What Is Biometric Data Collection? Templates, Vaulting & Consent

Here's something that will probably bother you more the longer you think about it: when you upload your face to try on glasses online, the app doesn't actually keep your photo. It does something weirder — and, legally speaking, far more significant. It measures you. The distance between your eyes. The angle of your jawline. The precise geometry of your nose. Then it throws those measurements into an equation, spits out a string of numbers, and that's what it keeps. Not a picture. A mathematical blueprint of your face.

Most people don't know that step exists. And a recent ruling from the Seventh Circuit Court of Appeals — one of the most influential federal appeals courts in the U.S. — just made it very clear that courts are paying close attention to it. The case involved a company called Gunnar Optiks and its virtual try-on feature. The question wasn't really about glasses. It was about whether that invisible conversion step — selfie to math file — creates the kind of data that biometric privacy law was written to protect.

Spoiler: it does. And once you understand how that conversion happens, you'll never look at a "try before you buy" feature the same way again.

---

How Uploads Create a BIPA Biometric Template

Picture this. You're on an eyewear website at 9pm. You click "try on frames." The app asks you to take a selfie or upload a photo. You do. Seconds later, you see yourself wearing the glasses. Looks kind of good, honestly. You close the tab and move on.

Here's what happened in those few seconds that you didn't see. This article is part of a series — start with Your Face Was Scanned Saturday Nobody Asked If That Was Lega.

The moment your face appeared on the app's server, software began scanning it for landmarks — specific, measurable points on your face. According to ExploreAnthro, facial recognition systems measure things like the distance between your eyes, the upper outlines of your eye sockets, the sides of your mouth, the location of your nose, and the prominence of your cheekbones. These aren't vague impressions — they're specific numerical measurements, taken from specific points on your face.

Then comes the part that matters. Those measurements don't get stored as a snapshot. They get compressed — run through a mathematical process that converts the geometry of your face into a compact string of numbers. Facia.ai describes this as "a mathematical representation of the user's face allowing for later identification without storing the original images." The photo is gone. What remains is a file that encodes the unique shape of you.

That file is called a biometric template (a reusable mathematical model of your face's geometry — think of it as your face, expressed as a formula rather than a photograph).

---

Biometric Template vs. Photo

Here's the analogy that makes this click instantly.

Think of your selfie as a painting of your face — a complete image that anyone can look at, copy, or recognize. A biometric template is more like a recipe for your face: "two tablespoons of interocular distance (space between the eyes), one cup of jawline curvature, a precise dash of nose-bridge width." The recipe doesn't look like you. But it describes you so accurately that software can use it to find you in a database — or verify that you're you — without ever needing the painting again.

A painting can be deleted. A recipe can be copied, shared, sold, or matched against other recipes indefinitely. That's the difference. And that's exactly why the law draws a hard line between the two. Previously in this series: That Quick Selfie To Verify Could Be Handing Scammers Your F.

Under Illinois' BIPA — the Biometric Information Privacy Act, which is the toughest biometric privacy law in the U.S. right now — a "biometric identifier" is defined as a scan of face geometry. Not a photo of a face. A scan of its geometry. The word "photographs" is explicitly excluded from BIPA's coverage. But the moment software extracts that mathematical map? The full weight of the law lands. Companies must disclose what they're collecting, why, and how long they'll keep it. They must get written consent. They cannot sell it.

"The instant software extracts a face-geometry template and matches it against a gallery, it has created a biometric identifier, and the full weight of the law lands." — Analysis of the Seventh Circuit ruling, as reported by DiCello Levitt

---

BIPA Requirements for Biometric Templates

So what was Gunnar Optiks actually arguing? That their virtual try-on tool might qualify for a healthcare exemption under BIPA. Illinois law carves out an exception for data collected in a healthcare context — patient records, medical imaging, that kind of thing. Gunnar sells prescription eyewear alongside regular frames. Their argument was essentially: collecting facial geometry to help fit prescription lenses is medically adjacent, so maybe the healthcare exemption applies.

The Seventh Circuit was not convinced. As DiCello Levitt reported, the court observed that the try-on service was "aesthetic, not medical" — and that "better-appearing glasses are not medical treatment." The class action was revived. The case moves forward.

But here's what's more interesting than the legal outcome: the ruling confirms that intent doesn't change the technology. Gunnar wasn't being malicious. They probably genuinely believed they were just helping people pick frames. The software didn't care about their intent. It extracted geometry anyway. And that extraction — not the company's purpose, not the website's design, not whether someone bought prescription or non-prescription lenses — is what triggered the law.

