendors get named as co-defendants, but that does not get the employer or merchant out of the case.
The fix is contractual and it belongs in the agreement before rollout, not after a demand letter. Our commercial contract attorneys look for three things in these deals: an allocation of who performs notice and consent, a vendor obligation to support your retention and deletion schedule, and a defense-and-indemnification clause broad enough to actually cover statutory privacy claims. Generic “data protection” language frequently fails that last test. This is the same contractual discipline we described in our analysis of AI agent liability, where the tool acts and the business answers for it.
3. Retention schedules are a standalone violation
BIPA requires a publicly available written retention and destruction policy, with destruction when the initial purpose is satisfied or within three years of the individual’s last interaction, whichever comes first. That is an independent obligation. A business can have flawless consent forms and still lose on retention because it never published a policy or never actually deleted anything.
This is the requirement most often discovered during due diligence rather than before it. If you are selling the business, a missing biometric retention policy is a diligence finding that gets escrowed against — a dynamic familiar to anyone who has been through a small-business M&A process in Illinois.
4. The state rules are moving in opposite directions
There is no single national standard, and 2026 pulled the states further apart. Texas’ Responsible Artificial Intelligence Governance Act, effective January 1, 2026, amended CUBI to clarify that publicly available media does not by itself establish consent, and created exceptions for developing or training AI systems and for certain security and fraud-prevention deployments. Colorado moved the other way, with HB 24-1130 layering notice, consent, retention, and deletion duties for biometric identifiers onto the Colorado Privacy Act and reaching employers directly.
Illinois, meanwhile, narrowed damages. A 2024 amendment established that repeated collection by the same method supports a single recovery, and in April 2026 the Seventh Circuit held in Clay v. Union Pacific that the change applies retroactively to pending cases. The practical takeaway for multi-state employers is that one national biometric policy no longer works. What is exempt in Texas may be a violation in Colorado, and Illinois remains the only one of the three where private plaintiffs drive the litigation.
5. Employees and customers are two separate exposure channels
Businesses tend to think about biometric privacy law in one lane — usually the customer-facing one — while the larger historical liability has come from the workforce: fingerprint timeclocks, palm scanners, face-based door access, and voiceprint authentication in call centers. Employee claims arrive as class actions with a naturally defined class and clean records of exactly who was scanned and when.
Customer-facing deployments carry their own version. Age-gated retail is a live example: Illinois dispensaries scan identification at every entry, and any business layering facial matching onto that workflow has moved from checking a document to processing a biometric identifier. For operators building those SOPs, our colleagues at Collateral Base handle the operational compliance side, while licensing and regulatory questions in that industry run through Cannabis Industry Lawyer. And if a claim has already landed, biometric class actions are litigation, not a compliance project — that work sits with the trial team at Howard Law Group. The classification lesson here rhymes with our piece on worker classification risks: the technology changed, the statute did not, and the employer answers for the gap.
What Howard East Clients Should Do Now
You do not need a privacy program to close the most common gaps. You need an afternoon and a short list.
- Inventory what you already capture. Timeclocks, door access, call-center voice authentication, ID scanners, security cameras with analytics. Most businesses find at least one system they forgot was biometric.
- Pull the consent artifacts. For each system, produce the signed written release and the written disclosure of purpose and retention term. If you cannot produce them, that is the finding.
- Publish a retention and destruction schedule and confirm someone is actually executing the deletions.
- Re-read the vendor agreement for indemnification scope and who owns the notice obligation.
- Map your states. Where do your employees and customers physically sit? That, not your headquarters, drives which biometric privacy law applies.
Call counsel before you deploy, not after. The single most expensive fact pattern in this area is a system that ran for two years without a consent form — because every scan in that window is already in the record, and no amount of after-the-fact papering fixes it.
Talk to a Business Attorney About Biometric Compliance
Howard East advises employers and business owners on privacy, technology-vendor contracts, and the employment-law exposure that comes with new workplace systems. If you are evaluating facial recognition, fingerprint timekeeping, or identity verification — or you have already deployed one and want to know where you stand — schedule a consultation with our business law team.
This article is for informational purposes only and does not constitute legal advice. Reading it does not create an attorney-client relationship. Biometric privacy law varies significantly by state and continues to change; consult counsel about your specific facts.
Frequently Asked Questions About Biometric Privacy Law
Does biometric privacy law apply to a small business, or only to large tech companies?
Illinois’ Biometric Information Privacy Act applies to private entities generally, with no revenue or headcount threshold, and the businesses that get sued are frequently small and mid-sized employers using fingerprint timeclocks or face-scan door access rather than technology companies. Texas and Colorado take different enforcement routes, but their coverage is similarly broad. If your business captures a fingerprint, a voiceprint, or a scan of face or hand geometry from an employee or a customer, you are likely inside the statute regardless of your size.
We use a third-party vendor for our timeclock or ID scanner. Doesn’t that shift the liability?
Not by default. Under statutes like BIPA, the obligation to give notice and obtain a written release generally attaches to the private entity that collects or possesses the data, which is usually the employer or merchant, not just the software company. Vendors have been named as defendants too, but that does not remove the collecting business from the case. The practical fix is contractual: your agreement should allocate compliance responsibility, require the vendor to support your notice and retention obligations, and include a defense and indemnification obligation that actually reaches privacy claims.
Did the 2024 BIPA amendment and the 2026 Seventh Circuit ruling eliminate the risk?
No. The 2024 amendment clarified that repeated collection by the same method supports a single recovery rather than one per scan, and in April 2026 the Seventh Circuit held in Clay v. Union Pacific that the amendment applies retroactively to pending cases. That meaningfully lowers the ceiling on per-plaintiff damages. It does not remove the private right of action, class certification, statutory damages, or fee-shifting, and it does not cure a missing consent form. Exposure got smaller, not optional.
Is a photograph of an employee or customer regulated biometric data?
It depends on what you do with it. The Illinois statute excludes photographs from the definition of a biometric identifier, but courts have allowed claims to proceed where a business derived a scan of face geometry from a photograph. Storing a headshot is treated differently from running that headshot through facial recognition to generate an identifying template. The processing step, not the file format, is usually what brings the activity inside biometric privacy law.
