Biometric Privacy Laws by State (2026): BIPA, CUBI & Consent

Most U.S. states do not have a dedicated biometric privacy law. Only Illinois (BIPA), Texas (CUBI), and Washington have stand-alone biometric statutes. About twenty more states protect biometric data as sensitive data under a broader consumer privacy law, and the rest cover it only through data-breach notification rules. There is no federal biometric privacy law.

Jurisdiction scope: This guide covers U.S. state biometric privacy laws (fingerprints, facial geometry, voiceprints, retina and iris scans) as of 2026. It is general legal information, not legal advice.

Which States Have Biometric Privacy Laws?

A biometric identifier is a measurement of a unique physical trait, such as a fingerprint, faceprint, voiceprint, or iris scan. As of 2026, only three states regulate the collection of biometric identifiers with a dedicated statute. Everywhere else, biometric data is protected either as a category of sensitive data under a general consumer privacy law or only through data-breach notification rules. No federal law specifically governs commercial biometric data, so the protections that apply to you depend entirely on your state.

The single most important distinction is whether a state gives individuals a private right of action, meaning the ability to sue on their own. Only Illinois does. That one feature is why Illinois is the center of biometric litigation in the country.

The Three Dedicated Biometric Laws

Illinois, Biometric Information Privacy Act (BIPA), 740 ILCS 14. Enacted in 2008, BIPA is the strictest biometric law in the United States. A private entity must obtain written consent before collecting a person's biometric identifier, publish a retention and destruction schedule, and never sell biometric data. BIPA is the only biometric law with a private right of action, and it sets statutory damages of $1,000 per negligent violation and $5,000 per reckless or intentional violation, plus attorney fees. The Illinois Supreme Court has held that a person does not need to prove actual harm to sue (Rosenbach v. Six Flags, 2019).

Texas, Capture or Use of Biometric Identifier Act (CUBI), Business and Commerce Code 503.001. Texas requires informed consent before capturing a biometric identifier for a commercial purpose and limits how long it can be retained. Unlike BIPA, CUBI has no private right of action; only the Texas Attorney General can enforce it, with civil penalties up to $25,000 per violation.

Washington, RCW 19.375 and the My Health My Data Act. Washington's 2017 biometric law requires a business to provide notice, obtain consent, or offer a mechanism to opt out before enrolling a biometric identifier in a database for a commercial purpose (satisfying any one of the three is enough), enforced by the Attorney General. Washington went further in 2023 with the My Health My Data Act, which classifies all biometric data, not just data tied to health, as protected consumer health data, and includes a private right of action.

Biometric Data as Sensitive Data Under State Privacy Laws

Roughly twenty states have passed comprehensive consumer privacy laws, and nearly all of them classify biometric data as sensitive data. These include California, Virginia, Colorado, Connecticut, Texas, Oregon, Montana, and others. Under these laws, a business generally must obtain opt-in consent before processing biometric data, though California, Utah, and Iowa instead give consumers a right to opt out rather than requiring opt-in consent, and consumers gain rights to access and delete it. Colorado went furthest in this group. HB 24-1130, signed May 31, 2024 and effective July 1, 2025, added C.R.S. 6-1-1314, which requires a controller to obtain consent before collecting biometric data, to adopt a written retention and destruction policy that deletes a biometric identifier by the earliest of the collection purpose being satisfied, twenty-four months after the consumer last interacted with the controller, or a short deadline triggered by the controller's own annual review, and which flatly bars selling, leasing, or trading biometric identifiers. It also limits the situations in which an employer may make biometric consent a condition of employment. Under the amended C.R.S. 6-1-1304(1)(b), those biometric duties reach a controller that handles any amount of biometric identifiers or biometric data, regardless of the amount, so a business too small for the act's usual 100,000 or 25,000 consumer thresholds is still bound as to biometrics. These protections are real but are enforced by the state attorney general, not through individual lawsuits.

States Without a Dedicated Biometric Law

In the remaining states, there is no statute that specifically restricts collecting biometric identifiers. Biometric data is usually still listed as protected personal information in the state's data-breach notification law, so a company that suffers a breach involving biometric data must notify affected residents. But there is generally no requirement to obtain consent before collection, and no individual right to sue over the collection itself.

Biometric Privacy Laws by State

The table below links to a detailed guide for each state. Select your state for the specific statute, consent rules, penalties, and recent changes.

What About BIPA Specifically?

Because Illinois BIPA drives most biometric litigation in the country, it is worth understanding on its own. For the statute's consent and retention requirements, the landmark cases, and how the per-scan damages question affects employers, see our detailed BIPA explainer, and for the Illinois state context, our Illinois biometric privacy guide.