That's the part worth sitting with. A company can mean well and still create regulated biometric data without realizing it.

---

Why People Get This Wrong (And It's Not Their Fault)

Almost everyone assumes that "using your face" in an app means the app is storing a picture of you — maybe in some folder on a server, maybe getting sold to advertisers, maybe being reviewed by a real human somewhere. That's the mental model most of us carry around. And honestly, it makes sense. That's how cameras have always worked. You take a picture. Someone has a picture. Up next: Monroe County Biometric Disclosure Retail Facial Recognition.

But modern facial processing doesn't work that way. As Fora Soft explains, the regulated act under BIPA isn't recording video or capturing an image — it's building a faceprint from that image. The photo is often discarded almost immediately. What remains is the template: a file that doesn't look like a face, doesn't contain pixels, but can still uniquely identify you across any database it's ever matched against.

Here's why that's actually more dangerous, not less. A photo of your face can be cropped, filtered, or simply not matched if lighting is different. A biometric template is built to be resilient. It's designed to find you even when conditions change — different lighting, different angle, five years older. The recipe works even when the painting looks different.

This is exactly where CaraComp focuses — understanding the gap between what facial technology appears to do (show you a preview) and what it's actually doing underneath (building a persistent identity file). That gap is where most people's intuition breaks down, and where the real privacy questions live.

So next time an app says "use your face to find your fit" — for glasses, makeup, hair color, anything — the question to ask yourself is simple: does this app tell me whether it's storing a template, or just a photo? Most don't say. Most people don't think to ask. But knowing the difference between a painting and a recipe? That's the thing that makes you harder to fool.

Template Protection: Locking the Math File Down

Template protection is the umbrella term for the technical steps a company takes to keep a biometric template from being stolen, copied, or reused somewhere it shouldn't be. This usually means encrypting the biometric template both while it sits in storage and while it travels between a phone and a server. Good template protection also limits who inside a company can even touch the raw biometric data — most employees never need to see it, so most employees never get access to it.

Without template protection, a leaked biometric template is a permanent problem, because unlike a password, you cannot reset your face. That's the core reason regulators keep pushing companies toward stronger template protection standards rather than treating a biometric template like any other file on a server.

Template Transformation: Changing the Math Before It's Stored

Template transformation is the step that makes cancelable biometrics possible in the first place. Instead of saving your raw facial measurements straight into a database, a system applies a mathematical function to those measurements first, so the biometric template that actually gets stored is already a distorted version of the original. Good template transformation is repeatable in one direction only — the company can always regenerate the same distorted template from your face, but nobody can run the process backward to rebuild your actual facial geometry from the stored file.

This matters because template transformation is what turns a permanent liability into a replaceable one. If a database holding a transformed biometric template ever leaks, the company can simply pick a new transformation, generate a fresh template, and retire the old one, all without asking anyone to resubmit a fresh photo. That single design choice is a big part of why security researchers keep bringing up template transformation whenever the conversation turns to biometric data breaches.

Cancelable Biometrics: Making a Template Replaceable

Cancelable biometrics solve the "you can't reset your face" problem in a different way. Instead of storing your raw facial geometry, a system using cancelable biometrics runs it through an extra transformation first, so the stored biometric template is intentionally distorted in a repeatable way. If that distorted template ever leaks, the company can throw it out and generate a fresh one from a new transformation, without asking you to rescan your actual face.

Cancelable biometrics are gaining attention because they answer the exact criticism people raise about biometric data in general: passwords can be changed after a breach, and now, with cancelable biometrics, a compromised biometric template can be too. This is one reason security researchers describe cancelable biometrics as a meaningful upgrade over storing a raw, unprotected biometric template.

Biometric Vaulting: A Separate Vault for the Math File

Biometric vaulting takes template protection a step further by physically or logically separating the biometric template from the identity information it's linked to, like your name or account number. Under biometric vaulting, the math file lives in one secured location and your personal details live in another, so a single breach can't hand an attacker both at once. Some systems built around biometric vaulting also use specialized hardware, similar to how a bank vault is a different structure from the teller counter.

The point of biometric vaulting isn't to make the biometric template impossible to steal — nothing is truly unbreakable — it's to make a stolen template useless without the second piece a thief would also need.

Fingerprint Template Basics

A fingerprint template works on the same principle as a facial biometric template, just with a different body part supplying the geometry. Instead of measuring the distance between your eyes, the scanner maps the ridges, valleys, and branching points of your fingerprint, then converts that pattern into a compact fingerprint template. That fingerprint template, not an image of your actual fingerprint, is what most phone unlock systems and workplace time clocks store and compare against.

