Biometric Privacy Laws by State: Fingerprint Time Clock Rules (2026)

A fingerprint or face scan time clock is the fastest way to stop buddy punching and, in Illinois, the fastest way into a class action. The Biometric Information Privacy Act has produced more than $130 million in settlements against employers and time clock vendors, from Speedway's $12.1 million to a string of seven-figure payments by payroll companies whose clocks captured fingerprints without a written release. Texas, Washington and Colorado have their own biometric statutes, New York City and Portland have ordinances, and a dozen states treat biometric identifiers as sensitive data under consumer privacy laws that may or may not reach employees.

This page explains what each law requires before an employer can enroll a fingerprint, hand or face, how long the data can be kept, who can sue and for how much, what the August 2024 BIPA amendment and the April 2026 Seventh Circuit decision changed, and what a compliant consent form and retention policy contain. The Washington and Texas statutes were read directly in October 2026; the Illinois text was taken from the Public Act and the Illinois Supreme Court's decisions because the legislature's site refused automated access.

The laws at a glance

Illinois: the Biometric Information Privacy Act

BIPA applies to any private entity that collects a biometric identifier, defined as a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry, from an Illinois resident. Before collecting, the entity must inform the person in writing that the identifier is being collected, state the purpose and the length of time it will be stored, and obtain a written release, which in the employment context means a release executed as a condition of employment. It must publish a written policy with a retention schedule and destruction guidelines, destroy the data when the purpose is satisfied or within three years of the last interaction, store it with at least the care applied to other confidential information, and never sell, lease or profit from it. Disclosure to a third party, including the time clock vendor and the payroll processor, requires consent or legal compulsion.

Three Illinois Supreme Court decisions made the statute dangerous. Rosenbach v. Six Flags (January 25, 2019) held that a person is "aggrieved" and may sue without proving any harm beyond the violation itself. McDonald v. Symphony Bronzeville Park (February 3, 2022) held that the Workers' Compensation Act does not bar employees' BIPA claims. Cothron v. White Castle (February 17, 2023) held that a separate claim accrued on every scan, so an employee who clocked in twice a day for five years had thousands of violations, and White Castle told the court its exposure exceeded $17 billion. The same court's Tims v. Black Horse Carriers (February 2, 2023) set a five-year limitations period.

Public Act 103-0769, signed August 2, 2024, answered Cothron: a private entity that collects the same biometric identifier from the same person by the same method more than once commits a single violation, and the person may recover for one violation only. It also made an electronic signature a valid written release. On April 1, 2026 the Seventh Circuit held in Gregg v. Central Transport that the amendment applies to cases that were pending when it took effect, because it clarified rather than changed the law. Illinois state courts are not bound by that reading, and the question remains open for cases filed in state court. The amendment caps per-person exposure at $1,000 or $5,000, but with a thousand employees that is still $1 million to $5 million per class, and the statute's fee-shifting makes small classes worth bringing.

BIPA settlements over time clocks

Outside timekeeping, the biggest numbers are Rogers v. BNSF, where a $228 million jury verdict over truck drivers' fingerprint scans at rail yards (October 2022) was vacated and replaced by a $75 million settlement in 2024, Walmart's $10 million palm scanner settlement (2021), and Meta's $650 million over photo tagging (2021). Two patterns run through the time clock cases. Vendors are sued alongside employers because BIPA reaches anyone who "collects" or "obtains" the identifier, and courts have refused to let vendors hide behind the employer's consent; and the defense that a partial fingerprint template is not a "fingerprint" has failed every time it was raised, including in Speedway.

