Biometric Privacy Laws by State (2026)

The Texas cap is the biggest number here, but only the Attorney General can collect it. The Illinois figures are smaller per violation, yet any affected person can sue for them, which is why most biometric lawsuits are filed there.

Illinois stands alone in the first bar. For most states the strongest rule is now a broad consumer privacy law: 17 have one in effect and 4 more have signed one. 25 jurisdictions still have neither kind of law.

2025 was the peak, with 8 laws taking effect in one year. The 2027 and 2028 bars are laws already signed, so plan for them now.

The count of broad privacy laws covering biometrics rose from 1 state in 2020 to 19 in 2026, and it reaches 23 once the signed laws kick in. A vendor that ignores biometric consent is running out of places to hide.

Both record Texas settlements came from state enforcement, not private suits. Note that the Google figure also covers location and incognito claims, so it is not a pure biometric number.

State laws written specifically for biometric data, compared (2026)

Source: Illinois General Assembly (copy of compiled statute hosted by Akin Gump), Biometric Information Privacy Act, 740 ILCS 14 (statute text); King & Spalding, Illinois BIPA Reform Takes Effect; Texas Legislature (via Texas Public Law), Tex. Bus. & Com. Code § 503.001, Capture or Use of Biometric Identifier; Washington State Legislature, RCW 19.375, Biometric Identifiers; Washington State Legislature, RCW 19.373, Washington My Health My Data Act; Washington State Office of the Attorney General, Protecting Washingtonians' Personal Health Data and Privacy (My Health My Data Act FAQ); Colorado General Assembly, HB24-1130, Privacy of Biometric Identifiers & Data; Colorado General Assembly (via Colorado Public Law), C.R.S. § 6-1-1303, Colorado Privacy Act definitions; International Association of Privacy Professionals (IAPP), US State Comprehensive Privacy Laws Report: 2024 Legislative Session. Download as image

Signed comprehensive state privacy laws that treat biometric data as sensitive (23 states)

Source: International Association of Privacy Professionals (IAPP), US State Privacy Legislation Tracker 2026 (map); International Association of Privacy Professionals (IAPP), US State Privacy Legislation Tracker 2026: Comprehensive Consumer Privacy Bills (chart); International Association of Privacy Professionals (IAPP), US State Comprehensive Privacy Laws Report: 2024 Legislative Session; Texas Legislature (via Texas Public Law), Tex. Bus. & Com. Code § 541.001, Texas Data Privacy and Security Act definitions; Colorado General Assembly (via Colorado Public Law), C.R.S. § 6-1-1303, Colorado Privacy Act definitions; Troutman Pepper Locke, Vermont Brings the Total to 23 State Comprehensive Privacy Laws; Mayer Brown, Vermont Enacts Comprehensive Consumer Privacy Law; Mayer Brown, Alabama Enacts Comprehensive Consumer Data Privacy Law; Davis Wright Tremaine, Louisiana Data Privacy Act (SB 386); Troutman Pepper Locke, Oklahoma Enacts Consumer Data Privacy Law; Oklahoma House of Representatives, SB546 data privacy protections signed into law. Download as image

Strongest biometric privacy law in the state by state

• 1Biometric-specific law with a private right of action
• 3Biometric-specific law enforced by the state
• 17Comprehensive privacy law in effect: biometric data is sensitive
• 4Comprehensive law signed, not yet in effect: biometric data is sensitive
• 1Narrow privacy law (very large companies only)
• 25No biometric-specific or comprehensive privacy law

Which states have biometric privacy laws?

Think of the map in three tiers. The top tier is states with a law written just for biometric data: Illinois, Texas, Washington and Colorado. Illinois is the only one where you, the person whose face was scanned, can file the lawsuit yourself.

The middle tier is the general consumer privacy laws. 23 states have signed one, and every one of them labels biometric data as sensitive. In practice that usually means a company needs your consent before it processes a fingerprint or face template. Four of those laws, in Oklahoma, Louisiana, Alabama and Vermont, take effect in 2027 or 2028.

The bottom tier is everyone else. 25 jurisdictions, including New York, Pennsylvania and DC, have neither a biometric-specific law nor a broad consumer privacy law. That doesn't make biometric data a free-for-all there. Employment, school and breach notification laws can still apply, and a business that serves customers in Illinois or Texas is bound by those states' rules no matter where its office sits.

What counts as biometric data?

