Biometric Privacy Laws by State (2026): BIPA, CUBI & Consent

Most U.S. states do not have a dedicated biometric privacy law. Only Illinois (BIPA), Texas (CUBI), and Washington have stand-alone biometric statutes. About twenty more states protect biometric data as sensitive data under a broader consumer privacy law, and the rest cover it only through data-breach notification rules. There is no federal biometric privacy law.

Jurisdiction scope: This guide covers U.S. state biometric privacy laws (fingerprints, facial geometry, voiceprints, retina and iris scans) as of 2026. It is general legal information, not legal advice.

Which States Have Biometric Privacy Laws?

A biometric identifier is a measurement of a unique physical trait, such as a fingerprint, faceprint, voiceprint, or iris scan. As of 2026, only three states regulate the collection of biometric identifiers with a dedicated statute. Everywhere else, biometric data is protected either as a category of sensitive data under a general consumer privacy law or only through data-breach notification rules. No federal law specifically governs commercial biometric data, so the protections that apply to you depend entirely on your state.

The single most important distinction is whether a state gives individuals a private right of action, meaning the ability to sue on their own. Only Illinois does. That one feature is why Illinois is the center of biometric litigation in the country.

The Three Dedicated Biometric Laws

Illinois, Biometric Information Privacy Act (BIPA), 740 ILCS 14. Enacted in 2008, BIPA is the strictest biometric law in the United States. A private entity must obtain written consent before collecting a person's biometric identifier, publish a retention and destruction schedule, and never sell biometric data. BIPA is the only biometric law with a private right of action, and it sets statutory damages of $1,000 per negligent violation and $5,000 per reckless or intentional violation, plus attorney fees. The Illinois Supreme Court has held that a person does not need to prove actual harm to sue (Rosenbach v. Six Flags, 2019).

Texas, Capture or Use of Biometric Identifier Act (CUBI), Business and Commerce Code 503.001. Texas requires informed consent before capturing a biometric identifier for a commercial purpose and limits how long it can be retained. Unlike BIPA, CUBI has no private right of action; only the Texas Attorney General can enforce it, with civil penalties up to $25,000 per violation.

Washington, RCW 19.375 and the My Health My Data Act. Washington's 2017 biometric law requires a business to provide notice, obtain consent, or offer a mechanism to opt out before enrolling a biometric identifier in a database for a commercial purpose (satisfying any one of the three is enough), enforced by the Attorney General. Washington went further in 2023 with the My Health My Data Act, which classifies all biometric data, not just data tied to health, as protected consumer health data, and includes a private right of action.

Biometric Data as Sensitive Data Under State Privacy Laws

Roughly twenty states have passed comprehensive consumer privacy laws, and nearly all of them classify biometric data as sensitive data. These include California, Virginia, Colorado, Connecticut, Texas, Oregon, Montana, and others. Under these laws, a business generally must obtain opt-in consent before processing biometric data, though California, Utah, and Iowa instead give consumers a right to opt out rather than requiring opt-in consent, and consumers gain rights to access and delete it. Colorado went furthest in this group. HB 24-1130, signed May 31, 2024 and effective July 1, 2025, added C.R.S. 6-1-1314, which requires a controller to obtain consent before collecting biometric data, to adopt a written retention and destruction policy that deletes a biometric identifier by the earliest of the collection purpose being satisfied, twenty-four months after the consumer last interacted with the controller, or a short deadline triggered by the controller's own annual review, and which flatly bars selling, leasing, or trading biometric identifiers. It also limits the situations in which an employer may make biometric consent a condition of employment. Under the amended C.R.S. 6-1-1304(1)(b), those biometric duties reach a controller that handles any amount of biometric identifiers or biometric data, regardless of the amount, so a business too small for the act's usual 100,000 or 25,000 consumer thresholds is still bound as to biometrics. These protections are real but are enforced by the state attorney general, not through individual lawsuits.

States Without a Dedicated Biometric Law

In the remaining states, there is no statute that specifically restricts collecting biometric identifiers. Biometric data is usually still listed as protected personal information in the state's data-breach notification law, so a company that suffers a breach involving biometric data must notify affected residents. But there is generally no requirement to obtain consent before collection, and no individual right to sue over the collection itself.

Biometric Privacy Laws by State

The table below links to a detailed guide for each state. Select your state for the specific statute, consent rules, penalties, and recent changes.

Northeast states

The table below covers 9 states in the Northeast.

Midwest states

The table below covers 12 states in the Midwest.

Southern states

The table below covers 16 states in the South, plus the District of Columbia.

Western states

The table below covers 13 states in the West.

What About BIPA Specifically?

Because Illinois BIPA drives most biometric litigation in the country, it is worth understanding on its own. For the statute's consent and retention requirements, the landmark cases, and how the per-scan damages question affects employers, see our detailed BIPA explainer, and for the Illinois state context, our Illinois biometric privacy guide.

Frequently Asked Questions

Which states have biometric privacy laws?

Only Illinois (BIPA), Texas (CUBI), and Washington have stand-alone biometric statutes. Colorado is a partial fourth: its privacy act now carries biometric-specific duties at C.R.S. 6-1-1314. About twenty more states protect biometric data as sensitive data under a comprehensive consumer privacy law, and the rest cover it through data-breach notification rules only.

Is there a federal biometric privacy law?

No. There is no federal law that specifically regulates commercial collection of biometric identifiers. Protection depends entirely on the state where the data is collected.

Can I sue a company for collecting my biometric data?

Only in Illinois. BIPA is the only biometric law with a private right of action, allowing individuals to sue for statutory damages of $1,000 or $5,000 per violation. Texas and Washington laws are enforced only by the state attorney general.

What counts as a biometric identifier?

Generally a measurement of a unique physical characteristic used to identify a person, such as a fingerprint, faceprint or facial geometry, voiceprint, or retina or iris scan. Exact definitions vary by state.

Do comprehensive privacy laws protect biometric data?

Yes. States with comprehensive consumer privacy laws, such as Virginia, Colorado, and Connecticut, treat biometric data as sensitive data and generally require opt-in consent before processing, along with rights to access and delete it. Colorado goes further than the rest, adding biometric-specific consent, written policy, retention, and no-sale duties at C.R.S. 6-1-1314 that apply no matter how much biometric data a controller handles. California, Utah, and Iowa are exceptions: their privacy laws treat biometric data as sensitive personal information but give consumers an opt-out style right to limit its use rather than requiring opt-in consent.