Biometric Information and BIPA: One Biometric Data Scan Can Cost You $5,000
Quick answer
What is biometric information and why is it treated differently?
Biometric information is data taken from a body, such as face geometry, fingerprints, retina scans or voice recordings, that a computer can use to tell one person from another. It is treated differently because it cannot be changed after a leak, unlike a password, and some laws regulate how it is collected.
Here is the strange part about biometric information: a company can owe you money the second it saves your face, even if nothing bad ever happens to that file. No hack. No leak. Just a scan taken without the right paperwork. And whether anyone actually pays often comes down to one clause, buried in a contract you will never be asked to read.
Biometric information (your face, fingerprints and voice, the body stuff that's uniquely you) can create a legal debt the moment a company collects it, and one clause in a contract decides who ends up paying when something goes wrong.
Biometric information explained: why a face is an identity that can't be reset
Let's back up. Biometric information is data about your body that a computer can use to pick individuals out of a crowd. Your password has no body. If it leaks, you change it before lunch. If your face leaks, there is no "forgot face" button. That single difference is why the law treats these records so differently, and why your identity is tied to them in a way no login ever was.
Is biometric data the same as biometric information?
Close enough for daily life. Both mean measurements taken from a body to tell individuals apart. Lawyers split hairs: Illinois's law lists specific "identifiers," like a scan of face geometry, and treats the records built from them as information. Either way, the same face is at stake.
Finger, face, voice: what counts as biometrics
Biometrics is the measuring of an individual's biological characteristics so a machine can recognize them. The list includes a finger pressed on a phone, a hand scan at a gym door, a retina scan at a secure entrance, face geometry (the distances between your eyes, nose and jaw), and voice recordings. Researchers also count even DNA. The common thread is unique identifying information based on a person's unique physical characteristics. Think of someone's physical traits as a signature written in flesh. Nobody else has yours, and you can't swap it out.
Illinois, which has the best-known biometric privacy law in the country, spells it out in plain legal text:
"Biometric identifier" means a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry.
Illinois Biometric Information Privacy Act, Section 10 (definitions)
How facial recognition collects biometric information before anything goes wrong
Picture a store camera running facial recognition. Three quiet steps happen. First comes detection: the software finds a face in the picture and draws an invisible box around it. Detection only says "a face is here." It does not say whose. Second, the system starts measuring an individual's facial features and turns them into a list of numbers, the metrics that describe your spacing and proportions. Third comes storage: those numbers, often called a template, get saved in a database.
Later, recognition does its job by comparing new numbers against the saved ones. Notice what is missing from those steps. Nothing requires you to say yes. By step three, the company is holding your biometric information, and it got there without a breach, a hacker, or a villain. Face detection is the quiet first step. Facial recognition is the part that puts a name on it. This article is part of a series, start with Age Verification Windows 11 Sorts Kids Into 5 Age Boxes.
Authentication versus identification: enhanced security or a lineup?
People mix these up, and it's easy to see why, since both use your face. Authentication asks a small question: can this person verify their identity? Your phone does this: it uses physical characteristics, comparing one fresh scan to one saved template, and the point is to verify you before giving access. That can offer enhanced security for users, because a thief can't easily copy your face the way they copy a typed code.
Identification asks a much bigger question: who is this? A recognition system searches a whole database or crowd and tries to automatically identify people. One is a locked door. The other is a lineup. Wrong answers in the first one lock you out of your phone. Wrong answers in the second can put you in handcuffs, as we'll see.
Security measures compared: biometric authentication versus a password
Why does biometric authentication get its own legal treatment? Compare it side by side with the thing it often replaces.
| Question | Password | Biometric information |
|---|---|---|
| After a leak | Change it in a minute | Cannot be changed, because it is your face or finger |
| What it checks | Something you know, used for authentication | Something you are, used for biometric authentication |
| Typical misuse | Cyber thieves get access to an account, and breach detection flags it | A recognition system tracks your identity or matches your face to the wrong person |
| Consent paperwork | Usually just a login screen | Illinois requires written notice and consent before collection |
Typing rhythm and other biometrics based on behavior
Not all biometrics are physical. Typing rhythm, meaning how fast you type and the pauses between keys, is one of the behavioral characteristics (spelled behavioural in much of the world) that systems can measure. So is walking style, or the way a hand holds a phone. These behaviors are softer than a fingerprint, and laws differ on which ones count. The practical takeaway: a company may be gathering more biometric information than your face alone. Read what the privacy policy actually lists.
Biometric information, BIPA and cyber risk: the debt starts at collection
Most of us think about privacy as a cyber problem. Hackers break in, data spills, damage follows. Under that thinking, a company that stores your file safely owes you nothing. Illinois's law flips the order. BIPA regulates how private companies collect biometric data in the first place. A company must tell individuals in writing that it is collecting, say why and for how long, get written consent, and publish a policy that includes when the data gets destroyed.
Skip those steps and the bill arrives early. According to Anderson Kill, damages run $1,000 per negligent violation and $5,000 per intentional or reckless one. A person suing does not have to prove they were hurt. The violation is the injury.
