Key takeaways
- Consent is the common denominator across all six regions.
- The EU and UK add DPIAs and special category conditions.
- BIPA's private right of action makes Illinois uniquely litigious.
- Retention limits and deletion are required almost everywhere.
At a glance
| Region | Main rules | Consent | Stand-out duty |
|---|---|---|---|
| United States | BIPA, CUBI, CCPA/CPRA, Colorado | Written release (IL) | Public retention schedule |
| Canada | PIPEDA, Quebec Law 25 | Express | CAI notice for biometric databases (QC) |
| Australia | Privacy Act 1988, APPs | Generally required | Sensitive-information handling |
| United Kingdom | UK GDPR, DPA 2018 | Usually explicit | DPIA; Article 9 condition |
| Western Europe | GDPR, EU AI Act | Usually explicit | AI Act prohibitions |
| India | DPDP Act 2023, DPDP Rules | Free, specific, informed | Erasure when purpose ends |
The common baseline
If you design for the strictest rules, one flow can serve every market:
- Clear notice before capture, in plain language.
- Opt-in consent, recorded and withdrawable.
- A non-biometric alternative for people who decline.
- A published retention schedule and automatic deletion.
- A processor agreement with your vendor.
- No selling, and no secondary uses without fresh consent.
Where regions diverge
Illinois requires a written release and a public retention schedule, and lets individuals sue. Quebec requires advance notice to its regulator before a biometric database goes live. The EU AI Act bans emotion recognition at work and in schools and untargeted face scraping. India's DPDP Act centres on itemised notice and consent that's as easy to withdraw as to give.
Keeping current
Biometric law is moving quickly: new US state laws, phased AI Act obligations, Australia's 2024 privacy reforms and India's DPDP Rules. Review requirements before each launch and treat this page as a starting point.
General information, not legal advice. Last reviewed 2026-09-30.
