Biometric Privacy Law: BIPA, Data Protection & State Rules

Spain's data protection authority just handed a digital identity company a €950,000 fine, and broke it into three separate penalties like a prosecutor reading counts at arraignment. That level of surgical enforcement isn't a warning shot. It's a template.

Here's my prediction: over the next 12-18 months, the collision between Illinois BIPA momentum, Spain's AEPD precedent, and the EU's incoming Digital Omnibus package will force a hard divide in the professional investigation world. Tools that can document consent, demonstrate limited purpose, and produce clean audit trails will become indispensable court assets. Everything else, the tools that hoover up faces without strict controls, default users into data-sharing, or can't answer a judge's basic question about where the templates went, will quietly disappear from serious casework. Most investigators don't see this coming. They should.

Biometric Privacy News: Spain's Fine as Enforcement Model

PPC Land reports that Spain's Agencia Española de Protección de Datos (AEPD) structured its ruling against Yoti in three distinct charges: €500,000 for processing biometric data without a lawful basis under GDPR Article 9, €200,000 for collecting consent through pre-ticked checkboxes (which the regulator deemed invalid), and €250,000 for retaining personal data beyond what the processing purpose required. The case file reference is EXP202317887, signed by AEPD President Lorenzo Cotino Hueso.

What's important here isn't the total, it's the itemization. Regulators aren't just asking "did you collect biometric data?" They're auditing three separate questions simultaneously: Was the legal basis solid? Was the consent genuinely informed and freely given? Did you delete the data when you were done with it? That's a fundamentally different enforcement posture than anything we've seen before. And it maps almost perfectly onto the kinds of gaps that professional investigation tools, built for speed, not compliance paperwork, tend to carry. This article is part of a series, start with Stress Test Facial Comparison Method Against Deepf.

Illinois Enforcement: Smart Biometric Data Definition

Some people looked at the drop in BIPA settlement totals, from $206 million in 2024 to $136.6 million in 2025, according to The National Law Review's 2025 biometric privacy litigation reviewand exhaled. Mistake. That 34% decline followed 2024 BIPA amendments that tightened the definition of actionable harm, which filtered out the weakest cases. What survived was more targeted, and considerably more dangerous.

The ACLU of Illinois celebrated a landmark settlement that required a major facial recognition company to comply with BIPA, not just pay a fine and move on, but structurally change how it handles biometric data in Illinois going forward. That's a different kind of win. It sets a behavioral precedent, not just a financial one. The investigators and agencies who were customers of that tool now have to ask: did my workflows inherit the compliance problems? Do my case files document consent in a way that holds up if someone pulls the thread?

The litigation targets are also shifting. Plaintiffs' attorneys started with employers using biometric timeclocks, easy targets, lots of employees, clear violations. Now they're moving upstream toward the tools themselves. That's the tell. When enforcement starts hitting the software layer rather than the end-user layer, everyone in the professional investigation chain needs to pay attention.

"Biometric data is only considered 'special category' data where it is processed for the purpose of uniquely identifying a person." European Commission Digital Omnibus proposal language, as reported by Inside Privacy

The EU Digital Omnibus: Enforcement Standards for Investigators

On November 19, 2025, the European Commission published its Digital Omnibus Regulation and AI Omnibus proposals. Kennedys Law LLP's analysis and reporting from Inside Privacy both flag the same critical distinction buried in the proposals: one-to-one biometric verification (comparing a face against a specific known identity) is being treated differently from one-to-many identification (scanning a face against a database to find who someone is). Previously in this series: Biometric Privacy 2026 Compliance Split Investigat.

That distinction, verification vs. identification, is about to become the most consequential line in professional investigation technology. Running facial comparison against your own case files, on subjects you have a documented reason to investigate, looks completely different under this framework than querying an open-ended database to figure out who an unknown person is. The first is defensible. The second is where regulators are concentrating fire.