Just like a facial biometric template, a fingerprint template can be paired with template protection, biometric vaulting, or cancelable biometrics to reduce the damage if a database is ever breached.

Biometric Data: The Bigger Category

It helps to remember that a biometric template is one specific form of biometric data, not the whole category. Biometric data includes the raw scan, the extracted measurements, and the final template, plus anything else a system derives from your physical characteristics. When people worry about "biometric data privacy," they are usually most worried about what happens to the finished biometric template, since that's the piece that can travel, get copied, and get matched against other databases long after the original photo is gone.

Beyond the face and fingerprint examples already covered, the same conversion logic shows up with an iris scan. An iris pattern gets measured, converted into numbers, and stored as a template rather than a picture of your eye, following the same template-first approach as a facial or fingerprint template. Whether the source is a face, a finger, or an iris, the underlying system treats the resulting numbers as the sensitive asset worth protecting, which is exactly why template protection and cancelable biometrics keep coming up across every kind of biometric identity technology, from unlocking a phone to authentication at a border checkpoint.

Liveness checks add another layer worth understanding, because they confirm that the face or finger being scanned belongs to a live person in front of the camera, not a photo or a mask. A liveness check happens before the system ever builds a template, so it's a safeguard against feeding fake source data into the same pipeline that produces a legitimate biometric template. Systems that skip liveness checks are more vulnerable to someone spoofing the authentication step with a printed photo or a recorded video, which is a separate risk from a stolen or leaked template.

None of these protective layers change the core lesson from earlier in this article: a template, whether it comes from a face, a finger, or an iris, is fundamentally different from a photo, and it deserves fundamentally different legal and technical treatment. The digital identity systems built on templates are only as trustworthy as the protections wrapped around the template itself.

It's worth walking through what a biometric template actually looks like on the inside, because the word "template" can make it sound more mysterious than it is. In practice, a biometric template is just a list of numbers — sometimes called a feature vector — where each number represents one measurement the system extracted, like the distance between two facial landmarks or the angle of a particular ridge on a fingerprint. A biometric vector is simply that list of numbers arranged in a fixed order, so two templates can be compared position by position to see how closely they match.

When engineers talk about a feature vector, they mean the specific set of measurements a system chose to extract from a raw sample, before those measurements get bundled into the final biometric template. A face template is one common example: the feature vector might include eye distance, jaw width, and nose-bridge length, all reduced to a short string of numbers that a matching algorithm can compare in a fraction of a second. The sample itself — the photo, fingerprint scan, or iris image — is discarded once the feature vector is extracted, which is exactly why the template, not the sample, becomes the thing worth protecting.

This numbers-first design is also why biometric matching works even when the exact same photo is never taken twice. A face template built from Monday's lighting and a face template built from Friday's lighting will produce slightly different numbers, but a good matching system allows for that natural variation and still recognizes both as the same person. That tolerance for small differences is part of what makes a biometric template useful for everyday identity verification, from unlocking a phone to badging into a secure building.

Disposable templates are a related idea worth knowing about, especially in higher-security settings like border checkpoints or financial institutions. Instead of storing one permanent biometric template for a person, some systems generate disposable templates that are meant to be used once or for a limited window, then discarded and replaced. Disposable templates borrow the same logic as cancelable biometrics — if the stored numbers are only useful for a short time, a leak becomes far less damaging than a leak of a template meant to last forever.

It also helps to separate a biometric template from the physical characteristic it was built from in the first place. Your fingerprint ridges, your iris pattern, and your facial geometry are all physical characteristics — traits your body simply has, whether or not any system ever measures them. A biometric template only exists once software decides to measure a physical characteristic and convert it into numbers, which is exactly the step BIPA and similar laws are built around regulating.

Attacks against biometric systems generally target one of two weak points: the sample being captured, or the template being stored. Spoofing attacks try to fool the sample-capture step, using a printed photo, a mask, or a recorded video to trick the sensor into extracting a feature vector from a fake source. Template-focused attacks instead go after the stored biometric template itself, attempting to steal, reverse-engineer, or replay it, which is exactly why template protection, biometric vaulting, and cancelable biometrics exist as separate, stackable layers of defense.

Identity verification is the broader goal that all of this technology serves, whether the underlying method is a face template, a fingerprint template, or an iris template. In identity verification, a freshly captured sample gets converted into a biometric template and then compared against a stored template to answer one narrow question: does this person match the identity they're claiming? Because identity verification depends entirely on comparing numbers rather than pictures, the quality and protection of the underlying biometric template directly determines how trustworthy the whole identity verification process can be.

