United States
Illinois Biometric Information Privacy Act (BIPA), California Consumer Privacy Act (CCPA), and various state biometric laws
The United States does not have a single federal biometric privacy law. Instead, a patchwork of state laws governs facial recognition and biometric data. Illinois BIPA is the strongest, requiring written consent before collecting biometric identifiers and granting individuals a private right of action. California's CCPA and CPRA give residents the right to know, delete, and opt out of the sale of personal information including biometric data. Texas, Washington, and other states also have biometric-specific statutes.
Key Provisions
- BIPA requires informed written consent before collecting biometric identifiers including face geometry
- CCPA/CPRA classify biometric information as sensitive personal information with enhanced protections
- Companies must provide a retention schedule and guidelines for destroying biometric data under BIPA
- Texas BITH Act prohibits capture of biometric identifiers for commercial purposes without consent
- Washington state biometric law requires notice and consent but no private right of action
- Several cities including San Francisco, Boston, and Portland have banned government use of facial recognition
Your Biometric Rights
- Right to informed consent before biometric data collection (BIPA)
- Right to know what biometric data is collected (CCPA)
- Right to delete biometric data (CCPA)
- Right to opt out of sale/sharing of biometric data (CCPA)
- Private right of action for BIPA violations ($1,000–$5,000 per violation)
Penalties for Non-Compliance
BIPA: $1,000 per negligent violation, $5,000 per intentional/reckless violation (private right of action). CCPA: $2,500 per violation, $7,500 per intentional violation (AG enforcement). Major BIPA settlements include Facebook ($650M) and Google ($100M).
Our Removal Process
We submit opt-out requests under BIPA, CCPA, and applicable state laws. For Illinois residents, BIPA's private right of action provides the strongest enforcement mechanism. We file deletion requests with each database operator and track compliance.
Get Protected