Nobody should be surprised by this. Financier Worldwide's overview of GDPR enforcement on AI governance makes clear that EU regulators have been building toward this distinction for years. The Digital Omnibus just formalized it. And with the AI Act's high-risk system rules applying from August 2026, the clock is now genuinely running.

(Worth noting: some commentators are pointing to the Digital Omnibus proposals as evidence that Europe is "softening" on AI regulation. That's a selective reading. Yes, the proposals expand "legitimate interest" grounds for training biometric models. But training a model and deploying it against non-consenting third parties are two entirely different acts under the framework. The softening, such as it is, doesn't extend to operational use in casework.)

The Investigators Who Future-Proof Now Won't Be Scrambling Later

Here's the thing about regulatory pressure: it rarely announces itself with a countdown timer. The Spain fine happened. The Illinois settlements are happening. The EU Digital Omnibus timeline is published and specific. The investigators who are still running facial comparisons through tools they can't explain to a regulator, tools with no consent documentation, no purpose logs, no clear data deletion policy, are building a problem they don't know they have yet. Up next: Eu Digital Omnibus Biometric Evidence Standards.

The professional investigation community needs to treat biometric privacy compliance the same way it treats chain of custody for physical evidence. You document it at every step, not because you expect to be challenged immediately, but because when you are challenged, in court, in discovery, by a regulator, the documentation is what makes the evidence usable. Understanding how facial recognition biometrics actually work within a privacy-first framework isn't optional reading anymore. It's operational prerequisite.

Tools built around this model, facial comparison against your own case files, with documented consent or legal basis, clear purpose limitation, and audit-ready records, are positioned to become more valuable as enforcement tightens, not less. The market will split. Court-ready platforms will command premium positioning. Everything else will get quietly dropped when a firm's legal department finally reads the fine print on what happened in Madrid.

The uncomfortable question sitting underneath all of this: if a regulator or opposing counsel asked you tomorrow to produce a complete audit trail for every facial comparison you've run in the last 18 months, who initiated it, what legal basis authorized it, where the biometric template is stored right now, and when it will be deleted, how many of your current workflows could actually answer that? Because in Spain last month, the answer to those questions was worth €950,000. And the AEPD is not the last regulator who's going to ask them.

Biometric Law: What Counts as Regulated Data

Biometric law generally covers any measurement of a physical or behavioral trait that can identify a specific person, fingerprints, iris scans, voiceprints, and facial geometry all qualify. Under most frameworks, including the Illinois Biometric Information Privacy Act (BIPA) and GDPR, this category of data gets special protection precisely because it can't be changed the way a password can. Once a faceprint or fingerprint template is exposed, the person it belongs to cannot simply reset it, which is why regulators treat mishandling of biometric identifiers as a more serious violation than an ordinary data breach.

Information Privacy and Why Biometric Information Is Different

Information privacy as a broad legal concept covers how any personal information is collected, used, and shared. Biometric information sits at the sharper end of that spectrum because it is permanent, unique, and often collected without the person's direct involvement, a photo pulled from a database, for instance, rather than a form someone fills out. That's the reason biometric information privacy act statutes single out this category for stricter consent, storage, and disclosure rules than general information privacy law requires.

BIPA Basics: The Illinois Biometric Information Privacy Act (BIPA)

The Illinois Biometric Information Privacy Act (BIPA), passed in 2008, was one of the first laws in the country to give individuals a private right to sue over biometric mishandling rather than relying only on a regulator to act. BIPA requires written consent before collection, a public retention schedule, and a firm deadline for destruction once the purpose for collecting the data has been satisfied. That structure, consent first, purpose-limited use, then mandatory deletion, is now the template other states and the EU's Digital Omnibus proposals are visibly borrowing from.

