Growing Privacy Concerns with the Increased Use of Biometric Identification

By: Elena Allen

The increased use of biometric identification, particularly on social media, has led to new issues of personal data privacy and consent.

What is biometric identification? Biometric identifiers are facets of a person’s physical being that can be used to verify their identity such as fingerprints, facial structure, voice pattern, gait pattern, and iris or retina image.[1] Social media websites play a large role in lawsuits regarding the privacy and consenting to the use and selling of biometric data.[2] There are many ways social media sites use biometric data; including use of physical movement data to track GPS location, facial recognition software to identify tagged photos, as well as fingerprint and facial recognition software to login and interact within the apps.[3]

All of these uses of biometric data have brought a flurry of privacy concerns and risks.[4] The average user does not read the “terms of use” text detailing the company’s use of their data which is often beyond the user’s comprehension.[5] There are also concerns about privacy regarding how this data will be used and how long it will be stored and what agendas it will be used for.[6]

How is this information being regulated? There are only three states in the U.S. that have enacted statutes addressing private entities’ use of biometric data – Illinois, Texas, and Washington.[7] Illinois enacted the Illinois Biometric Information Privacy Act (BIPA) in 2008 regulating non-governmental entities use of biometric data and imposes five general requirements.[8] There must be a written consent telling users their data will be collected, a separate consent for entities that wish to disclose or disseminate this information, the act prohibits a company from profiting off of the collected data, there must be a retention schedule detailed, and a reasonable standard of care used.[9]

In a recent lawsuit, an Illinois District court dismissed a claim for lack of jurisdiction when a user of the dating site, OKCupid, filed a class action lawsuit against a New York technology company alleging they used her facial image from the site for profit without her consent in violation with BIPA.[10] Personal jurisdiction issues are prominent in these lawsuits especially because the connections between parties are often indirect through data collection.[11]

New York City has enacted a new biometric privacy ordinance requiring businesses that collect this data to post explicit notices and signs on their doors detailing to the customers how their data will be collected.[12] This will affect many retailers, stores, restaurants, and theaters.[13] This ordinance is a step in the right direction to clarify when people should be aware of their data being collected.[14]

The current lawsuits and legislation show that with the increased collection and misuse of biometric data comes more Internet users feeling concerned, fearful, and often confused in a world full of new and growing data privacy concerns.


[1] Frank Nolan, Implications of US Laws on Collection, Storage, and Use of Biometric Information, Eversheds Sutherland Biometrics Whitepaper (July 2020), https://us.eversheds-sutherland.com/portalresource/Biometrics%20whitepaper_July%202020.pdf.

[2] Rivkin Radler, Businesses Face New Litigation Risk Over Biometric Information, JDSupra (Aug. 16, 2021), https://www.jdsupra.com/legalnews/businesses-face-new-litigation-risk-6238256/.

[3] Danny Thomas, Biometrics in Social Media Apps: Opportunities and Risks, Bayometric, https://www.bayometric.com/biometrics-in-social-media-apps/, (Last visited Sept. 22, 2021).

[4] Id.

[5] Id.

[6] Id.

[7] Nolan, supra note 1

[8] Id.

[9] Id.

[10] Stein v. Clarifai, Inc., No. 20 C 1937, 2021 U.S. Dist. LEXIS 49516, at *1-2 (N.D. Ill. Mar. 15, 2021).

[11] Nolan, supra note 1.

[12] Zack Whitaker, New York City’s new biometrics privacy law takes effect, Tech Crunch (July 9, 2021, 8:00 AM), https://techcrunch.com/2021/07/09/new-york-city-biometrics-law/.

[13] Id.

[14] Id.