Alaska Biometric Privacy Laws: Collection, Consent & Penalties (2026)

Alaska has no dedicated biometric privacy statute. The state's Personal Information Protection Act (AS 45.48) does not include biometric data, and multiple legislative attempts since 2011 have failed. Alaska's constitutional right to privacy under Article I, Section 22 offers limited protection, applying primarily to government agencies rather than private businesses.

Alaska stands out as one of the few states with a constitutional right to privacy but no dedicated statute protecting biometric data like fingerprints, facial scans, or iris patterns. Several biometric privacy bills have been introduced in the Alaska Legislature over the past decade, but none have crossed the finish line.

This guide covers the current legal landscape for biometric privacy in Alaska, including what protections exist, what gaps remain, and what pending legislation could change the picture. For the full overview of Alaska's privacy framework, see our Alaska Data Privacy Laws guide.

Alaska Has No Dedicated Biometric Privacy Law

Unlike Illinois (with its Biometric Information Privacy Act), Texas, and Washington, Alaska has not enacted a standalone biometric privacy statute. This means there is no Alaska law that specifically requires businesses to:

• Obtain consent before collecting fingerprints, facial scans, or other biometric identifiers
• Provide written notice about the purpose and duration of biometric data collection
• Follow specific retention and destruction schedules for biometric data
• Refrain from selling or sharing biometric information

Multiple legislative attempts have been made to fill this gap. The most notable include SB 98 in the 27th Legislature (2011-2012), which passed the Alaska Senate unanimously but died in the House Judiciary Committee, and HB 72 in the 30th Legislature (2017-2018), which also stalled in committee. A similar bill, HB 96 in the 29th Legislature, met the same fate.

These bills would have added a new Article 2 (Sec. 18.13.200-18.13.290, "Biometric Information") to the existing AS 18.13 Genetic Privacy chapter, requiring informed consent before collection, prohibiting the sale of biometric data, mandating secure storage and destruction within 120 days, and allowing individuals to sue for violations with a penalty of $1,000 per violation, rising to $5,000 if the violation resulted in profit or monetary gain to the violator.

As of August 2026, none of these proposals have become law.

Alaska's General Breach Notification Law Does Not Cover Biometric Data

Alaska's Personal Information Protection Act (AS 45.48.010-090) requires businesses to notify residents when a data breach compromises their personal information. However, the statute defines "personal information" narrowly.

Under AS 45.48.090, personal information means an individual's first name or first initial and last name combined with one or more of the following:

• Social Security number
• Driver's license number or state identification card number
• Account number, credit card number, or debit card number (with required access codes)
• Passwords, PINs, or other access codes for financial accounts

Biometric identifiers such as fingerprints, facial geometry, iris scans, and voiceprints are not listed. This means that a breach involving only biometric data would not trigger the notification requirements of Alaska's general breach notification law, AS 45.48, under current law.

One narrow sector-specific exception sits outside AS 45.48. Under Alaska's Insurance Data Security Act, AS 21.23.399(7)(B)(v) counts "a biometric record" as nonpublic information about a consumer. AS 21.23.260 requires a covered insurance licensee to protect that information under a comprehensive written information security program, and AS 21.23.280 requires the licensee to notify the Alaska insurance director as soon as possible and no later than three business days after determining that a cybersecurity event has occurred. AS 21.23.300 exempts licensees with fewer than 10 employees from the information security program requirement, and exempts a HIPAA-compliant licensee that certifies its compliance from the article entirely. This duty runs to the state insurance director rather than to consumers, and it reaches only insurance licensees, not businesses generally.

This stands in contrast to states like California, Texas, and New York, which have amended their breach notification laws to explicitly include biometric data.

Constitutional Right to Privacy: Article I, Section 22

Where Alaska lacks a statutory framework for biometric privacy, its constitution may offer some protection. Article I, Section 22 of the Alaska Constitution states:

"The right of the people to privacy is recognized and shall not be infringed. The legislature shall implement this section."

Added by constitutional amendment in 1972, this provision is notably broader than the implied federal right to privacy. The Alaska Supreme Court has interpreted it to provide two separate protections: the right to personal autonomy (making choices about one's own life) and the right to shield personal information from public disclosure.

