Biometric Time Clocks and BIPA: Illinois, Texas, Washington and Other State Privacy Laws

If you collect fingerprints, face scans or other biometric identifiers for timekeeping, you may need written notice, written consent and a public retention policy first. Illinois's Biometric Information Privacy Act (BIPA, 740 ILCS 14) is the strictest law, and Texas and Washington also regulate biometric identifiers.

This article explains what BIPA requires, how a 2024 amendment changed the damages exposure, what Texas and Washington add, and when a non-biometric clock-in is the simpler choice.

What BIPA requires

BIPA applies to private entities that collect biometric identifiers such as fingerprints, retina scans and face geometry. Before collecting, you must give written notice that biometric data is being collected and why, state how long it will be kept, and obtain a written release from the person. You must also publish a retention schedule and destroy the data when the purpose ends.

The law covers employees, applicants and customers. It also restricts selling or profiting from the data and requires reasonable security. Because BIPA allows private lawsuits, the practical risk is class action litigation, not a state agency fine.

Biometric identifiers are different from passwords because they cannot be changed. That permanence is why lawmakers treat a breach as more serious, and why consent and security are central to every statute.

The 2024 amendment and damages

Illinois courts had held that each scan could be a separate violation, which made damages enormous. A 2024 amendment (SB 2979) limits recovery to one violation per person, not per scan, and allows electronic signatures for the written release. That reduced the exposure, but it did not remove it.

A violation can still bring statutory damages and attorney fees, and a class can include every employee who used the clock. For an employer with 200 employees, even one violation per person is a serious number. Ask counsel for the current damages figures before you set a budget.

Employers sometimes assume that a vendor's consent form is enough. It is not, if the form lacks the required elements, or if the vendor's template does not match your retention policy. The employer is the party that must comply, so review the documents yourself.

Texas, Washington and other states

Texas regulates biometric identifiers under CUBI, which requires notice and consent, limits sharing, and calls for destroying the data within a reasonable time. Washington has its own biometric law, and several state privacy statutes cover biometric data with employee exceptions that vary. Enforcement differs: Texas relies on the attorney general, while Illinois lets individuals sue.

Because laws vary and are changing, check your state before rolling out a biometric device in a multistate workforce. This is general information, not legal advice, and counsel should confirm how each law applies.

A compliance checklist for biometric clocks

If you use biometrics, follow a short list. 1. Draft the written policy with the purpose and retention period. 2. Give each employee a written notice. 3. Get a signed release before the first scan. 4. Post or publish the retention policy. 5. Delete data when employment ends, or within the legal deadline.

Also review the vendor contract. If a vendor holds the templates, the contract should require security, deletion and cooperation. Employees who refuse should be offered an alternative method, since the law does not let you assume consent.

Keep the signed releases for as long as you keep the data, and a reasonable period after, since you may need them to answer a claim years later. Store them separately from the personnel file.

Simpler alternatives

The FLSA does not require a specific device, so there is no legal reason to use biometrics. Buddy punching is the usual argument for them, but it can be handled by other controls, such as location captured at the moment of the punch, unique logins and manager review of exceptions. Our article on buddy punching and time theft lists the options.

A system that does not collect biometric identifiers avoids the biometric laws entirely, along with the training and retention burden. For many small and midsize employers, that is the simplest and safest path.

If you already collect biometrics, do not wait to find out whether the program is compliant. Audit the notices, releases and retention schedule now, and have counsel decide whether to re-consent employees.

Data security and retention

Whatever you collect, treat timekeeping data as sensitive. Limit access, use encryption in transit and at rest, and define how long records stay. Wage records must be kept for at least 3 years, and time cards for 2 years under the FLSA, but biometric templates are not wage records and should be deleted sooner.

For a broader view of retention and employee access, see timekeeping data privacy. Align the deletion schedule with the written retention policy that biometric laws require.

Applicants, contractors and multistate workforces

The duties do not stop at employees. If you scan applicants at an on-site interview, or contractors who badge into a site, the same notice and consent steps may apply. Collect only what you need and for the shortest time.

With a multistate team, the simplest approach is to follow the strictest rule everywhere, which today is usually Illinois. That gives you one process, one form and one retention policy. The alternative is a state-by-state matrix, which is harder to maintain and easier to get wrong.

Biometric laws are also moving. New state privacy statutes and amendments appear regularly, and court decisions keep changing how BIPA is read. Put a calendar reminder to review your program every six months and ask counsel whether anything changed.

How SimpleWorkshift Helps Without Biometrics

SimpleWorkshift does not use fingerprints or face scans. Employees clock in and out from the iOS or Android app or the web, and GPS location is captured with each entry, giving managers GPS-verified time entries and real-time views of exceptions.

Work schedules per employee, automatic overtime calculations and custom reports support accurate, defensible records. You get the accountability without a biometric consent program. Start a 30-day free trial, with no contracts and cancel anytime, at simpleworkshift.com.