Georgia Biometric Privacy Laws: Collection, Consent & Penalties (2026)

Georgia has no biometric-specific privacy law, but its first comprehensive consumer privacy statute, the Georgia Consumer Privacy Protection Act (SB 111, Act 462), was signed by Governor Kemp on May 11, 2026, and takes effect July 1, 2026. SB 111 classifies biometric data processed to uniquely identify a person as sensitive data and requires covered businesses to obtain consent before processing it. The Personal Identity Protection Act (O.C.G.A. 10-1-910 et seq.) separately requires breach notification but excludes biometric data from its definition of personal information, leaving biometric-only breaches without a state-level notification requirement.

Georgia is one of the majority of U.S. states that has not enacted a dedicated biometric privacy law. Residents who use fingerprint scanners at work, submit to facial recognition at public venues, or provide biometric data to apps and devices have limited state-level legal protections governing how that data is collected, stored, shared, or destroyed.

This guide explains what Georgia law currently does and does not cover when it comes to biometric information, what the new Georgia Consumer Privacy Protection Act (SB 111) changed, and what federal protections fill the remaining gaps.

For broader context on Georgia's overall privacy framework, see the parent guide to Georgia Data Privacy Laws.

What Counts as Biometric Data

Biometric data includes unique physical or behavioral characteristics used to identify an individual. Common examples include fingerprints, facial geometry (used in facial recognition), iris and retina scans, voiceprints, palm prints, and gait analysis.

States with dedicated biometric privacy laws, such as Illinois (BIPA) and Texas (CUBI), define these identifiers in statute and regulate how entities handle them. Georgia has not taken this step.

Georgia's Current Legal Framework

Personal Identity Protection Act (O.C.G.A. 10-1-910 et seq.)

Georgia's primary data protection law is the Personal Identity Protection Act, enacted in 2005 and amended in 2007. This law requires businesses and data brokers to notify Georgia residents when a security breach compromises their personal information.

However, the statute defines "personal information" under O.C.G.A. 10-1-911 as an individual's name combined with one or more of the following:

• Social Security number
• Driver's license or state ID number
• Financial account, credit card, or debit card numbers (with access codes)
• Account passwords or PINs

Biometric data such as fingerprints, facial scans, and voiceprints are not included in this definition. A breach involving only biometric records would not trigger notification obligations under current Georgia law.

Fair Business Practices Act (O.C.G.A. 10-1-390 et seq.)

Georgia's Fair Business Practices Act prohibits unfair and deceptive trade practices. While the statute does not mention biometric data specifically, a business that made false promises about how it handles biometric information could theoretically face enforcement action under this law.

The Georgia Attorney General enforces the FBPA. There is no private right of action that would allow individual consumers to sue for biometric data misuse under this statute alone.

No Employer-Specific Biometric Rules

Georgia does not restrict employers from collecting fingerprints, facial scans, or other biometric data from employees. Businesses that use biometric time clocks, fingerprint-based access controls, or facial recognition for security purposes are not required by state law to:

• Obtain written consent before collecting biometric data
• Disclose how biometric data will be stored or used
• Establish retention schedules or destruction timelines
• Limit sharing of biometric data with third parties

This stands in sharp contrast to states like Illinois, where the Biometric Information Privacy Act requires informed written consent and imposes statutory damages of $1,000 to $5,000 per violation.

Georgia Consumer Privacy Protection Act (SB 111, Act 462)

The most significant change for biometric privacy in Georgia is the Georgia Consumer Privacy Protection Act (SB 111), which Governor Kemp signed into law as Act 462 on May 11, 2026, after it was introduced in the 2025-2026 legislative session.

What SB 111 Does for Biometric Data

The law classifies biometric data processed for the purpose of uniquely identifying an individual as "sensitive data." SB 111:

• Requires covered businesses to obtain explicit consumer consent before processing biometric data
• Mandates clear notices when a business sells or shares sensitive data, including biometric information
• Requires data protection assessments for activities involving sensitive data processing
• Authorizes the Georgia Attorney General to seek civil penalties of up to $7,500 per violation, with treble damages for knowing or willful violations

Current Status

SB 111 passed the Georgia Senate on March 3, 2025, by a vote of 53-2. The House withdrew and recommitted the bill in March 2025 and did not act on it before the 2025 session adjourned. The House passed a substitute version 162-1 on March 31, 2026, the Senate agreed to that substitute on April 2, 2026, and Governor Kemp signed the bill into law as Act 462 on May 11, 2026. SB 111 takes effect July 1, 2026.

The ACLU of Georgia has criticized the law for high applicability thresholds. It applies only to entities that exceed $25 million in annual revenue and process personal information of at least 175,000 Georgia residents, or 25,000 residents if the entity derives more than 50% of revenue from selling personal data.

The law also does not create a private right of action. Only the Attorney General can bring enforcement actions.

Federal Protections That Apply in Georgia

Georgia's SB 111 requires consent before covered businesses process biometric data as sensitive data, but it exempts employee data and applies only to larger businesses, so federal statutes remain the primary legal guardrails for biometric data that falls outside SB 111's scope.

Section 5 of the FTC Act allows the Federal Trade Commission to bring enforcement actions against companies engaged in unfair or deceptive practices involving biometric data. The FTC has taken action against companies for deceptive facial recognition practices and inadequate data security.

HIPAA protects biometric data when it is collected or used by covered healthcare entities and their business associates. Fingerprint or facial recognition data used in a healthcare setting falls under HIPAA's Privacy Rule.

FERPA restricts how educational institutions handle student biometric data. Schools that use fingerprint-based lunch payment systems or facial recognition must comply with FERPA's privacy requirements.

COPPA imposes strict requirements on the collection of biometric data from children under 13, including parental consent requirements enforced by the FTC.

How Georgia Compares to Other States

Georgia falls into the least protective tier of states for biometric privacy. For comparison:

• Illinois has the strongest biometric law in the country (BIPA), with a private right of action and statutory damages of $1,000 to $5,000 per violation
• Texas and Washington have biometric-specific statutes enforced by their attorneys general
• States with comprehensive privacy laws (like Colorado, Connecticut, and Virginia) classify biometric data as sensitive and require consent for processing
• Georgia has no biometric-specific statute, but its new comprehensive privacy law, SB 111 (Act 462), effective July 1, 2026, classifies biometric data as sensitive and requires consent from covered businesses, with no private right of action

This article provides general legal information about Georgia biometric privacy laws. It is not legal advice. Laws and regulations change frequently, and this content may not reflect the most recent developments. Consult a qualified attorney licensed in Georgia for advice about your specific situation.

More Georgia Laws

• Georgia Employee Monitoring Laws
• Georgia Deepfake Laws
• Georgia Video Recording Laws