Courts apply strict scrutiny when reviewing government actions that infringe on this right. The government must demonstrate a compelling state interest to justify any intrusion.

For biometric data, this constitutional protection is most relevant when a government agency collects or uses biometric identifiers. A state agency requiring fingerprints or facial recognition without adequate justification or safeguards could face a constitutional challenge under Section 22.

However, this provision primarily restricts government action. It does not directly regulate how private businesses collect or use biometric data, which is where a dedicated statute like Illinois' BIPA would fill the gap.

Unfair Trade Practices Act as a Backstop

Alaska's Unfair Trade Practices and Consumer Protection Act (AS 45.50.471) declares unlawful any "unfair methods of competition" and "unfair or deceptive acts or practices" in the conduct of trade or commerce.

While this statute does not mention biometric data specifically, it provides a potential enforcement tool. If a business collects biometric information through deceptive means, fails to honor its own privacy policy regarding biometric data, or misrepresents how it uses biometric identifiers, the Alaska Attorney General could pursue enforcement under this statute.

AS 45.48.080 splits enforcement of the breach notification law along two paths. Under subsection (a), a governmental agency that violates AS 45.48.010-45.48.090 is liable to the state for a civil penalty of up to $500 for each state resident who was not notified, capped at $50,000 in total, and may be enjoined from further violations. Under subsection (b), a violation by a non-governmental information collector is an unfair or deceptive act or practice under AS 45.50.471-45.50.561, but the collector is not subject to the civil penalties in AS 45.50.551; the same $500-per-resident penalty, capped at $50,000, applies instead.

This is a far cry from the targeted protections a biometric privacy law would provide, but it offers a limited safety net for the most egregious cases of biometric data misuse.

Genetic Privacy Protections Under AS 18.13

Alaska's Genetic Privacy Act (AS 18.13) provides strong protections for genetic information, requiring informed consent before genetic testing and restricting disclosure of results. While genetic data and biometric data are distinct categories, this law shows Alaska's willingness to protect sensitive biological information when the legislature acts.

The Genetic Privacy Act requires that genetic testing be performed only with the informed and written consent of the individual. Results cannot be disclosed without consent, and violations carry criminal penalties.

This framework does not extend to biometric identifiers like fingerprints or facial scans. However, the failed biometric bills (SB 98, HB 72, HB 96) all proposed adding biometric protections as a new article within the same title (Title 18) that houses genetic privacy protections, suggesting legislators view these as related categories.

Pending Legislation: SB 2 and HB 367's Private-Sector Biometric Provisions

The most relevant pending legislation is Senate Bill 2 (SB 2), introduced by Senator Shelley Hughes in January 2025 during the 34th Legislature. While primarily focused on artificial intelligence regulation and election-related deepfakes, SB 2 includes significant biometric provisions for state agencies.

If enacted, SB 2 would:

• Prohibit state agencies from using AI systems for biometric identification purposes
• Ban state agency use of AI for emotion recognition and social scoring
• Require biennial inventories and impact assessments of AI systems used for consequential decisions
• Mandate individual consent, notification, and appeal processes for AI-driven decisions

As of August 2026, SB 2 remains in the Senate State Affairs Committee with a subsequent referral to the Judiciary Committee. It has not advanced to a floor vote.

A second bill, House Bill 367 (HB 367), the Consumer Data Privacy Act, is further along and more directly relevant to the private-sector gap this page describes. Sponsored by Representative Story, HB 367 would regulate private businesses, not just state agencies, and defines biometric data as a category of sensitive personal data that requires consumer consent before collection. The House Judiciary Committee advanced a committee substitute on May 8, 2026, and the bill was referred to House Finance on May 12, 2026. It has not yet passed the House.

SB 2 alone would not create a comprehensive biometric privacy law for the private sector, since it applies only to state agencies. HB 367 goes further: if enacted, it would become Alaska's first law regulating how private businesses collect and use biometric data.

Federal Protections That Apply in Alaska

Without a state biometric privacy law, Alaska residents depend on federal protections for much of their biometric data security:

FTC Act, Section 5 allows the Federal Trade Commission to take enforcement action against companies that engage in unfair or deceptive practices involving biometric data. The FTC has pursued enforcement actions against companies that failed to protect biometric information or used it without adequate consent.

