Texas biometric law at work: fingerprint clocks, face scans and the employer rules in Business and Commerce Code 503.001

Texas regulates fingerprints, face geometry, voiceprints and eye scans through section 503.001 of the Business and Commerce Code, titled "Capture or use of biometric identifier" (Tex. Bus. & Com. Code 503.001). It applies to any person that captures these identifiers for a commercial purpose, which in practice includes employers using biometric time clocks, door access or identity checks. It was last amended by House Bill 149, the Texas Responsible Artificial Intelligence Governance Act, with effect from 1 January 2026. This page explains what it means at work.

The short answer: before capturing a worker's biometric identifier, an employer must inform the worker and receive their consent. It may not sell or disclose the identifier except in listed cases, must protect it at least as well as other confidential information, and must destroy it within a reasonable time and no later than one year after the purpose for collecting it expires. For identifiers an employer collects for security purposes, that purpose is presumed to expire when the employment ends. The Attorney General can sue for a civil penalty of up to $25,000 per violation (503.001(b)-(d)).

What is covered

• Biometric identifier: "a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry" (503.001(a)(2)).
• Commercial purpose: the rules apply to capture "for a commercial purpose" (503.001(b)). The section does not define the phrase, so employers should not assume workplace uses fall outside it.
• Exclusions: voiceprint data kept by financial institutions, and since 2026 the training, processing or storage of biometric identifiers to develop or offer AI models or systems, unless a system is used to uniquely identify a specific individual, and AI used for security, fraud prevention or investigating illegal activity (503.001(e)). If identifiers captured to train AI are later used for another commercial purpose, the ordinary rules and penalties apply again (503.001(f)).

What employers must do

• Inform and get consent first: inform the individual before capture and receive their consent (503.001(b)). Unlike Illinois, the text does not require the notice or consent to be in writing, but a written record is the easiest way to show it happened.
• Public images are not consent: a photo or other media on the internet does not count as notice or consent unless the person made it public themselves (503.001(b-1)).
• No sale or disclosure: the identifier may not be sold, leased or disclosed unless the person consents to disclosure for identification if they disappear or die, the disclosure completes a financial transaction they requested, a federal or other state statute requires or permits it, or it goes to or from law enforcement under a warrant (503.001(c)(1)).
• Protect it: with reasonable care, and at least as well as other confidential information the employer holds (503.001(c)(2)).
• Destroy it on time: within a reasonable time and no later than the first anniversary of the date the purpose expires, or, if the identifier is tied to a document another law requires to be kept longer, no later than one year after that retention period ends (503.001(c)(3), (c-1)).
• Security uses end with the job: if an employer collected the identifier for security purposes, the purpose is presumed to expire when the employment relationship ends (503.001(c-2)), so the one-year clock runs from that date.

Enforcement

A violation carries a civil penalty of up to $25,000 each, and the Attorney General may bring the action (503.001(d)). The section names no other enforcer and does not mention a private lawsuit, which is a key difference from Illinois's BIPA, where any aggrieved person can sue.

What this means in practice

• Employers: list every clock, door reader, app and AI tool that reads fingerprints, faces, hands, eyes or voices. Tell workers before enrolling them, record their consent, check vendor contracts against the disclosure limits, and set a deletion date no later than one year after the purpose ends, or after employment ends for security uses.
• Workers: you should be told before your fingerprint, face or voice is captured and asked to consent. After you leave, ask when your biometric data will be destroyed. Complaints go to the Texas Attorney General.

For the Illinois rules, see Illinois BIPA at work, and for Washington, see Washington biometric law at work. For the wider Texas AI law, see the Texas AI law and employment, and for workplace surveillance more widely, US employee monitoring laws. For all four state biometric laws side by side, see biometric privacy laws at work compared.

This page covers Texas and is general information based on the statute text published by the Texas Legislature when checked on 3 November 2026, not legal advice.