Here's an everyday version. Imagine a restaurant that quietly photographs every customer "for security," tells no one, and keeps the pictures forever. Nobody stole anything. The photos sit in a drawer. Under this kind of law, the restaurant still owes each customer, because the debt was created when the picture was taken and stored, not when someone misused it.
Why BIPA numbers got huge, then got reined in
Those per-violation amounts multiply fast. In a case about a fast food chain scanning employees' fingers, each scan counted as its own violation. The ACLU of Illinois describes the potential exposure as roughly $17 billion. Courts invited lawmakers to step in, and Illinois changed the law in 2024. So older contracts and old compliance plans were written for rules that have since shifted. That alone should tell you why this stuff is a moving target. Previously in this series: Janhvi Kapoor Deepfake Any Face Online Can Be Faked Podcast.
The misconception worth fixing: "A company is only responsible if my face gets stolen." It's a fair guess. We file faces under personal information, right next to a phone number or a Social Security number, and nobody owes you much if a number just sits in a database. But a face is a different kind of record. It can't be canceled or replaced, so the law tries to prevent the harm before it can start, instead of cleaning up afterward. Privacy risks begin at collection, not at theft.
Who pays when recognition systems misuse biometric data, and which clause decides it?
Often it comes down to a contract clause. An indemnification clause is a promise to reimburse the other side's costs, such as lawsuits and regulator questions. If the clause is missing, or carves out biometric claims, the bill lands somewhere else, sometimes on the person whose face was taken.
You will never sign that clause. It lives between a company and its software vendor, or between a company and its insurer. But it decides whether real money sits behind a promise to handle your face carefully. Blank Rome advises businesses to settle this in writing with any third party that touches biometric data. On the insurance side, K&L Gates describes disputes over whether insurers have to defend these claims at all, and the answer can hinge on how one exclusion is worded. Same lawsuit, different sentence, different payer.
When recognition systems are wrong, who pays then?
Now the human side. In February 2023, Porcha Woodruff, eight months pregnant, was arrested at her Detroit home for robbery and carjacking after a false facial recognition match. She was held for 11 hours before charges were dropped, according to CBS News. In November 2022, Randal Reid of Georgia was jailed for six days over a theft in Louisiana, a state he had never visited, according to the Associated Press. In 2020, the ACLU reports, Robert Williams was arrested in front of his family and held for 30 hours. In 2019, Nijeer Parks spent 10 days in jail in New Jersey after another false hit.
To be fair, these were police matches, not company privacy cases, and a privacy law like BIPA wasn't what decided them. But they show the pattern. When a recognition system is wrong, the cost does not land on the software. It lands on a person, a family, a week of their life. The ACLU of Georgia counts more than a dozen of them.
At CaraComp, we spend our time on how facial recognition and facial comparison actually work, and the lesson that stands out is simple: the math gets the headlines, but the paperwork gets the consequences. Who agreed to the scan, who stored it, and who promised to cover the fallout are all questions answered in writing, long before any match is made.
How to protect a face before a company collects it
You can't read every contract. You can do a few small things, and each takes minutes.
- Search the privacy policy. Open it and look for the words "biometric," "face," "voice," and "retain." If a company says how long it keeps your data and when it destroys it, that is a good sign. Silence is a signal too.
- Take the non-face option. If a store, gym or workplace offers a PIN or card instead of a scan, that is your lower-risk way in.
- Ask in writing. Email the company: what do you collect, how long do you keep it, and can I have it deleted? A reply, or a refusal to reply, tells you plenty.
- Go to the referee. If a company ignores you, your state attorney general's office takes privacy complaints. In your own accounts at major platforms, check the privacy settings for face and voice features and switch off what you don't use.
What You Just Learned
- It can't be reset. A password is changeable. A face, a finger or a retina is not.
- Detection is not recognition. Detection finds a face. Recognition says whose it is, and that is where the stakes rise.
- Collection can create the debt. Under Illinois's law, no breach or injury has to be shown.
- One clause moves the bill. Indemnification and insurance wording decide who covers the cost.
Biometric information is different from other data because it can't be replaced, so the biggest question is not whether a company got hacked but whether it had permission to collect your biometric data at all, and who has promised in writing to pay if it didn't. Up next: Biometric Information One Face Scan Can Cost A Firm 5 000.
So go back to the question that matters. If a company kept your face tonight and something went wrong, would you know where to look first? Not the app. Not the settings screen. Look for the sentence nobody advertises, the one that says who pays. That clause decides whether your biometric information is protected by a promise or just by hope.
Biometric information: Frequently Asked Questions
What are physical personal characteristics that count as biometric information?
A biometric characteristic is any measurable physical characteristic that can single out one person, such as fingerprints, face geometry, a retina scan, a hand scan, and voice recordings. Biometrics also include even DNA, according to researchers. Systems favor these because individuals carry their unique physical characteristics everywhere. Legal definitions differ from place to place, so a trait covered by one law may not be covered by another. Check the specific rules where you live.
Can a camera system automatically identify people without asking them first?