Storage Rules: How Long Biometric Templates Can Sit

Storage is one of the three pillars regulators keep coming back to, alongside consent and purpose. BIPA requires companies to publish a retention schedule and destroy biometric identifiers within three years of the last interaction with the subject, whichever comes first, unless a valid business purpose or law requires longer storage. Spain's AEPD fine against Yoti shows the same principle applied under GDPR: storage beyond what a stated purpose requires is treated as its own separate violation, not a footnote to the consent problem.

How Investigators Protect Themselves and Their Subjects

To protect both the people whose biometric data they handle and their own casework from later challenge, investigators need three things in writing: documented consent or a clear legal basis, a stated purpose that the biometric comparison actually served, and a retention and deletion schedule that gets followed, not just written down. Tools that log all three automatically make it far easier to protect a case file against a defense challenge or a regulator's request months or years after the fact. Skipping any one of these protections is exactly what turned three separate violations into a single €950,000 fine in Spain.

None of this is theoretical anymore. Biometric law is moving from a niche compliance concern into a standard operating requirement for anyone running facial comparison professionally, and the biometric information privacy act model, written consent, stated purpose, bounded storage, is becoming the baseline other jurisdictions measure themselves against.

Private investigators, insurance fraud examiners, and corporate security teams all handle biometric identifiers routinely, often without realizing that the same rules protecting employees under BIPA can extend to how they build and store case files. Written consent isn't just a formality; it's the document that determines whether a facial comparison holds up if a subject later disputes how their image was used. Treating consent, purpose, and storage as three separate checkboxes, the same three the AEPD itemized against Yoti, is the simplest way to stay on the right side of both Illinois law and GDPR.

Data privacy and biometric privacy overlap but aren't identical. General data privacy law worries about names, addresses, and account numbers, information that can be changed if it leaks. Biometric privacy deals with identifiers a person is born with and can never reissue, which is exactly why biometric systems face tighter storage limits and stricter consent standards than ordinary databases handling personal information.

State Biometric Laws Beyond Illinois

Illinois isn't the only state writing rules for biometric data anymore. Texas and Washington both passed their own state biometric statutes years ago, and a growing number of other legislatures are drafting privacy legislation that borrows the same consent-purpose-retention structure BIPA established. BCLP has been tracking enacted biometric privacy laws across the country, and the pattern is consistent: each new statute treats biometric information as a category that needs its own biometrics regulation, separate from ordinary consumer data protection rules. For any investigator or business operating across state lines, that means the safest compliance posture isn't "meet the strictest state", it's building one workflow that satisfies every state biometric privacy act on the books at once.

This matters for practical reasons, not just legal ones. A security team that builds its consent forms, retention schedule, and data protection practices around BIPA's requirements will likely already satisfy most other state biometric privacy laws, since they share the same basic skeleton: written notice, a stated purpose, and a deletion deadline. Skipping that step and relying on a generic privacy policy is a common source of consumer complaints and, increasingly, litigation. Technology teams building facial comparison or matching tools should treat state-level biometric information rules as a floor, not a ceiling, especially as more states introduce their own privacy act language modeled on BIPA and GDPR.

Security is the practical thread that connects all of these rules, data security for how biometric templates are stored, security of the consent records themselves, and security around who inside an organization can access a match result. A biometric identifier that sits on an unencrypted server is a security failure independent of whatever consent language a company used to collect it. Investigators auditing their own tools should ask their vendors direct security questions: where is biometric information stored, who has access, and what technology enforces the deletion schedule once the retention period ends. Those three questions cover most of what regulators in Spain, Illinois, and the EU are already asking, and they're a reasonable starting checklist for anyone who hasn't run this kind of internal audit before.

The broader trend across every biometric privacy statute, BIPA, GDPR, and the newer state biometric laws following behind them, is an increase in how much documentation businesses are expected to keep on hand, not less. Regulators aren't loosening consent standards; they're asking for more detail about how biometric data moves through a system from collection to deletion. That increase in documentation burden is exactly why the investigators who build clean audit trails now, rather than after a regulator asks, will be the ones still operating without disruption eighteen months from now.