Written notice & consent
Tell users what you collect, why and for how long, and get a written release (e-signature works) before capture.
Region · United States
Face recognition in the United States.
There's no single federal biometric law, but state laws are strict — and BIPA carries a private right of action. Here's what matters before you ship.
BIPA · CCPA/CPRA · Texas CUBIKey laws
What applies in United States.
IL
Illinois BIPA
Written notice and a written release before collecting biometric identifiers, a public retention and destruction schedule, and a private right of action. A 2024 amendment treats repeated collection by the same method as a single violation.
TX
Texas CUBI
Notice and consent before capturing biometric identifiers, no sale, and destruction within a reasonable time — generally within a year after the purpose ends. Enforced by the Attorney General.
WA
Washington
RCW 19.375 covers biometric identifiers enrolled for commercial purposes; the My Health My Data Act also treats biometric data as consumer health data.
CA
CCPA / CPRA
Biometric information processed to identify a consumer is sensitive personal information, with rights to know, delete and limit its use.
CO
Colorado
The Colorado Privacy Act's biometric amendment adds notice, consent and retention duties, effective from July 2025.
Your checklist
What you need to do.
Public retention schedule
Publish when you'll destroy biometric data — e.g. when the purpose is met or within three years of the last interaction, whichever is first.
No selling or profiting
Never sell, lease or trade biometric data, and restrict disclosure.
Honour deletion
Delete templates promptly on request or when the purpose ends.
How SIMSIM helps
Privacy-first by design.
Templates, not photos
Less sensitive data held, smaller breach impact.
Deletion by API
Honour withdrawal and retention schedules in code.
Processor terms
A DPA with the transfer terms your market needs.
FAQ
Questions from teams in United States.
Does BIPA apply if my company isn't in Illinois?
It can. BIPA focuses on biometric data collected from people in Illinois, so out-of-state companies with Illinois users should plan for it.
Do I need consent in every state?
Not every state has a biometric statute, but consent-based design is the safest national baseline and is increasingly expected.
Does SIMSIM help with retention?
Yes — delete templates by API and see our Biometric Data Policy for a model schedule.
General information, not legal advice. Last reviewed 2026-09-30. Confirm requirements with qualified counsel.
Other regions
Operating in more than one market?
Building for United States?
Start free, or talk to us about DPAs, processing locations and volume pricing.