Biometric Privacy Law: Why WiFi Body Tracking Slips Through

Here's the thing nobody told you this week: your home WiFi router may already know it's you walking into the room — not because it recognized your face, not because you typed a password, but because your body moves through radio waves in a way that's uniquely yours. Researchers just proved it works. And there is currently no law in the United States that specifically says a company can't use that signal to track you.

WiFi Identity Detection: What Researchers Proved

Scientists at the Karlsruhe Institute of Technology in Germany didn't just theorize about this. They tested it. According to reporting from Cybernews, the research demonstrated that a standard WiFi router can identify individuals based entirely on how their bodies interact with wireless signals. Walk across a room. Sit down. Stand up. The router reads the tiny changes your body creates in the radio waves — and those changes are as unique as a fingerprint.

The part that makes this more than a cool science experiment: it works even if you've left your phone in the car. You don't need a device on you. The router is reading you, not your gadgets.

ScienceDaily reported that the Karlsruhe Institute research clocked accuracy at essentially 100% in identifying individuals this way. That's not "pretty good." That's better than a lot of facial recognition systems that cities have spent millions deploying on street cameras.

Here's where it gets technically interesting — and then immediately worrying. Routers are constantly sending and receiving small data packets called beamforming feedback information. Think of it as the router and your device constantly whispering to each other about the best way to maintain signal. According to Digital Journal, this feedback data travels unencrypted — meaning anyone within range can potentially read it. Add an AI model trained to map how a specific person's body disrupts those signals, and you have an identity system with no obvious "on" switch and no obvious "off" switch. This article is part of a series — start with Only 0 1 Of People Can Spot A Deepfake Heres The 3 Step Meth.

The Legal Gap Is the Real Story

States like Illinois and Texas have strong laws protecting biometric data — that's the legal term for unique physical identifiers like fingerprints, face scans, iris patterns, and voiceprints. Companies that collect biometric data without consent can face serious consequences in those states. But WiFi radio signatures don't legally count as biometric data. Not yet, anyway.

That gap is not accidental. It's just that lawmakers wrote those privacy laws before anyone proved a router could do what this research just proved it can do. The law is behind reality, as it almost always is.

What a Biometric Privacy Law Actually Covers

A biometric privacy law is a statute that limits how companies collect, store, and share biometric identifiers — things like a fingerprint, a face scan, an iris pattern, or a voiceprint. The strongest biometric privacy laws in the country generally require a private entity to get your written consent before collecting biometric data at all. That single requirement — written consent before collection — is the backbone of nearly every biometric privacy law on the books today.

Biometric Identifier vs. Biometric Information

It helps to know the difference between a biometric identifier and biometric information, because most biometric privacy laws treat them almost interchangeably. A biometric identifier is the raw physical measurement itself — your fingerprint, your iris pattern, your face geometry. Biometric information is any data generated from that identifier, even after it's been converted into a code or template a computer can process. Under most biometric privacy laws, both categories trigger the same consent and disclosure obligations for any private entity that touches them.

The Illinois Biometric Information Privacy Act (BIPA)

The most well-known biometric privacy law in the United States is the Illinois Biometric Information Privacy Act, usually just called BIPA. BIPA requires a private entity to get written consent before collecting a person's biometric identifier or biometric data, tell people why the data is being collected and how long it will be kept, and follow strict rules for storing and eventually destroying that information. BIPA has become the reference point that other states measure their own biometric privacy laws against.

Biometric Data Compliance for Everyday Businesses

Compliance with biometric privacy law isn't just a concern for giant tech companies. Any private entity that uses fingerprint clocks for employee timekeeping, face-scanning entry systems, or voiceprint verification for customer service needs to think about biometric data compliance. Getting compliance right generally means securing written consent up front, limiting how long biometric information is stored, and being transparent about what the biometric data is used for.

Why Privacy Laws Haven't Caught Up to WiFi Signals

Every biometric privacy law on the books today was written with a specific list of biometric identifiers in mind — fingerprints, face geometry, iris scans, voiceprints. None of the major biometric privacy laws currently list a WiFi radio signature as biometric data, which means the written consent and compliance rules that would normally apply to a private entity collecting biometric information simply don't attach here. Closing that gap would likely require lawmakers to update the definition of biometric identifier itself.

"Ordinary WiFi networks could become a powerful form of invisible surveillance using standard wireless signals and artificial intelligence, while simultaneously age and identity verification are no longer restricted to financial systems but routinely being incorporated into day-to-day digital life." — Security research analysis, State of Surveillance

The practical implication? An advertising company could install WiFi equipment in a shopping mall, train it to identify individual shoppers based on how they walk past routers, and build a profile of your movements over time — without ever capturing your face, without ever asking for your name, and without technically violating a single biometric privacy law. Because your WiFi radio signature isn't legally "you" yet.

Researchers are already pushing back. According to State of Surveillance, privacy advocates are calling for protections to be built into the IEEE 802.11bf standard — which is basically the official technical rulebook for how WiFi works. That standard was formalized in September 2025, and it actively enables routers to detect presence, motion, and gestures as core features. The window to bake privacy protections into the standard before widespread hardware deployment is, to put it plainly, not wide open.