Technically, yes. Biometric identification, meaning a search that names individuals, can run on ordinary video once a template database exists, and facial recognition software can automatically identify people this way. Whether that is legal depends on the law where it happens. In Illinois, BIPA requires written notice and consent before a private company collects biometric data. Elsewhere the rules may be weaker or missing, which is why reading a privacy policy matters.
What is biometric technology data, and where does it get stored?
Biometric technology data means the numbers a system builds from a scan, usually called a biometric template, plus any original photos or recordings. It may sit on your own device, on a company server, or with a vendor that runs the biometric technologies for a business. Where storage happens affects who is responsible if it leaks, which is exactly what contracts try to settle.
Does a privacy policy have to mention biometric information?
It depends on the law. Illinois requires companies that collect biometric data to publish a written policy covering how long they keep it and when they destroy it, which protects consumers' biometric data from being kept forever. Other states and countries vary. A good privacy policy names the kinds of biometric data collected, the purpose, and the deletion schedule. If a policy is vague, ask the customer service team to spell it out in writing.
Is typing style really someone's physical traits, or something else?
Typing style is a behavior, not a physical trait. Someone's physical traits are things like a face or finger, while typing rhythm and walking style are behavioral characteristics. Both kinds of biometrics can be used to verify a person's biometric identity, and some security systems use both together. Laws often focus on the physical kind, so behavioral data may be treated differently from state to state.
Why do companies use biometric authentication if it carries privacy risks?
Convenience and security. A face or finger is quick, and it is harder to guess than a password. But the same permanence that makes it strong makes a leak serious. Responsible companies weigh the access benefit against the privacy risks, build compliance checks into the process, and limit how long they keep biometric information. Customers can ask which of those steps a company really takes.
A biometric sample is the raw scan a system captures, such as a photo of your face or a recording of your voice. The system turns each biometric sample into a template of numbers. Biometric recognition then compares new biometric data against that stored template. Knowing which piece is which helps you ask better questions about biometric information.
Biometrics fall into two broad groups. Physical biometrics include a fingerprint, a face, an iris or a hand. Behavioral biometrics include typing rhythm and walking style. Both groups of biometrics can be turned into biometric data, and both can be stored by systems you never see.
A fingerprint is one of the oldest and best-known forms of biometric identification. A fingerprint scanner on a phone door lock or a time clock measures the ridges of a finger and saves a template. If that template is stored by a company instead of only on your device, the biometric data now sits in someone else's systems, and the biometric information rules start to matter.
Good governance means a company has clear rules for who may see biometric information, how long it is kept, and who signs off before it is shared. Strong governance on paper is not the same as strong practice, so ask whether those rules are written down. A company with real governance can usually answer simple questions about its biometric data in a few sentences.
Government uses can follow different rules than a private shop. Homeland security screening, for example, is a public-sector setting, and it is not covered the same way as a gym that scans members. That is one more reason to check which biometric recognition rules apply to the place collecting your biometric information.
Biometric technologies are the tools that capture, measure and compare these traits. They include cameras, fingerprint readers, microphones and the software behind them. Different technologies work in different ways, and each one has its own features, strengths and weak spots. A fingerprint reader is not the same as a face system, so the risks are not identical either.
Some features of a face system matter more for privacy than others. Does it only detect a face, or does it also run identification? Does it keep the biometric sample, or only the template? Does it share biometric data with a vendor? These features change the risk, so they are worth asking about before you agree to a scan.
Identification systems deserve extra care, because they search many people at once. Biometric identification is a one-to-many search, while authentication is a one-to-one check. An individual walking past a camera may never know that an identification system is running. Knowing the difference helps you judge whether a use of biometric recognition is reasonable.
To keep a secure setup, a business should treat biometric data like its most sensitive records. Secure storage, limited access and a clear deletion date all help. A secure system is not just one that is hard to hack. It is also one that collects only what it needs, because biometric information that was never collected can never leak.
Ask how recognition systems are tested. Recognition errors happen, and a match is a guess with a score, not a certainty. A business that relies on recognition to deny entry or flag an individual should have a human check the result. That simple step keeps one wrong biometric match from turning into a real problem for a real person.
Vendors play a big part. Many businesses do not build their own systems. They buy biometric technologies from a vendor, and the vendor may hold the biometric data. That is why the contract matters: it says who may use the biometric information, who must delete it, and who pays if something goes wrong with the systems.
Small businesses are not exempt. A local gym with a fingerprint door or a shop with a face camera can be collecting biometric information just like a big company. Size does not remove the duty to give notice and get consent where a law like BIPA applies. If you run a small business, write down what biometric data you collect and why.
Employees have a stake too. A time clock that reads a fingerprint is collecting biometric data from every worker who uses it. Workers can ask what is stored, how long it is kept, and whether a card or PIN is offered instead. A fair employer can answer those questions about its identification and recognition setup in plain words.
If you only remember one thing, remember this: biometrics are personal in a way no password is. Biometric information tells a system who you are, and you cannot reset it. So ask early, read the policy, prefer secure options, and look for the clause that says who pays.