Texas

Business and Commerce Code 503.001 forbids capturing a retina or iris scan, fingerprint, voiceprint or record of hand or face geometry for a commercial purpose without first informing the person and getting consent. The identifier may not be sold, leased or disclosed except for identification of a missing or deceased person, to complete a financial transaction the person requested, as required by law, or to law enforcement under a warrant. It must be stored with reasonable care and destroyed within a reasonable time, no later than the first anniversary of the date the purpose for collecting it expires; where an employer collected it for security purposes, the purpose is presumed to expire when the employment relationship ends. The statute does not define "commercial purpose", but its employer clause assumes employers are covered, and practitioners treat time clocks as within it. Only the Attorney General may sue, for a civil penalty of up to $25,000 per violation; the office's $1.4 billion settlement with Meta in 2024 shows the scale it will pursue, but there has been no reported action against an employer over a time clock.

Washington

RCW 19.375 is narrower than its reputation. It bars enrolling a biometric identifier in a database for a "commercial purpose" without notice, consent or a mechanism to prevent later commercial use, and defines commercial purpose as furthering the sale or disclosure of the identifier to a third party for marketing of unrelated goods or services. Section 19.375.020(7) says no notice or consent is needed to enroll for a security purpose, meaning preventing shoplifting, fraud or theft, or protecting the security of an account or system. Photographs, video and audio recordings and HIPAA-regulated data are excluded from the definition. An ordinary employee time clock is not a sale of data for marketing, so the statute's consent requirement likely does not reach it; competitor pages that list Washington as a consent state for time clocks overstate the law. Enforcement is by the Attorney General under the Consumer Protection Act, with no private action. Washington's My Health My Data Act (RCW 19.373) covers biometric data only where it is health data.

Colorado

House Bill 24-1130 amended the Colorado Privacy Act from July 1, 2025 to cover biometric identifiers of employees and applicants, a group the Act otherwise excludes. An employer must obtain consent that is specific, informed and unambiguous, given by a clear affirmative act; electronic consent is valid and opt-out is not. Employment may be conditioned on consent only for four uses: access to secure physical locations or hardware and software; recording the start and end of the full workday, including meal and rest breaks over 30 minutes; workplace safety or security; and public safety in emergencies. Consent is not needed for roles where collection is reasonably expected, such as security staff, or for background checks on applicants. The employer must adopt a written biometric policy with a retention schedule, a security incident response protocol and deletion guidelines, and must delete the data at the earliest of the purpose being satisfied, 24 months after the last interaction, or 45 days after deciding storage is no longer needed. The Attorney General and district attorneys enforce, with penalties up to $20,000 per violation and no private action. Whether the Act's general employment-records exemption still shelters some employee data is unsettled.

New York City, Portland and other cities

New York City's biometric identifier law, Administrative Code 22-1201 to 22-1205, in force July 9, 2021, requires commercial establishments that collect customers' biometric identifiers to post a conspicuous sign at every entrance, and bans selling or sharing the data for value. Customers may sue after a 30-day notice and cure period, for $500 per signage violation and $500 to $5,000 per sale violation. The law covers customers, not employees, so an employee time clock in a Manhattan store is outside it. Portland's 2021 ordinance bans private use of facial recognition in places of public accommodation with a private right of action of $1,000 a day; a back-office time clock is unlikely to be a place of public accommodation, but a face scan clock at a retail counter could be. Maryland's 3-717 requires a signed waiver before using facial recognition in a job interview, a hiring rule rather than a timekeeping one, and bills modeled on BIPA were pending in Massachusetts (S.B. 2204) and New York (S 2539) in 2026 without passing.

States that call biometrics sensitive data

California, Virginia, Colorado, Connecticut, Utah, Oregon, Texas, Montana, Maryland, Delaware, New Jersey and a dozen more states have comprehensive consumer privacy laws that classify biometric data as sensitive and require opt-in consent or a notice and opt-out before processing it. Most of them exclude employees and job applicants from the definition of "consumer", so they do not reach workplace time clocks; Virginia, Connecticut, Oregon and Texas say so expressly. California's CCPA is the exception. Since January 1, 2023 it covers employee data, so a California employer that collects fingerprints or face scans must give a notice at collection describing the purpose and retention period, honor access and deletion requests, and, under the regulations in force from January 1, 2027, treat any automated decision based on that data under the automated decision-making rules. The CCPA has a private right of action only for data breaches, including breaches of biometric data, with statutory damages of $100 to $750 per consumer per incident. Our employee monitoring laws by state page covers the notice statutes that sit alongside these.