Face Detection Powers Expanding Identity Checkpoints

The WiFi story would be interesting on its own. But it lands during a week when the broader pattern of identity expansion is impossible to ignore. This isn't one technology doing one thing. It's everything, everywhere, quietly asking: Who are you?

Twenty-five US states now require you to verify your age — by uploading your driver's license or scanning your face — before you can access certain websites, according to State of Surveillance. The UK has deployed 50 facial recognition vans to enforce age checks on streets. The EU's Digital Identity Wallet — originally designed for government services — is launching in 2026 and is increasingly being positioned as the backbone of age verification across apps and platforms. Previously in this series: Online Identity Verification Vpn Blocking Prediction Markets.

Even the concert world got pulled in this week. The rock band Thirty Seconds to Mars announced they're using eye-scanning technology to grant fans access to special live concert tickets. (Yes, really. You scan your iris to prove you're you, to buy a ticket, to stand in a field and listen to music.)

The Coffee Shop Already Has the Infrastructure

Here's the thing that should sit with you a little. The coffee shop you go to every Tuesday morning almost certainly has a WiFi router. That router is already doing the beamforming process described in this research — it's just standard hardware doing standard things. The shop didn't buy it to track you. But if someone trained an AI model on that router's signal data, they could know exactly when you arrived, exactly where you sat, and whether it was you or a stranger who came in instead.

They just didn't know what the router could do. Yet.

The word "yet" is doing a lot of work in this story. Identity technology and the businesses that want to use it are moving genuinely fast. Shufti Pro's 2026 identity verification trends analysis confirms that AI-driven identity checks are expanding rapidly into everyday digital life — not just financial services, but retail, entertainment, and general internet access. The systems are being built. The checkpoints are multiplying. And public understanding of what data is actually being collected is, to put it generously, lagging.

This is the part that matters most: when a system verifies who you are, you usually know it's happening. You hold up your ID. You look at a camera. You type your password. But WiFi identification happens with no interaction from you whatsoever. No prompt. No consent screen. No moment where you even think "someone is checking who I am right now." Up next: Sweden Live Facial Recognition Police Law Enforcement Safegu.

If you've ever wondered whether a photo or a profile is really who it claims to be — that quiet, nagging suspicion that something online might not be authentic — you're already asking exactly the right question. That instinct is worth keeping sharp. The next step is extending it to physical spaces, not just screens. Ask who the WiFi belongs to. Ask what the terms of service say about the data collected in the app you just age-verified into. These aren't paranoid questions anymore. They're just practical ones.

The one concrete thing to watch for right now: when you see an app, a website, or a physical location asking you to verify your identity in any form, check whether there's a privacy policy and whether it mentions what happens to that verification data afterward. Most won't tell you clearly. That absence of information is itself information.

The IEEE 802.11bf WiFi standard — the official technical rulebook that makes router-based identification a mainstream capability — was finalized in September 2025. The hardware running that standard is already being manufactured. Somewhere between the research lab in Karlsruhe and the router in your living room, a decision will get made about whether your body's unique effect on radio waves counts as personal data worth protecting. That decision is being made right now, mostly by engineers and lawyers in rooms you're not in.

The least alarming version of this story ends with your WiFi just knowing you're home so it can warm up the thermostat. The more interesting question is: who else gets to see that it knows?

It's worth stepping back and asking what a private entity actually has to do to comply with a typical biometric privacy law once a technology like WiFi body sensing gets formally classified as biometric. In most states with a biometric privacy law, the private entity would need to post a public policy explaining its retention schedule, obtain written consent before the first collection, and avoid selling or profiting from biometric data outright. None of that is exotic. Companies already handling fingerprints or face scans under BIPA follow these steps daily.

The compliance burden also isn't limited to giant corporations. A small gym that uses a fingerprint scanner to check members in, or a local clinic that uses voiceprint verification for scheduling calls, is a private entity under most biometric privacy laws just as much as a national retailer is. Compliance means the same rules apply regardless of company size: written consent, a retention and destruction policy, and no sale of biometric information to third parties.

This is exactly why the WiFi radio-signature gap matters so much. If lawmakers eventually add WiFi-based body identification to the list of recognized biometric identifiers, every private entity running a router capable of this kind of detection would suddenly face the same compliance obligations that apply to biometric data today. Until that happens, the coffee shop, the mall, and the office lobby can collect this information without triggering any of the written consent requirements that already protect fingerprints and face scans.

Illinois remains the state most people point to first, but it isn't the only place with a biometric privacy law on the books. Texas and Washington also regulate biometric identifiers, and several other states have introduced their own versions in recent years. Each version defines biometric information a little differently, which is part of why closing the WiFi loophole isn't as simple as applying one existing law nationwide — lawmakers in each state would need to update their own definitions separately.

For everyday readers, the practical takeaway is simpler than the legal detail: biometric privacy laws exist to make sure you know when your body is being measured and turned into data, and that you get a say before it happens. WiFi body sensing currently sits outside that protection. Knowing that gap exists is the first step toward asking the right questions the next time a business installs new hardware nearby.