Biometric Modalities

Defines the three primary capture methods (fingerprint, facial recognition, iris) plus the key data artifact (facial geometry scan) that trigger different legal treatment across states.

Fingerprint Recognition

Fingerprint recognition is a biometric identification method that captures and matches the unique ridge patterns on an individual's fingertip. In timekeeping, it is the most widely deployed modality and is explicitly regulated as a biometric identifier under BIPA, CUBI and most state statutes.

Also known as: fingerprint scanning, fingerprint biometrics

Illinois BIPA, Texas CUBI and Washington HB 1493 all explicitly enumerate fingerprints as a regulated biometric identifier.

Facial Recognition

Facial recognition is a biometric identification method that maps facial geometry, the spatial relationships between facial features, to verify identity. It is subject to stricter or separate regulation in several states and is banned for mandatory employment use in some jurisdictions.

Also known as: face recognition, facial biometrics

New York City's Biometric Identifier Information Law (Local Law 2021/No. 3) specifically targets commercial use of facial recognition.

Iris Recognition

Iris recognition is a biometric identification method that captures the unique pattern of the colored ring of the eye to verify identity. It is enumerated as a regulated biometric identifier under BIPA and most state statutes and is used in high-security timekeeping environments.

Also known as: iris scanning, iris biometrics

Iris-based time clocks are most common in high-security enterprise deployments where contactless verification and high accuracy are required.

Facial Geometry Scan

A facial geometry scan is the specific data artifact produced by facial recognition, a mathematical representation of the spatial measurements of a face. Statutes including BIPA explicitly name facial geometry scans, not raw images, as the regulated biometric identifier, distinguishing them from photographs.

Also known as: faceprint, facial template

BIPA's definition of biometric identifier excludes photographs but includes scans of facial geometry, a distinction central to compliance analysis.

State Statutes and Frameworks

Covers the named laws buyers encounter most, from BIPA and CUBI through Washington, California, New York and the federal baseline question, giving multi-state employers the statutory vocabulary they need.

BIPA (Biometric Information Privacy Act)

BIPA is Illinois's 2008 statute (740 ILCS 14) that regulates private-sector collection, storage, use and destruction of biometric identifiers and information. It is the most litigated biometric privacy law in the U.S. and the benchmark against which other state statutes are compared. EasyClocking by WorkEasy Software includes configurable consent workflow templates, retention schedule enforcement and destruction audit logs for Illinois locations.

Also known as: Illinois BIPA, 740 ILCS 14

BIPA provides a private right of action with liquidated damages, the highest enforcement exposure of any U.S. biometric statute.

CUBI (Capture or Use of Biometric Identifier Act)

CUBI is Texas's biometric privacy statute (Tex. Bus. and Com. Code § 503.001) that prohibits capturing biometric identifiers for commercial purposes without informed consent. Unlike BIPA, CUBI is enforced exclusively by the Texas Attorney General; it has no private right of action.

Also known as: Texas CUBI, Texas biometric law

CUBI carries civil penalties enforced by the Texas AG with no individual plaintiff standing, making its enforcement profile distinct from BIPA.

Washington HB 1493

Washington HB 1493 is Washington State's biometric privacy law (RCW 19.375) that requires informed consent before enrolling biometric identifiers and prohibits selling biometric data. Like CUBI, it is enforced by the state Attorney General rather than through a private right of action, limiting individual litigation exposure.

Also known as: RCW 19.375, Washington biometric law

Washington HB 1493 applies to biometric identifiers used for commercial purposes, including employee timekeeping, and requires a publicly available retention and destruction policy.

California Biometric Regulation (CCPA/CPRA)

California's biometric regulation operates primarily through the CCPA and its 2020 amendment CPRA, which classify biometric data as sensitive personal information subject to opt-out rights and disclosure requirements. California lacks a standalone biometric statute equivalent to BIPA but has the nation's broadest consumer privacy framework. EasyClocking by WorkEasy Software generates CCPA-compliant biometric data disclosures and opt-out workflows for covered California employers.

Also known as: CCPA biometric rules, CPRA biometric provisions

California Labor Code § 1051 separately prohibits fingerprinting employees as a condition of employment in certain contexts, a restriction distinct from CCPA.

New York Biometric Law (DCWP and Local Law 2021/No. 3)

New York's biometric regulation combines New York City's Biometric Identifier Information Law (Local Law 2021/No. 3), enforced by the NYC Department of Consumer and Worker Protection, with New York State's proposed but not-yet-enacted statewide statute. The NYC law requires posted notice and prohibits selling biometric data collected from customers and employees.

Also known as: NYC biometric law, NYC Local Law 3

NYC Local Law 2021/No. 3 includes a private right of action, making it one of the few municipal biometric statutes with individual enforcement standing.

Federal Biometric Baseline

A federal biometric baseline refers to a hypothetical or proposed uniform federal statute governing biometric data collection across all U.S. states. As of 2025, no comprehensive federal biometric privacy law exists; regulation remains a state-by-state patchwork, making multi-state employer compliance a jurisdiction-by-jurisdiction analysis. EasyClocking by WorkEasy Software maps each deployment location to its applicable state statute, filling the gap left by this absence.

Also known as: federal biometric privacy law

The American Data Privacy and Protection Act (ADPPA), proposed in Congress in 2022, included biometric provisions but was not enacted as of 2025.

Enforcement and Liability

Covers private right of action, liquidated damages and audit-readiness, the risk vocabulary that drives the compliance decision for employers deploying biometric time clocks.

Private Right of Action (Biometric)

A private right of action, in biometric privacy law, is a statutory provision that allows individual employees, not just government agencies, to sue employers directly for biometric privacy violations. BIPA and NYC Local Law 2021/No. 3 include private rights of action; Texas CUBI and Washington HB 1493 do not.

Also known as: individual enforcement right, statutory standing

BIPA's private right of action has generated significant class action settlement activity since 2019, making Illinois the highest-liability jurisdiction for biometric time clock deployments.

Liquidated Damages (Biometric)

Liquidated damages, in biometric privacy law, are statutory per-violation penalties that courts award without requiring proof of actual harm. BIPA sets liquidated damages for negligent and intentional or reckless violations, and courts have held that each unconsented scan constitutes a separate violation.

Also known as: statutory damages, per-violation penalties

In Cothron v. White Castle (Ill. 2023), the Illinois Supreme Court held that each biometric scan without consent is a separate BIPA violation, dramatically multiplying per-employee exposure for daily time clock use.

Audit-Ready Biometric Compliance

Audit-ready biometric compliance is the operational state in which an employer can produce, on demand, documented evidence of consent, retention schedules, destruction logs and data handling policies for every biometric identifier collected, satisfying regulatory inquiry or litigation discovery without manual reconstruction. EasyClocking by WorkEasy Software surfaces consent status, retention schedule adherence and destruction event logs for every enrolled employee across all locations through the platform's compliance dashboard.

Also known as: compliance readiness, biometric audit preparedness

BIPA requires employers to maintain a publicly available written policy for retention and destruction; absence of this policy is itself a per-employee violation under the private right of action.

Biometric Time Clock Laws Glossary: 22 Key Terms Defined

Foundational Concepts

Fair Pay Starts at the Clock

Biometric Modalities

State Statutes and Frameworks

Enforcement and Liability

How These Terms Relate

Learn More

Foundational Concepts

Fair Pay Starts at the Clock

Biometric Modalities

State Statutes and Frameworks

Consent and Compliance Mechanics

Enforcement and Liability

How These Terms Relate

Learn More