What Is Considered Biometric Data? The Permanence Gap Explained

In April 2026, a financial security researcher named Li Chang sat down in front of a Chinese television audience and did something that should have made headlines everywhere. He took a single celebrity selfie, the kind posted on social media every minute of every day, and used an AI tool to extract that person's fingerprints from it. Not from a crime scene. Not from a glass they'd touched. From a photo.

Here's the thing that makes that demonstration genuinely unsettling: you can change your password right now, in about 30 seconds. You cannot change your fingerprints. Ever. You've got ten fingers total. That's your entire lifetime supply of replacements, and once the data from any one of them is digitized, copied, and stolen, that finger is compromised as a security tool forever.

That's not a metaphor. That's the actual math. And it's why biometric data belongs in a completely different mental category than every other kind of personal information you share online.

---

Biometric Data Definition: What It Includes

Most people hear "biometrics" and picture two things: the fingerprint sensor on their phone, and Face ID. Those are biometrics, yes. But the category is much wider than that, and the wider parts are where things get genuinely surprising.

Biometric data (your body's unique, measurable characteristics) splits into two families. The first is physiologicalthe physical stuff: fingerprints, your face, your iris, even the pattern of veins in your nailbed. The second is behavioraland this is the one most people have never thought about. Behavioral biometrics includes things like the rhythm of how you type, the angle you naturally hold your phone, the cadence of your speech, and, here's where it gets interesting, the way you walk.

Gait recognition (identifying someone by how they move) has quietly moved from science fiction toward standard practice. By 2023, the UK's Biometrics and Forensic Ethics Group had flagged it for ethical guidance, which, if you know how these things work, is usually the signal that real-world use isn't far behind. The key detail about gait recognition? It works at a distance, from regular security camera footage, without the person knowing they're being identified. No cooperation required. No finger on a scanner. You just walk past a camera. This article is part of a series, start with Only 0 1 Of People Can Spot A Deepfake Heres The 3 Step Meth.

Banks and retailers are already harvesting behavioral biometrics, often continuously, often without making it particularly obvious. The way you scroll, the pressure you apply when you tap, the micro-hesitations in how you navigate an app, these patterns are being collected and used to verify (or flag) your identity in the background, right now, while you use perfectly ordinary apps.

What Counts as Biometric Data, Exactly?

When people ask what is considered biometric data, the honest answer is broader than most expect. Biometric data covers any measurement of a person's unique physical characteristics, fingerprints, facial geometry, iris patterns, vein maps, plus behavioral signals like typing rhythm, gait, and speech cadence. Personal data becomes biometric data specifically when it's used to identify a person from a measurable trait of their body or behavior, not just to describe them in general terms. A photo alone is just personal data; the same photo run through facial recognition software to extract a unique faceprint becomes biometric data the moment that extraction happens.

Biometric Information vs. Ordinary Personal Data

Biometric information differs from other personal data in one crucial respect: it can't be reissued. A leaked home address or an old email password is personal data you can eventually change or move away from. Biometric information, the measurements behind your fingerprint or facial recognition profile, describes something fixed about your body, so once biometric information is exposed, the underlying trait it was measuring stays compromised for the rest of your life.

---

Biometric Security Systems vs. Passwords: Key Differences

Think of a password like a combination lock on a locker. Someone steals the combination, annoying, but you just set a new one. The lock doesn't care about your history. It only knows the current combination.

A biometric is more like a key that was cast from your actual body. Once someone makes an accurate copy of it, they can use that copy indefinitely. You can't recast your finger. And here's the twist that makes this worse than the key analogy: a physical key is hard to copy secretly, but biometric data, once it's been digitized and stored in a database, is trivially easy to replicate. According to research covered by The Conversation, once someone has your fingerprint data, it's possible to print a physical replica using conductive ink, and that replica can fool biometric scanners.

Let that sit for a second. A printout. Fooling a fingerprint scanner. This isn't a hacker-movie plot. It's a documented technique.

Your fingerprint data doesn't live in just one place, either. It's in your phone's secure chip, yes. But it may also be in your employer's access system, your gym's check-in kiosk, the border control database from your last international trip, and any number of third-party apps that requested biometric access and stored a version of that data in their own servers. Each of those is a separate target. A separate place where a breach could hand someone a permanent copy of something you can never change.

