Fingerprint time clocks, face scans at the door and voice checks are now common at work, and a handful of US states have laws on biometric data. They differ sharply: what triggers the rules, whether consent must be written, how fast data must be deleted, and above all whether workers can sue. This page compares the four state laws we have covered from their statute text: Illinois (740 ILCS 14), Texas (Bus. & Com. Code 503.001), Washington (RCW 19.375) and Colorado (HB24-1130, C.R.S. 6-1-1314). Other states and cities have their own rules, so check where you work.
The short answer: Illinois has the most detailed requirements and is the only one of the four that lets workers sue for set damages. Texas requires notice and consent with a one-year deletion deadline, enforced by the Attorney General. Washington's duties apply mainly to enrollment for a narrowly defined commercial purpose. Colorado is the only one with rules written for employers, listing the uses a job can require.
Side by side
| Illinois | Texas | Washington | Colorado | |
|---|---|---|---|---|
| What triggers the rules | Any private entity collecting biometric data | Capture for a commercial purpose | Enrollment for a commercial purpose, defined as sale or disclosure for unrelated marketing | Any controller holding biometric identifiers, at any volume |
| Before collecting | Written notice of purpose and term, and a written release | Inform the person and receive consent | Notice, consent or an opt-out mechanism | Notice of collection, purpose, retention and sharing, and consent before collecting biometric data |
| Rules written for employers | A release can be a condition of employment | Security purposes presumed to end when employment ends | None; security purposes excluded | Consent can be required only for access, clocking in and out, safety and security, and emergencies |
| Deletion deadline | Purpose satisfied or 3 years after last interaction, whichever first | Reasonable time, no later than 1 year after the purpose expires | No longer than reasonably necessary | Earliest of purpose satisfied, 24 months after last interaction, or 45 days after an annual review |
| Sale of data | Banned | Banned | Disclosure for a commercial purpose limited without consent | Banned |
| Who enforces | Any aggrieved person can sue | Attorney General | Attorney General only | Within the Colorado Privacy Act; no private suit in the section |
| Money at stake | $1,000 per negligent and $5,000 per intentional or reckless violation, or actual damages | Up to $25,000 per violation | Under the Consumer Protection Act | Not set in the section |
The main differences
- The private lawsuit: only Illinois gives any aggrieved person a right to sue for set amounts (14/20). Since 2024, repeated collection of the same data from the same person by the same method counts as one violation. Texas leaves enforcement to the Attorney General (503.001(d)), and Washington says its chapter may be enforced solely by the Attorney General (19.375.030(2)).
- Written consent: Illinois requires a written release, which in employment can be signed as a condition of the job (14/10, 14/15(b)). Texas requires consent without saying it must be written (503.001(b)).
- What a job can require: Colorado lets an employer make biometric consent a condition of employment only for secure access, recording the work day, workplace safety or security, and public emergencies, and bars making any other use a condition or retaliating against a worker who says no (6-1-1314(6)).
- Narrow scope in Washington: its definition of commercial purpose excludes security and law enforcement purposes, and nothing in its main section requires notice and consent for security purposes (19.375.010(4), 19.375.020(7)), so many workplace uses may fall outside it.
- Deletion: Texas sets a firm one-year outer limit (503.001(c)(3)), Colorado 24 months after last interaction (6-1-1314(2)(a)(III)) and Illinois 3 years (14/15(a)).
What this means in practice
- Employers in several states: the strictest common rule works everywhere: written notice of what is collected, why and for how long, a signed release, a published retention and deletion policy, no sale, and vendor contracts that match. In Colorado, keep required uses to the four listed purposes.
- Workers: ask what is captured, who receives it and when it will be deleted. Your options to act depend heavily on the state, from a direct lawsuit in Illinois to a complaint to the Attorney General in Texas and Washington.
Read each state in full: Illinois BIPA at work, Texas biometric law at work, Washington biometric law at work and Colorado biometric data at work. For face analysis in job interviews, see facial recognition in job interviews in Maryland.
This page is general information based on the statute texts published by the Illinois, Texas, Washington and Colorado legislatures when checked on 3 November 2026, not legal advice.
Questions and answers
Which states have biometric privacy laws that cover employers?
Among the states covered on this site, Illinois, Texas, Washington and Colorado. Other states and cities have their own rules.
Can I sue my employer over a fingerprint time clock?
In Illinois, any person aggrieved by a BIPA violation can sue. Texas and Washington leave enforcement to the Attorney General, and Colorado's section does not create a private lawsuit.
Can my employer make biometric consent a condition of the job?
In Illinois a written release can be signed as a condition of employment. In Colorado, only for secure access, clocking in and out, workplace safety or security, and public emergencies.
How long can an employer keep my fingerprint data?
Illinois: until the purpose is satisfied or 3 years after your last interaction, whichever is first. Texas: no later than 1 year after the purpose expires. Colorado: the earliest of purpose satisfied, 24 months, or 45 days after an annual review. Washington: no longer than reasonably necessary.