Biometric data has become a focal point in privacy law, but whether it is legally classified as personally identifiable information (PII) varies by jurisdiction and context. In the United States, there is no single federal definition of PII; instead, laws often define PII or similar terms in ways that may or may not include biometrics. This article clarifies when biometric data is treated as PII, how major laws address it, and practical implications for organizations that collect or store biometric information.
What Counts As PII In U.S. Law
PII generally refers to information that can be used to identify an individual, either alone or when combined with other data. In the U.S., there is no universal definition enforced across all sectors. Some statutes define PII or sensitive data narrowly, while others use broader terms like “personally identifiable information,” “sensitive data,” or “private information.” The classification often depends on the statute’s purpose, sector (e.g., healthcare, financial services), and the data’s context.
Biometric data—such as fingerprints, iris scans, facial recognition templates, voiceprints, and palm prints—can be considered PII when paired with identifiers like a name, account number, or address. Even without a direct identifier, some laws treat biometric data as sensitive information that merits special protections due to its unique, immutable nature and potential for misuse.
Biometric Data As PII
Biometric data is unique to an individual and can enable precise identification. Because biometric identifiers are immutable, the consequences of a data breach can be more severe than for passwords or other credentials. In practice, biometric data is often treated as sensitive PII under applicable state and federal rules. However, some laws specifically address biometrics in separate categories, such as “biometric information” or “biometric identifiers.” When a statute mentions biometrics, it typically imposes stricter safeguards and consent requirements than generic PII rules.
Key considerations include whether biometric data is stored as raw data (e.g., fingerprint minutiae) or as a derived template. Some laws restrict reuse or require secure storage, encryption, and limited retention. The interpretation at the state level can vary, with several states adopting comprehensive biometric privacy statutes that designate biometrics as sensitive data with explicit protections.
Key U.S. Laws And Regulations
Federal privacy law in the United States does not have a single biometric privacy standard. Instead, several sector-specific laws and regulations address biometrics in different ways:
- Biometric privacy statutes in some states: States like Illinois (Biometric Information Privacy Act, BIPA), Texas, Washington, and others impose explicit consent, disclosure, data retention, and destruction requirements for biometric data, often treating it as highly sensitive PI data.
- Health information privacy: The Health Insurance Portability and Accountability Act (HIPAA) protects biometric information when it is part of protected health information (PHI). Covered entities must implement safeguards for PHI, which can include biometric identifiers used for patient identification or authentication.
- Financial data: The Gramm-Leach-Bliley Act (GLBA) governs financial institutions, including the safeguarding of customer information, which can encompass biometric data used for authentication in financial services.
- Education data: The Family Educational Rights and Privacy Act (FERPA) protects student records, which may include biometric data collected by schools in some contexts (e.g., attendance systems).
- Consumer protection and data breach laws: Various states require notification and security measures when biometric data is compromised, highlighting its special treatment in breach scenarios.
Federal emphasis often centers on data breach notification and consumer consent for sensitive data. In states with comprehensive biometric statutes, biometric data is treated as a discrete, highly sensitive category with stricter consent, disclosure, and retention standards.
State Variations
State approaches to biometric data differ markedly. The strongest and most well-known protections come from Illinois’ BIPA, which mandates informed consent for collection, a written policy on data retention, and damages for violations. Other states have adopted biometric privacy or data security laws that emphasize security measures, minimum protection standards, and breach notification rights. Some states treat biometrics as part of broader PII definitions, with varying requirements for handling, storage, and deletion.
Organizations operating across multiple states should map biometric data processing activities to the relevant state statutes, implement robust consent practices, and adopt uniform security controls to minimize risk and ensure compliance regardless of jurisdiction.
Best Practices For Businesses
- Obtain clear consent for collecting biometric data, with easily accessible privacy notices that explain purposes, retention periods, and rights.
- Limit collection to information that is strictly necessary for the stated purpose and avoid collecting extraneous biometrics.
- Secure storage use strong encryption, secure templates (not raw data where possible), and access controls to protect biometric data at rest and in transit.
- Transparent retention policies define retention timelines and secure destruction methods once data is no longer needed.
- Audit and breach readiness implement regular security assessments, incident response plans, and breach notification procedures in line with applicable laws.
- Vendor management ensure third-party processors comply with biometric protections and data handling standards.
- Regular training educate employees on biometric data handling, privacy obligations, and incident reporting.
Common Misconceptions
- Biometric data is never PII: It can be PII or sensitive data when linked to identifiers or controlled under specific laws.
- All biometric data is treated the same across the U.S.:
- There is significant variation by state and by federal sector-specific regulations, so protections differ by context.
- De-identified biometric data loses protections: Even anonymized or tokenized biometrics may be subject to certain safeguards, depending on the law and data form.
In practice, understanding whether biometric data is PII depends on the applicable law, the data’s context, and how it is used. In many U.S. scenarios, biometrics are treated as highly sensitive PII or as a separate category requiring heightened safeguards.
Practical Takeaways
- Assess the regulatory landscape for biometric data where the business operates, including state biometric statutes and sector-specific federal laws.
- Implement consent-focused, transparent privacy notices for biometric data collection and usage.
- Prioritize secure storage of biometric data, favoring templates over raw data when feasible, and enforce strict access controls.
- Prepare for breach scenarios with clear notification protocols that align with applicable laws.