"The most important advantage of gait identification is that it can be done at a distance, unlike fingerprints or faces, gait can be extracted from video without the subject's knowledge." Professor Oli Buckley, Loughborough University

---

Biometric Security System Accuracy: Why 99% Isn't Enough

Here's the misconception that almost everyone carries around, and it's completely understandable why: biometric systems feel like they're giving you a yes or a no. Your face either unlocks your phone or it doesn't. It feels binary. Clean. Certain. Previously in this series: The Spreadsheet That Decides Whether Ai Regulation Can Actua.

What's actually happening is a probability calculation, and the gap between "feels certain" and "is certain" matters enormously once you understand the numbers.

Every biometric match is a score that gets compared to a threshold. The system doesn't say "that's definitely her." It says "this score is above the cutoff we set, so we'll call it a match." According to NIST (the National Institute of Standards and Technology, basically the gold standard for this kind of measurement), every biometric system has two competing error types: false matches (the system says "yes" when it should say "no") and false non-matches (it says "no" when it should say "yes"). Engineers tune the threshold to balance these errors based on what the system is being used for. You probably didn't set that threshold. You almost certainly don't know what it is.

Now scale this up. According to Innovatrics, if you screen one million passengers a day with a false positive rate (wrongly flagging an innocent person) of just 0.1%, you'd expect around 1,000 mistaken hits. Every single day. From a system that's 99.9% accurate. That's not a flaw, that's math. A small error rate applied to a giant number still produces a very large number of mistakes.

Fingerprint capture quality adds another wrinkle. NIST research shows that matching accuracy with a single fingerprint, especially captured contactlessly, like from a photo, sits around 60-70%. Scan four or more fingers at once, and accuracy climbs to 99.9%. That's a massive range, and it hinges on something as mundane as how many fingers you put on the reader.

---

So What Should You Actually Do With This Information?

The useful takeaway here isn't "biometrics are terrifying, never use them." Face ID is genuinely more secure than a four-digit PIN for most everyday threats. The useful takeaway is knowing what kind of risk you're accepting when you hand over biometric data, and recognizing that it's a different category of risk than sharing a password.

Passwords operate on a model of infinite replacement. Biometrics don't. When a company asks you to verify your identity using your face, your fingerprint, or behavioral signals like how you move through their app, you're not just handing over a credential. You're handing over a permanent piece of identifying information that will live in their database, governed by their security practices, for as long as that company exists, and sometimes longer. Up next: Sweden Live Facial Recognition Police Law Enforcement Safegu.

At CaraComp, we work with facial recognition systems every day, and the most important thing we've learned is that the technology itself is only half the picture. The other half is understanding what happens to the data after the match is made, who stores it, how long they keep it, and what their security posture looks like if something goes wrong. Those are questions worth asking before you tap your finger on any scanner that isn't your own device.

The photo-to-fingerprint demonstration is a useful gut-check. That celebrity didn't hand their fingerprints to Li Chang. They posted a photo on social media. The data was extracted without their participation. Which means the question isn't just "who am I giving my biometrics to?", it's also "what data about my body is already out there, in formats I didn't think of as biometric data, waiting for a tool advanced enough to extract it?"

There's one more thing worth sitting with. The gait recognition research isn't theoretical. It's being flagged by ethics boards precisely because it's getting operational. Right now, the security cameras you walk past every day don't necessarily know who you are. But that's changing, and when it does, the identifying signal they'll use isn't something you consented to provide. It's just the way you've always walked.

Which raises a question worth taking to bed with you: if someone could identify you from the way you move, silently, from a distance, from footage you didn't know was being captured, which of the things you do every day would feel different?

Biometric Protection: What Actually Keeps Your Data Safe

Biometric protection is not one single lock, it's a stack of separate safeguards, and each one can fail independently. Good systems store a mathematical template of your fingerprint or face rather than the raw image, encrypt that template, and keep it isolated on your device instead of shipping it to a central server. Weak systems skip one or more of those steps, which is exactly where the printed-replica attack described above gets its opening.

Biometric Technologies Beyond the Fingerprint Scanner

Biometric technologies now cover far more ground than the sensor on your phone. Iris scanning, voice recognition, vein-pattern readers, and gait analysis all fall under the same umbrella, and each one captures a different physical or behavioral signal. The practical consequence is that "opting out of biometrics" is harder than it sounds, because a camera capturing your gait or a microphone capturing your voice print doesn't need your cooperation the way a fingerprint scanner does.