Put together, a full biometric identity system is really just a set of features working in sequence: capture a sample, extract a feature vector, build a biometric template, protect that template, and compare it during identity verification. Each of those features exists because an earlier step in the chain could otherwise be attacked or misused. Understanding those features individually — instead of thinking of "the app scanning my face" as one single mysterious action — is what makes it possible to ask smarter questions about any biometric identity technology before handing over your face, your fingerprint, or your iris to it.

What Is Biometric Data Collection, Step by Step

What is biometric data collection, in plain terms? It is the process of capturing a physical characteristic — a face, a fingerprint, an iris, even a voice — and converting it into biometric data a computer can store and compare. Biometric data collection starts the moment a sensor captures a sample, but the sample itself is rarely what gets kept; instead, the system extracts measurements and builds a template. So when someone asks what is biometric data collection, the honest answer is that it's less like taking a photo and more like taking very precise notes about your body, then throwing away the photo and keeping the notes.

Biometric data collection almost always follows the same order: capture, measure, convert, store. First a sensor captures a raw sample of your face, finger, or eye. Then software measures specific points on that sample. Next it converts those measurements into a compact biometric template. Finally, the system stores that template — and, if it is doing things responsibly, discards the raw sample and protects the stored data with encryption and limited access.

Personal Data and Biometric Data: Where They Overlap

Biometric data is a special kind of personal data, because it can identify you and it usually cannot be changed if it is exposed. Most personal data, like your address or your phone number, can be updated if it leaks. Biometric data drawn from your face or fingerprint cannot be swapped out the same way, which is exactly why laws like BIPA treat biometric data as sensitive data that deserves stricter rules than ordinary personal data. Some privacy frameworks even place biometric data in a special category alongside health records and other information that carries a higher risk if it is mishandled.

This distinction matters for anyone trying to understand their own risk. When a company collects your name and email, a breach is annoying but fixable — you can change an email address. When a company's biometric data collection process is breached, the individuals affected cannot simply issue themselves a new face or a new fingerprint, which is why access to raw biometric data should be limited to as few systems and employees as possible.

Biometric Authentication vs. Biometric Identification

Biometric authentication and biometric identification both rely on biometric data, but they answer different questions. Biometric authentication asks "does this biometric data match the one specific person it claims to belong to?" — like unlocking your own phone with your own face. Biometric identification asks a broader question: "who, among everyone in a database, does this biometric data belong to?" That second use case involves comparing one sample against many stored templates, which raises the stakes on how that biometric data is collected, stored, and secured.

Most everyday biometric authentication, like a fingerprint sensor on a laptop, keeps the biometric template stored locally on the device rather than sending it to a company's server, which limits the risk if the device itself isn't compromised. Biometric identification systems, on the other hand, often centralize biometric data collection across large groups of people, which is part of why biometric authentication and biometric identification carry different levels of risk even though both start with the same basic biometric data collection process.

Data Collection Risks and Practical Access Questions

Every biometric data collection system creates some level of risk, because biometric data cannot be reset the way a password can. The main risks include unauthorized access to stored biometric data, breaches that expose raw templates rather than protected ones, and biometric data being reused for a purpose the individual never agreed to. Understanding these risks is part of understanding what is biometric data collection in the first place — the technology and the risk are inseparable.

Before agreeing to any biometric data collection, it helps to ask a few practical questions. Who has access to this biometric data once it is collected? Is the biometric data being stored as a raw sample or as a protected template? How long is the biometric data kept, and can individuals ask for it to be deleted? Answering those questions is the most direct way to judge whether a company's biometric data collection practices are trustworthy, and it turns an abstract privacy concern into something individuals can actually evaluate before handing over their face, finger, or voice.

Security teams that work with biometric data collection systems typically separate access into tiers, so that only a small group can reach raw biometric data while a larger group can only trigger a comparison result like "match" or "no match." This kind of layered access is a practical security measure, not just a legal checkbox, because every additional person with access to raw biometric data is another potential point of failure. Limiting access this way also makes it easier to audit exactly who touched sensitive biometric data and when, which matters if a breach ever needs to be investigated.

Individuals also have a role to play in reducing their own exposure, even though most of the responsibility sits with the company doing the collecting. Reading a consent notice before agreeing to biometric data collection, asking whether a raw sample or a template is being stored, and asking how long biometric data will be retained are all reasonable steps that put a little bit of the access decision back in the hands of the person whose face or fingerprint is on the line.