Biometric Privacy Laws by State in the USA – Definition
Biometric privacy laws by state in the USA are a set of state laws and regulations that define when and under what conditions biometric data may be collected, processed, stored, disclosed, or deleted. In practice, this means data that can identify a person based on physical or behavioral traits, such as face geometry, fingerprints, iris scans, voiceprints, or other biometric identifiers. For teams responsible for anonymizing photos and video recordings, the key point is that visual material can become biometric data not only when it contains a face, but when that face is used for identification or to extract a so-called template, meaning a mathematical biometric pattern.
In the context of photos and video, it is important to distinguish between two levels of processing. A facial image alone is not always treated under state law in the same way as a biometric identifier. However, extracting facial features through a computer vision or deep learning model in order to recognize a person, verify identity, or create a persistent comparison template is usually the area of highest legal risk. That is why a face blurring system should operate as early as possible in the image processing pipeline and should not create or retain biometric templates unless the business purpose clearly requires it.
In the United States, there is no single nationwide equivalent of the GDPR for biometrics. Biometric privacy laws by state play the biggest role, and their scope varies in terms of definitions, consent requirements, retention periods, notice obligations, and whether individuals can bring private lawsuits.
How to Understand Biometrics When Anonymizing Photos and Video Recordings
For Data Protection Officers and compliance teams, the most important distinction is between detection and identification. Face detection is used to locate the facial area in a frame so it can be blurred. Facial identification is used to determine who the person is. This distinction matters both technically and legally.
In practice, the anonymization of visual material may include the following stages:
- object detection – the model locates a face or license plate in the image,
- tracking across frames – the algorithm keeps the same area aligned through subsequent frames,
- masking – the system applies blur, pixelation, or another covering effect,
- quality control – an operator checks whether any identifiable fragment remains visible.
Building an AI model for face detection requires training data and model training, usually with deep learning. However, a model used exclusively for face detection and face blurring does not need to identify a person by name. That reduces regulatory risk. In higher-risk environments, a privacy by design architecture is recommended: no storage of facial embeddings, no identity recognition features, and no secondary use of visual data for model training without a separate legal basis.
In this context, Gallio PRO is used for photo and video anonymization through automatic face blurring and license plate blurring. The software does not perform real-time video stream anonymization and does not blur entire body silhouettes. Other elements, such as documents or content displayed on monitors, can be concealed manually in the editor.
Which US States Have Specific Biometric Privacy Laws?
The regulatory landscape in the United States is uneven. Some states have adopted standalone biometric privacy laws, while others regulate this area under broader consumer privacy laws. For risk assessment, organizations should review both biometric-specific statutes and general state rules on sensitive data.
State
Legal Act
Year
Practical Impact
Illinois
Biometric Information Privacy Act – BIPA
2008
The most restrictive law. Requires prior notice and written consent. Allows a private right of action.
Texas
Capture or Use of Biometric Identifier Act – CUBI
2009
Regulates the capture of biometric identifiers for commercial purposes. Enforced by the Attorney General; no general private right of action.
Washington
H.B. 1493 / RCW 19.375
2017
Regulates enrollment and the commercial use of biometric identifiers. Has a narrower enforcement mechanism than BIPA.
California
CCPA/CPRA
2018/2020
Biometric data falls within the definition of personal information and, in some cases, sensitive personal information. Important notice obligations and access/deletion rights apply.
Virginia, Colorado, Connecticut, Utah, Montana, Oregon, Delaware, and others
State consumer privacy laws
2021–2025
These laws often classify biometric data as sensitive data and require opt-in consent or enhanced transparency, but the scope and exceptions vary by state.
As of 2025, the trend is clear: more laws are being enacted, and biometrics are increasingly singled out as a category of sensitive data. The highest litigation risk still exists in Illinois because of extensive case law and class action litigation.
Key Differences Between States
The differences do not come down to the definition of biometrics alone. Operational obligations also matter. These requirements determine whether a specific video processing workflow will comply with the law in a given state.
- Scope of the definition – some laws focus on a “biometric identifier,” while others also cover “biometric information” or data generated from biological traits for identification purposes.
- Consent – Illinois requires prior written consent before biometric data is captured or obtained. Other states provide for less formal mechanisms.
- Retention and deletion – BIPA requires a publicly available retention and destruction policy, generally providing for deletion once the purpose has been satisfied or within 3 years of the last interaction, whichever comes first.
- Enforcement – the biggest difference concerns the right to bring an individual lawsuit. Illinois provides a private right of action. In many other states, enforcement mainly rests with the state authority.
- Sale and disclosure – some laws expressly prohibit the sale of biometric data or its disclosure unless specific conditions are met.
Compliance Parameters for Video Anonymization Systems
When assessing a face blurring system, what matters is not only the wording of the statute but also the technical characteristics of the process. In a compliance environment, it is worth documenting parameters that show the system is designed for anonymization rather than person recognition.
Parameter
Legal and Operational Significance
Face detection recall
The higher the recall, the lower the risk of leaving an unblurred face visible. It should be measured on a validation dataset.
False negative rate
An undetected face creates a risk of disclosing personal data or material that enables further identification.
Retention of source files
Should be limited to the minimum necessary for the processing purpose and the organization’s policy.
Storage of embeddings
If the system stores facial templates, the risk increases that the activity will be classified as biometric data processing for identification.
On-premise processing
May reduce data transfers and sharing with third parties, but it does not remove statutory obligations.
Audit trail without personal data
Logs should document system operations without retaining additional biometric data.
In practice, the safer model is one in which the system detects a face, applies a mask, and does not retain a biometric template after the task is completed. This type of architecture reduces exposure to the requirements imposed by biometric privacy laws by state.
Legislative Trends and Practical Impact for Organizations
The direction of change in the United States is consistent. State lawmakers increasingly treat biometrics as a category requiring heightened protection, especially when data is used by AI for profiling or identification. At the same time, decisions by state and federal courts are becoming more important in defining harm, consent, and the scope of liability for controllers and technology providers.
For organizations working with photos and video recordings, this leads to several practical conclusions:
- they should determine in which states the individuals shown in the material or the service users are located,
- they must distinguish between standard image processing and the creation of biometric identifiers,
- they should implement data minimization by blurring faces and license plates as early as possible,
- they need a retention, deletion, and data subject request handling policy,
- they should review contracts with AI vendors if the model or service stores facial features.
Legal References and Sources
The following legal acts provide the basis for verifying definitions and obligations. Before implementation, it is advisable to check the current wording of the laws and the latest case law.
- Illinois Biometric Information Privacy Act, 740 ILCS 14, 2008.
- Texas Business and Commerce Code, Sec. 503.001 – Capture or Use of Biometric Identifier, 2009.
- Washington H.B. 1493, codified primarily at RCW 19.375, 2017.
- California Consumer Privacy Act – Cal. Civ. Code § 1798.100 et seq., as amended by the CPRA.
- National Conference of State Legislatures – overview of state biometric and privacy laws, 2024–2025 updates.
See Also
- Data anonymization
- Face blurring
- Privacy protection
- AI in data protection