Biometric Recognition and the Threshold Problem

Biometric recognition systems don't produce a flat yes or no, they produce a similarity score that gets checked against a threshold, exactly like the fingerprint and face-matching examples described earlier in this article. Move that threshold one way and you get more false matches; move it the other way and you get more false rejections. Whoever sets that threshold is making a judgment call about your identity that you never get to see, let alone approve.

Biometric System Design: Where the Weak Points Hide

Every biometric system has three stages: capture, storage, and matching, and a weakness at any single stage compromises the whole chain. Capture can be spoofed with a printed replica or a photo, as the Li Chang demonstration showed. Storage can be breached like any database, and matching can be tuned toward convenience at the expense of accuracy. Understanding which stage a given product is weakest at is more useful than trusting a marketing claim of "99% accurate."

Physical Biometrics vs. Behavioral Signals

Physical biometrics, fingerprints, faces, irises, are fixed and countable, which is part of why their theft is so consequential. Behavioral signals like typing rhythm or gait are harder to spoof convincingly because they change slightly from day to day, but they're also collected far more quietly, often without a clear consent screen. Both categories end up in the same permanence trap once they're digitized: neither can be reissued the way a password can.

Fingerprint biometrics deserve one more note of caution: the accuracy figures cited earlier assume a good-quality scan taken with cooperation, not a fingerprint reconstructed from a photo. When facial recognition and fingerprint biometrics are combined in the same access-control system, a failure in one doesn't just weaken that one channel, it can weaken the whole authentication chain, because many systems are configured to accept a match on either signal.

Authentication built on biometric data works differently from authentication built on something you know, like a password, or something you carry, like a key fob. Verification through a face or fingerprint is convenient precisely because you can't forget your own body, but that same permanence is what makes recovery impossible after a breach. Access control systems that rely solely on biometric verification, without a fallback authentication method, leave individuals with no real recourse once their biometric data has been copied.

Pattern recognition is the underlying technique behind nearly every biometric system, whether it's matching the ridges on a finger, the geometry of a face, or the rhythm of a gait. Behavioral characteristics are harder for pattern recognition to nail down precisely because they shift with mood, fatigue, or injury, which is why behavioral authentication methods often run continuously in the background rather than checking identity once at login. That continuous verification is also why banks and retailers can flag suspicious activity mid-session instead of only at sign-in.

Facial recognition remains the most visible form of biometric security precisely because it requires no physical contact, a camera can verify or flag a face from several feet away. That convenience is the same property that makes facial recognition useful for gait recognition and other distance-based identification, and it's why regulators keep circling back to facial and gait systems together when they draft ethical guidance for biometric security systems.

Biometric Access Control in Everyday Buildings

Biometric access control now shows up in ordinary office lobbies, apartment buildings, and gyms, not just high-security facilities. A biometric access control panel at a building entrance typically checks a fingerprint or face against a stored template, and if the security team hasn't set a sensible threshold, the system either lets in people it shouldn't or locks out people it should recognize. Because biometric access control is physical access at its core, a single compromised credential can affect every door tied to that same access control system.

Biometric identification differs from biometric authentication in one important way: identification asks "who is this person, out of everyone in the database," while authentication asks "is this person who they claim to be." A biometric security system built for identification, like a facial recognition setup scanning a crowd, carries far more false-match risk than one built for one-to-one authentication, like unlocking a single phone. That distinction matters because cutting-edge technologies that utilize unique physical characteristics get marketed under one umbrella term even though the underlying job, and the underlying risk, is completely different.

Facial biometrics used for identification at scale, such as scanning a stadium crowd, behave very differently from set-ups that use unique human characteristics for a single access decision, such as unlocking a laptop. Recognition systems built for the crowd scenario have to compare one face against millions of stored faces, which multiplies the false-match math discussed earlier in this article. Recognition systems built for the single-device scenario compare one face against one stored template, which is why phone-unlock accuracy tends to be far higher than crowd-surveillance accuracy.

Biometric security systems that use fingerprint recognition still depend on capture quality above almost everything else, exactly as the NIST research on multi-finger scanning showed earlier. A biometric system that uses fingerprint recognition from a single low-quality contactless scan inherits the same 60-70% accuracy ceiling described above, no matter how sophisticated its matching algorithm is. That's the practical reason many secure facilities still require a full hand scan rather than a single finger, even though a single finger feels faster.