What a compliant consent and retention policy contain

A single document can satisfy Illinois, Texas and Colorado if it contains these elements, and a version of it is the right practice everywhere:

1. What is collected, in the statute's words: a scan of fingerprint or hand or face geometry, and that a mathematical template rather than an image is stored, if that is true.
2. The specific purpose: recording the start and end of work time and breaks, and access to the premises if applicable. Colorado limits conditioning employment on consent to these purposes.
3. The retention period and the destruction trigger: the earlier of the purpose ending (separation) and the statutory maximum (three years after last interaction in Illinois, 24 months in Colorado, one year after the purpose expires in Texas). Pick the shortest and apply it everywhere.
4. Every third party that receives the data: the time clock vendor, the payroll processor, any cloud host, with the purpose of each disclosure. BIPA requires consent to disclosure, not just collection.
5. A statement that the data will not be sold, leased or traded, and how it is secured.
6. A written or electronic signature, dated, obtained before the first scan. Enrollment on the clock itself is not consent.
7. A copy of, or link to, the published retention and destruction policy, which Illinois requires to be publicly available and Colorado requires to exist in writing.
8. A non-biometric alternative, a PIN or badge, for employees who decline. Illinois does not require one, but offering it is the cheapest defense to a claim that consent was coerced, and Colorado's limits on conditioning employment make it necessary for any use outside the four permitted purposes.

Our employee monitoring consent form has a biometric clause built on this list, and the monitoring policy template has the retention schedule.

When not to use a biometric clock

For a small Illinois employer the arithmetic rarely works. Buddy punching costs the average employer a few hours a week; a BIPA class with fifty employees and a missing release is worth $50,000 to $250,000 before fees. Photo-capture clocks, which take a picture at each punch and compare it by eye or by an algorithm that does not create a stored face template, avoid the statute in most readings, as do PIN and badge clocks with GPS or geofence checks. Where a fingerprint clock is still the right tool, buy it from a vendor that has been through BIPA litigation and now ships consent workflows, choose a model that stores a template rather than an image, and get the release signed on paper or by electronic signature before enrollment. Our clock in clock out app review notes which products offer a non-biometric kiosk mode, and our time theft statistics page puts the buddy punching cost in context.

Key takeaways

• Illinois BIPA requires a written release, a published retention policy and destruction within three years of the last interaction before a fingerprint or face scan time clock can be used, with a private right of action worth $1,000 or $5,000 per person.
• The August 2, 2024 amendment limits recovery to one violation per person per method, reversing Cothron v. White Castle's per-scan rule; the Seventh Circuit applied it retroactively on April 1, 2026, but Illinois state courts have not ruled.
• Time clock settlements include Speedway $12.1 million, Kronos $15.3 million, Compass and 365 Retail Markets $6.8 million, NOVAtime $4.2 million, and seven-figure payments by Ceridian, Paychex, iSolved, RR Donnelley, WorkEasy, Epay, Accu-Time and Lifespace.
• Texas requires notice and consent and destruction within a year of the purpose ending, enforced only by the Attorney General at up to $25,000 per violation.
• Washington's statute applies only to enrollment for a commercial purpose and exempts security purposes, so an ordinary time clock is probably outside it.
• Colorado, since July 1, 2025, requires affirmative consent from employees, allows employment to be conditioned on it only for access, timekeeping, safety and emergencies, and sets a 24-month retention limit.
• New York City's law covers customers, not employees; most state consumer privacy laws exclude employees, but California's CCPA does not.
• A compliant program has a signed release before the first scan, a published retention policy, consent to vendor disclosure and a non-biometric alternative for those who decline.