Biometric data is a measurement of your body that can identify you. The usual list is fingerprints, face geometry, retina or iris scans, voiceprints and hand geometry. A plain photo or a voice recording on its own usually isn't covered. The trouble starts when software turns that photo into a face template or that recording into a voiceprint it can match later.

That line matters more than it sounds. A video call app that only records is one thing. The same app with a feature that recognizes speakers by voice is collecting biometric data, and the consent rules switch on. Many businesses cross that line when a vendor ships a new feature, without anyone on their side making a decision.

So the question to ask a vendor is not just "do you collect biometrics?" Ask whether any feature creates a template, a faceprint or a voiceprint, even as a background step for fraud checks or login.

Why is Illinois BIPA such a big deal?

BIPA stands apart for a couple of reasons. First, it demands written notice and a written release before collection. A line buried in a privacy policy rarely meets that bar. Since 2024 an electronic signature can count, but the person still has to sign a release. Second, it lets people sue directly for $1,000 per negligent violation or $5,000 per intentional or reckless one, or actual damages if those are higher.

Picture a warehouse where every worker clocks in with a finger scan and never signed a release. Even after the August 2, 2024 amendment, which limits recovery to one award per person for repeated scans by the same method, that is still at least one claim per worker. Multiply the per-violation amount by a full payroll and the exposure gets serious fast. A small business can face a demand bigger than its annual profit over a time clock it bought off the shelf.

BIPA also has a hard destruction rule. Data must be destroyed once its purpose is met or 3 years after the person's last interaction with the company, whichever comes first. A former employee's fingerprint template sitting on a vendor's server years later is a live risk.

How do Texas, Washington and Colorado differ?

Texas requires a business to tell you and get your consent before capturing a biometric identifier, and to destroy it within 1 year after the purpose expires. Only the Attorney General can sue, but the penalty runs up to $25,000 per violation. Texas has used that power: Meta settled for $1.4 billion in July 2024, and Google finalized a $1.375 billion settlement in October 2025 that covered biometric, location and incognito claims.

Washington's biometric law requires notice, consent or a way to block later commercial use before a business enrolls your biometric data for a commercial purpose. Only the Attorney General enforces it. Separately, its My Health My Data Act treats biometric data as consumer health data, and that law does allow private lawsuits.

Colorado folded biometric rules into its privacy act. Businesses need a written retention schedule and deletion guidelines, and employers face limits on why they can ask staff to consent.

The practical takeaway is that a missing private lawsuit right doesn't mean low risk. Illinois exposure comes from many small claims. Texas exposure comes from one very large one. Plan for both.

Does a biometric privacy law apply to my business?

Start with where the people are, not where you are. If you scan the faces of customers in Texas or the fingerprints of workers in Illinois, those states' laws reach you. Then list every tool that touches biometric data. Common ones include:

• Time clocks and door access systems that use fingerprints or palm scans
• Identity checks that match a selfie to a photo ID during signup
• Call center or voice assistant software that builds voiceprints
• Video tools that tag or recognize faces in recordings
• Phone apps that open with a face scan and send templates to a server

What should a freelancer, employer or worker do now?

If you run a business, get a written consent form in front of every person before collection, publish a retention schedule, and set a real deletion date. Use the strictest state you operate in as your baseline. Matching Illinois covers most of the ground, but Texas has a shorter deletion deadline: 1 year after the purpose expires.

If you buy software, ask the vendor where the biometric templates are stored, who can see them, and whether they are used to train other products. Get the answers into the contract, not a sales email.

If you're a freelancer building an app that captures faces or voices, your client may expect you to carry the legal risk. Push back on unlimited indemnity for privacy claims you have no control over.

Whatever your role, keep a paper trail. A signed consent, a dated retention policy and a deletion log are what you will want to show if a state office or a plaintiff's lawyer ever asks.

If you're a worker asked to scan in, you can ask for the written policy and how long your data is kept. In Illinois, a missing release is the employer's problem, not yours.

Sources and method

Every number on this page comes from the sources below, each opened and read on or before October 18, 2026. A second, independent review checked every figure against its source and corrected anything that did not match. 51 of 51 state entries were confirmed; any that could not be are marked "Not yet confirmed" and left out of every count and chart.