Some newer platforms describe themselves as technologies that verify identity based on more than one biometric signal at once, pairing a face scan with a fingerprint or a voice print so that spoofing one channel isn't enough to break in. A biometric system combining two of their unique physical characteristics is generally harder to fool than a single-signal system, since an attacker would need a convincing fake of both signals rather than just one. This is also why some vendors now describe their offering as a set-up that uses unique biological characteristics from more than one source rather than relying on any single scanner.

Security teams evaluating a new biometric security system should ask three questions before rollout: where the template is stored, whether the vendor has a documented spoof-resistance test, and what the fallback authentication path looks like if the biometric check fails. A secure deployment treats biometric access control as one layer in a broader security plan, not a replacement for every other safeguard. Security that depends entirely on a single fingerprint or face scan, with no fallback, repeats the exact permanence problem described at the start of this article, and building genuine security means planning for the day a scan gets spoofed, not just trusting that it won't.

Biometric Authentication and the Case for Multi-Factor Authentication

Biometric authentication alone is convenient, but security researchers increasingly recommend pairing it with multi-factor authentication rather than relying on a single factor authentication step. Multi-factor authentication combines something you are, your fingerprint or face, with something you know, like a password, or something you have, like a device passcode or a hardware key. Factor authentication that stacks two independent checks means a stolen password alone can't get an attacker in, and a spoofed biometric alone can't either.

Passwords, Passkey Authentication, and What Comes Next

Passwords have always had one advantage biometrics can't match: passwords are fully replaceable. Passkey authentication and passwordless IAM systems try to keep that replaceability while removing the memorization burden, using a device-bound cryptographic key instead of a password you type. A password manager helps in the meantime by generating and storing long, unique passwords for every account, so a single leaked password doesn't cascade into every other login you own.

Biometric MFA: Strength in Combining Signals

Biometric MFA pairs a biometric check with a second factor, so a single point of failure, a spoofed fingerprint or a leaked password, isn't enough on its own. MFA of any kind reduces risk because an attacker has to defeat two independent systems instead of one, and biometric MFA specifically forces them to defeat both a physical spoof and a separate credential. This is why many workplace security teams now require MFA even on devices that already have a fingerprint sensor built in.

Credential Theft and Why Biometrics Are Different

Credential theft involving passwords is common, disruptive, and ultimately fixable: you change the password, revoke old sessions, and move on. Credential theft involving biometric passwords, if a vendor is careless enough to call a stored template that, is a different order of problem because the stolen credential can't be swapped out. Biometrics are permanent in a way passwords were never designed to be, which is exactly why the security posture around biometric storage has to be so much stricter than the posture around a password database.

Device-Level Security and Identity Verification

Device security still matters even when biometric authentication is doing the front-door work, because a compromised device can leak both the password and the biometric template stored on it. Identity verification that relies on a single device, with no backup path, creates the same single-point-of-failure risk described throughout this article. A secure device combines local encryption, a device passcode as a fallback, and biometric authentication as the fast path, so identity checks don't collapse if any one layer fails.

Password and biometrics, taken together rather than as competitors, describe the two ends of a spectrum: something replaceable and something permanent. Security teams who understand both halves of that spectrum tend to build systems where a password failure and a biometric failure don't happen at the same time, through separate storage, separate recovery paths, and separate monitoring. Treating password and biometrics as complementary layers, rather than picking one over the other, is the practical lesson underneath everything else in this article.

Security researchers keep returning to the same core point: security is a property of the whole system, not any single credential inside it. A password can be strong and a biometric scanner can be accurate, but if the two aren't backed by good storage practices, sensible thresholds, and a real fallback authentication path, the overall security of the system is still weak. That's the standard worth holding any device, app, or building against before trusting it with your face, your fingerprint, or your password.

Passwordless Authentication: Removing the Password Entirely

Passwordless authentication does not just hide the password field, it removes the password from the login flow altogether, replacing it with a device-bound key, a biometric check, or both. Many identity teams are moving toward passwordless authentication because a password that never exists cannot be phished, guessed, or leaked from a breached database. Passwordless setups still need a device unlocked by a passcode or a fingerprint, so the device itself becomes the thing that must stay secure.

