Which States Have Biometric Privacy Laws?

Quick answer: There's no comprehensive federal biometric privacy law in the U.S. Illinois and Texas currently have the strongest protections, and Illinois' law is the most enforceable because it includes a private right of action, letting individuals sue directly.

There is no comprehensive federal biometric privacy law in the United States. Protection exists, where it exists at all, state by state, with meaningfully different levels of strength.

The states leading on enforcement

Illinois and Texas are the most aggressive on biometric privacy, and Illinois in particular stands out for including a private right of action, meaning individuals can sue directly over a violation, rather than relying solely on a regulator to act on their behalf. A number of other states have passed comprehensive privacy laws that touch on biometric data as one category among several, but generally without the same enforcement teeth as Illinois' dedicated statute.

Why "private right of action" matters so much

Most privacy law violations require a regulator or attorney general to pursue enforcement. A private right of action changes that by letting an individual bring a lawsuit themselves, a much more direct and immediate enforcement mechanism, and part of why Illinois' biometric law has had an outsized real-world impact. Companies operating nationally have, in many cases, changed their product design specifically to comply with Illinois' law, even for users outside the state, simply because building two different versions of a feature is often less practical than building one that satisfies the strictest applicable standard.

The federal picture

At the national level, U.S. biometric protection remains comparatively weak, leaving significant gaps for anyone outside a state with a strong statute. This means the practical level of protection an individual has over their own facial geometry or voiceprint can vary dramatically depending purely on which state they happen to live in, a patchwork that AI's borderless, internet-scale nature makes increasingly awkward to enforce.

FAQ

Which U.S. states have the strongest biometric privacy laws? Illinois and Texas currently have the most aggressive biometric privacy statutes, including a private right of action provision in Illinois' law.

Is there a federal biometric privacy law in the U.S.? No. At the national level, biometric protection is comparatively weak, and coverage depends heavily on which state you're in.

What is a "private right of action" and why does it matter? It allows an individual to sue directly over a violation, rather than requiring a regulator to pursue enforcement on their behalf, making the law significantly easier to actually enforce.