1. International Association of Privacy Professionals (IAPP), US State Privacy Legislation Tracker 2026 (map) (Last updated 8 Sept. 2026)
2. International Association of Privacy Professionals (IAPP), US State Privacy Legislation Tracker 2026: Comprehensive Consumer Privacy Bills (chart) (Tracker last updated 8 Sept. 2026)
3. International Association of Privacy Professionals (IAPP), US State Comprehensive Privacy Laws Report: 2024 Legislative Session (2024 Legislative Session edition (Dec. 2024))
4. Illinois General Assembly (copy of compiled statute hosted by Akin Gump), Biometric Information Privacy Act, 740 ILCS 14 (statute text) (P.A. 95-994 text (sections 15 and 20(a) unchanged by the 2024 amendment))
5. King & Spalding, Illinois BIPA Reform Takes Effect (August 12, 2024)
6. Texas Legislature (via Texas Public Law), Tex. Bus. & Com. Code § 503.001, Capture or Use of Biometric Identifier (Text verified through May 26, 2025 (pre-HB 149); unamended subsections (c)-(d) still current)
7. Texas Legislature (via Texas Public Law), Tex. Bus. & Com. Code § 541.001, Texas Data Privacy and Security Act definitions (Current statute (read 2026))
8. Office of the Texas Attorney General, Attorney General Ken Paxton Secures $1.4 Billion Settlement with Meta Over Its Unauthorized Capture of Personal Biometric Data (July 30, 2024)
9. Office of the Texas Attorney General, Attorney General Ken Paxton Finalizes Historic Settlement with Google and Secures $1.375 Billion (October 31, 2025)
10. Washington State Legislature, RCW 19.375, Biometric Identifiers (Current RCW (2017 c 299))
11. Washington State Legislature, RCW 19.373, Washington My Health My Data Act (Current RCW (2023 c 191))
12. Washington State Office of the Attorney General, Protecting Washingtonians' Personal Health Data and Privacy (My Health My Data Act FAQ) (Current page (read Oct. 2026))
13. Colorado General Assembly, HB24-1130, Privacy of Biometric Identifiers & Data (Approved May 31, 2024; effective July 1, 2025)
14. Colorado General Assembly (via Colorado Public Law), C.R.S. § 6-1-1303, Colorado Privacy Act definitions (Current statute (read 2026))
15. California Privacy Protection Agency, California Consumer Privacy Act of 2018 (Civ. Code § 1798.140) (Text effective 01/01/2026 (AB 137, AB 566 update), posted December 2025)
16. Virginia General Assembly, Va. Code § 59.1-575, Consumer Data Protection Act definitions (Current Code of Virginia (read 2026))
17. Connecticut Office of the Attorney General, The Connecticut Data Privacy Act (Current page (read Oct. 2026))
18. Iowa Legislature, Iowa Code § 715D.1, Consumer Data Protection definitions (Iowa Code 2026)
19. Montana Legislature, Mont. Code Ann. § 30-14-2802, Consumer Data Privacy Act definitions (Current MCA (read 2026))
20. Oregon Legislature (via Oregon Public Law), ORS 646A.570, Oregon Consumer Privacy Act definitions (Current statute (read 2026))
21. Delaware General Assembly, 6 Del. C. ch. 12D, Delaware Personal Data Privacy Act (Current Delaware Code (read 2026))
22. Minnesota Office of the Revisor of Statutes, Minn. Stat. § 325M.11, Consumer Data Privacy Act definitions (Current statute (read 2026))
23. Maryland General Assembly, Md. Code, Com. Law § 14-4701, Maryland Online Data Privacy Act definitions (Current statute (read 2026))
24. Florida Legislature, Fla. Stat. § 501.702, Florida Digital Bill of Rights definitions (2026 Florida Statutes (read 2026))
25. Mayer Brown, Alabama Enacts Comprehensive Consumer Data Privacy Law (April 28, 2026)
26. Mayer Brown, Vermont Enacts Comprehensive Consumer Privacy Law (June 22, 2026)
27. Troutman Pepper Locke, Vermont Brings the Total to 23 State Comprehensive Privacy Laws (June 18, 2026)
28. Davis Wright Tremaine, Louisiana Data Privacy Act (SB 386) (June 25, 2026)
29. Troutman Pepper Locke, Oklahoma Enacts Consumer Data Privacy Law (March 23, 2026)
30. Oklahoma House of Representatives, SB546 data privacy protections signed into law (March 23, 2026)
31. Davis Wright Tremaine LLP, State Privacy Laws Tracker: Nevada (SB 370 consumer health data law) (Undated tracker page (read 19 Oct. 2026))
32. Texas Legislature, H.B. 149, 89th Legislature (Texas Responsible Artificial Intelligence Governance Act), enrolled text (Enrolled 2025; effective January 1, 2026)