Statutes governing biometric identifiers impose specific obligations and, in some states, a private right of action with statutory damages that has produced very large aggregate exposure.

Covered data. Retina and iris scans, fingerprints, voiceprints, and scans of hand or face geometry. Photographs and information derived from them are treated differently across statutes, and that distinction has been extensively litigated.

Requirements. Written notice that biometric data is being collected and the purpose; the length of term for which it will be collected, stored and used; and a written release before collection.

Retention schedule. A publicly available written policy providing for destruction when the purpose is satisfied or within a stated period after the last interaction, whichever occurs first. Failure to publish a policy is itself a violation.

No sale or profit from biometric data, and disclosure only with consent or under narrow exceptions.

Security using the reasonable standard of care in the industry.

Damages. Statutory amounts per violation, with negligent and intentional tiers, and courts have held that each scan can constitute a separate violation.

Where it arises. Timekeeping systems, access control, voice authentication in call centers, and photo tagging features.