Key points

• Retailers are adopting facial recognition for loss prevention, virtual try-on, age estimation, voice ordering and employee time clocks. Each can involve regulated biometric data.
• The Illinois Biometric Information Privacy Act (BIPA) remains the most litigated statute, because it gives individuals a private right to sue. Texas and Washington have their own biometric laws, enforced by the state attorney general.
• Comprehensive state privacy laws treat biometric data used to identify a person as sensitive data, which generally requires opt-in consent.
• In Europe, biometric data used for identification is a special category under the GDPR, and the EU AI Act restricts certain biometric uses.
• Notice, written consent, retention limits and vendor contracts are the core controls. Technology that only analyzes a face without identifying it is not always outside the rules.

The technology is already in the store

Retail technology teams are testing and deploying tools that rely on faces, voices, fingerprints and gait. Loss prevention systems compare shoppers against watchlists. Virtual try-on features map a customer’s face for cosmetics or eyewear. Self-checkout kiosks estimate age. Call centers and voice assistants authenticate by voiceprint. Employee systems use fingerprints or face scans to clock in. Each use has a different risk profile, but they share one feature: biometric data cannot be changed if it is compromised, and lawmakers treat it accordingly.

Illinois and the private right of action

BIPA, enacted in 2008, requires private entities to give notice and obtain a written release before collecting biometric identifiers or information, to publish a retention and destruction policy, and not to sell or profit from the data. Its distinctive feature is that individuals can sue for statutory damages. Illinois courts have held that each collection can be a separate violation and that claims accrue without the need to show actual harm, which produced a wave of class actions and some very large settlements.

In 2024 the Illinois legislature amended the statute to provide that repeated collection of the same biometric identifier from the same person using the same method is a single violation for damages purposes, and to allow electronic signatures to satisfy the written release requirement. Courts continue to work through how the amendment applies to older claims. The exposure has been reduced, but not removed.

Other US laws

Texas and Washington regulate biometric identifiers through statutes that are enforced by the state attorney general rather than by private plaintiffs. Texas has pursued significant enforcement under its law. A growing number of comprehensive state privacy laws classify biometric data processed to identify a person as sensitive data that requires consent, and some give the attorney general rulemaking or enforcement powers. Several cities have adopted rules specific to commercial use of facial recognition, including notice requirements for businesses.

The Federal Trade Commission has also warned that misusing biometric information, or making unsubstantiated claims about biometric technology, can be an unfair or deceptive practice. It has taken action where companies failed to assess foreseeable harms or to test accuracy and bias.

Europe and the United Kingdom

Under the GDPR, biometric data processed to uniquely identify a person is special category data, and processing is prohibited unless an exception applies, typically explicit consent. Retailers cannot easily rely on legitimate interests for facial recognition in stores. Data protection authorities in several countries have criticized store-wide facial recognition as disproportionate, and the UK Information Commissioner has set out expectations for proportionality, accuracy and transparency in live facial recognition by private operators.

The EU AI Act adds a layer. It prohibits certain biometric practices, including the untargeted scraping of facial images from the internet or CCTV to build recognition databases and the inference of emotions in workplaces and schools, and it classifies many other biometric identification systems as high risk. Retailers using emotion or sentiment analysis in stores should review their position carefully.

What is and is not biometric data

Not every face-based tool collects regulated data. A system that estimates age or counts shoppers without creating a template or identifying an individual may fall outside some statutes, although not all, and regulators have taken different views. The safest course is to ask what the vendor stores, whether a template is created, whether it is retained and whether it can be linked to a person. Vendor marketing statements are a poor guide, and contractual representations should be tested.

Practical controls

Provide clear notice at the point of collection, in store and online, that describes what is collected, why and for how long. Obtain written or electronic consent where a statute requires it, and offer an alternative for those who decline, such as a manual age check or a different time clock method for employees.

Set a retention schedule and delete data when the purpose is fulfilled or within the period the statute requires. Restrict access, encrypt templates and keep them separate from other customer data.

Contract carefully with technology vendors. Require that they process data only on your instructions, that they not use it to train their models for other customers without agreement, and that they comply with the relevant statutes. Seek indemnities and confirm insurance coverage, since some policies exclude biometric claims.

Carry out a documented risk assessment before deployment. Many state laws and the GDPR require one in any event, and it is the best evidence of a thoughtful program.

Employees and franchisees

Employee biometric systems account for a large share of BIPA claims. Employers should obtain written releases at onboarding, and should check that franchisees and staffing agencies that operate time clocks have done the same. Where a collective bargaining agreement applies, check how it interacts with the statute.

Looking ahead

More states are expected to adopt biometric or sensitive data rules, and regulators are expanding their attention to automated decision-making. Retailers piloting new in-store tools should build compliance into the design and avoid a rollout that must be reversed.

Tomás Ellery-Vance in Washington, D.C. and Daria Kowalczyk in Chicago advise retailers on biometric privacy, in-store technology and related class action defense.