HIPAA protects biometric data when it qualifies as protected health information held by covered entities and their business associates. Fingerprints or other biometric identifiers used in healthcare settings fall under HIPAA's Privacy Rule.

FERPA restricts the disclosure of student biometric data collected by educational institutions receiving federal funding. Schools using fingerprint or facial recognition systems must comply with FERPA's privacy requirements.

COPPA provides additional protections for biometric data collected from children under 13, requiring verifiable parental consent before collection by websites and online services under the Children's Online Privacy Protection Act.

These federal laws provide a floor of protection but do not give Alaska residents a private right of action for biometric privacy violations by most private businesses.

What This Means for Alaska Residents and Businesses

For residents: You currently have no state law right to sue a private company for collecting your fingerprints, facial scan, or other biometric data without your consent. Your strongest protection comes from the Alaska Constitution's privacy guarantee, but that applies primarily to government actions. If a company deceives you about how it uses your biometric data, the Attorney General could potentially pursue the matter under the Unfair Trade Practices Act.

For businesses operating in Alaska: Alaska imposes no general biometric-specific obligations on private businesses, with the narrow exception of insurance licensees covered by the Insurance Data Security Act described above. Beyond that, businesses should be aware that collecting biometric data from residents of states with biometric laws (like Illinois, Texas, or Washington) can create liability regardless of where the business is located. Following biometric privacy best practices is advisable even in the absence of an Alaska-specific mandate.

For employers: Alaska has no state law restricting the use of biometric time clocks, fingerprint scanners, or facial recognition in the workplace. However, employers with workers in multiple states should ensure compliance with stricter biometric laws in other jurisdictions.

Disclaimer

This article provides general legal information about Alaska's biometric privacy landscape as of August 2026. It is not legal advice. Laws and pending legislation can change. If you have specific concerns about biometric data collection, storage, or use in Alaska, consult a qualified attorney licensed in Alaska who can evaluate your particular situation.

More Alaska Laws

• Alaska Deepfake Laws
• Alaska Employee Monitoring Laws
• Alaska GPS Tracking Laws
• Alaska Recording Laws

Frequently Asked Questions

Does Alaska have a biometric privacy law like Illinois BIPA?

No. Alaska has no dedicated biometric privacy statute as of August 2026. Multiple bills have been introduced since 2011, including SB 98 and HB 72, but none have been enacted. Illinois, Texas, and Washington are the only states with standalone biometric privacy laws that have been in effect for several years.

Can my Alaska employer require fingerprint scans for time tracking?

Yes. Under current Alaska law, there are no state restrictions on employers using fingerprint scanners, facial recognition, or other biometric systems in the workplace. However, the Alaska Constitution's privacy guarantee (Article I, Section 22) could be relevant if a government employer implements such systems without adequate justification.

What happens if my biometric data is breached in Alaska?

Alaska's general breach notification law (AS 45.48.010-45.48.090) does not include biometric data in its definition of personal information, so a breach involving only biometric identifiers would not trigger notification under that law. If other covered data (Social Security numbers, financial accounts) is also compromised, the standard notification rules apply. One narrow exception sits outside AS 45.48: under the Insurance Data Security Act a biometric record counts as nonpublic information (AS 21.23.399), and a covered insurance licensee must notify the Alaska insurance director no later than three business days after determining that a cybersecurity event has occurred (AS 21.23.280).

Does the Alaska Constitution protect my biometric privacy?

Potentially, but only against government action. Article I, Section 22 of the Alaska Constitution recognizes the right to privacy and courts apply strict scrutiny to government infringements. A state agency collecting biometric data without compelling justification could face a constitutional challenge. This protection does not directly apply to private businesses.

Is there any pending Alaska legislation that would protect biometric data?

Senate Bill 2 (SB 2), introduced in January 2025, would prohibit state agencies from using AI for biometric identification, emotion recognition, and social scoring, but it does not reach private businesses. House Bill 367 (HB 367), the Consumer Data Privacy Act, goes further: it defines biometric data as sensitive personal data and would require consumer consent from private-sector businesses before collection. HB 367 passed House Judiciary on May 8, 2026, and is now in House Finance.