Users adopting passwordless authentication trade one risk for another rather than eliminating risk outright: they eliminate password reuse and phishing, but they add device dependency, since losing the device without a backup method can lock users out entirely. Good passwordless systems build in a secondary recovery path, a backup device, a printed recovery code, or a second identity check, precisely because users forget devices at home or lose them the same way they used to forget passwords.

Password Basics Still Worth Knowing

A password remains the most common authentication method in the world, and users who follow a few basics, a unique password per account, a password manager instead of memory, and a password long enough to resist guessing, close off most of the easy attacks. The gap between a weak password and a strong password is often just length and uniqueness, not complexity for its own sake. Users who reuse one password across many accounts turn a single leaked password into a master key for an attacker.

Device Trust as the New Security Perimeter

The device sitting in your pocket has quietly become the real security perimeter, more so than the password or the biometric check layered on top of it. A trusted device stores the cryptographic keys behind passkeys, holds the biometric templates behind Face ID and fingerprint unlock, and often holds the session tokens that keep you logged into banking and email apps. Users who lose an unlocked, untrusted device hand an attacker a shortcut past both the password and the biometric layer at once, which is why device-level security deserves the same attention as the credentials it protects.

Identity in an Authentication System Built on Layers

Identity, in a modern authentication system, is rarely proven by a single signal, it's pieced together from a password or passkey, a device check, and often a biometric confirmation, each covering for the others' weaknesses. Security teams who design for identity this way accept that any one layer might fail on a given day, whether that's a forgotten password, a spoofed biometric, or a lost device, and they build recovery paths so one failure does not become total lockout. Users benefit from this layered identity approach even when they don't notice it, since it's the reason a single mistake rarely ends in a fully compromised account.

So what is considered biometric data in practice, once you strip away the marketing language? Regulators and security researchers generally point to the same short list: fingerprints, facial recognition templates, iris and retina scans, voice prints, and increasingly, behavioral patterns like gait and typing rhythm. What ties all of these together is that each one measures a person's unique physical characteristics or their unique behavioral patterns closely enough to identify that specific individual, not just to describe a category of people. A photograph of a crowd is personal data about everyone in it, but it only becomes biometric data for a given individual once software extracts a measurable, identifying signal from that image.

It helps to separate biometric identifiers from the broader idea of sensitive data. Sensitive data is a wider legal and practical category that includes things like health records, financial details, and precise location history. Biometric identifiers are a specific type of sensitive data because they meet a higher bar: they're tied permanently to one body, they usually can't be changed, and they can be used to single out one individual with real confidence rather than just narrowing down a group. That's why sensitive data used for biometric identification tends to get treated more strictly by security teams than sensitive data used for other purposes, even inside the same company.

Your specific physical characteristics, the exact curve of your iris, the ridge pattern on your fingerprint, the geometry of your face, are what separates biometric data from ordinary personal data. A person's unique physical characteristics don't change from one login attempt to the next the way a password can be swapped, which is exactly why biometric characteristic data demands stricter storage and handling rules than a typed password ever needed. Fingerprint or facial recognition data extracted from a single photo, as the Li Chang demonstration showed, is still biometric data even when the person photographed never sat in front of a scanner.

Biometric identity is the practical outcome of collecting enough of these measurements to distinguish one person from everyone else in a database. Establishing biometric identity doesn't require every biometric signal at once, a single high-quality fingerprint or face scan is often enough, but combining two or more signals, as some newer platforms now do, makes that identity claim far harder to spoof. Data that is related to a person's body or behavior in this identifying way carries permanence risk that ordinary data, like a mailing address or a purchase history, simply doesn't carry.

Personal identification through biometric data differs from older personal identification methods, like showing a photo ID card to a guard, in one key respect: the biometric version doesn't rely on a human comparing two images. It relies on software scoring a match against a threshold, exactly as described earlier in this article, which means personal identification at scale inherits the same false-positive math that airport screening does. Understanding that gap between how identification used to work and how it works now is part of understanding what is considered biometric data and why it gets treated differently under company security policies.

Type of biometric data matters just as much as the fact that it was collected at all. A fingerprint template stored locally on a phone's secure chip is a very different type of risk than the same fingerprint data sitting in a third-party server, even though both are technically the same type of biometric information. Knowing which type of data a given app or building system is collecting, physiological, behavioral, or some combination of both, is the first practical step toward deciding whether handing it over is worth the permanence risk described throughout this article.