The BIPA model of written consent, retention schedules, and destruction policies is being adopted by additional states at an accelerating pace. Multi-state employers can no longer rely on a single consent form or retention policy. Below are the four legal and regulatory trends reshaping the landscape.
T1. State Biometric Privacy Laws Are Multiplying Beyond Illinois
Direction: Accelerating. Maturity: Gaining adoption. Vintage: Accelerating since 2022, materially expanding in 2024 and 2025.
Texas, Washington, New York, Colorado, and other states have enacted or are advancing biometric privacy statutes with varying consent and destruction requirements. Employers operating in three or more states must map jurisdiction-specific obligations before any biometric time clocks go live. EasyClocking by WorkEasy Software customers deploying across five or more states report that jurisdiction mapping is now the first and most time-consuming step in every biometric rollout scoping call.
T2. Colorado HB 1130 and Successor Legislation Signal a New Consent Standard
Direction: Accelerating. Maturity: Early signal outside Colorado, gaining adoption within it. Vintage: Observed 2022 to 2025.
Colorado's HB 1130 raises the consent bar beyond BIPA's written-notice model toward affirmative opt-in with documented purpose limitation. Successor bills in other states are mirroring or exceeding this standard. Employers who built consent workflows to BIPA's 2008 standard may be under-compliant in newer-law states. A purpose-limitation audit of existing consent language is now a pre-rollout requirement.
T3. Local Jurisdictions Are Layering Rules on Top of State Law
Direction: Accelerating. Maturity: Gaining adoption (NYC enacted), early signal (other metros). Vintage: NYC enacted 2021, enforcement posture hardening 2023 to 2025.
New York City's Biometric Identifier Information Law (Local Law 3 of 2021) requires commercial establishments to post conspicuous notice when collecting biometric identifiers. A single corporate consent policy is insufficient for employers with NYC locations; location-specific posting and acknowledgment workflows are required.
T4. Federal Biometric Privacy Legislation Remains Stalled but Shapes State Momentum
Direction: Mature (federal stall), accelerating (state-level adoption of federal-bill standards). Vintage: Observed 2021 to 2025.
Repeated federal biometric privacy bill introductions have not passed, but their proposed consent and minimization standards are being adopted piecemeal at the state level. Do not wait for federal preemption to simplify compliance. The state-law proliferation trend is accelerating precisely because federal action is stalled.