Are biometric time clocks legal? The laws by state

Are biometric time clocks legal?

Yes. No federal law bans fingerprint, face or hand-scan time clocks. But a growing number of states regulate how employers collect, store and destroy biometric data, and Illinois's law has produced years of class actions over time clocks used without signed consent. The question is rarely whether you can use one; it's whether you did the paperwork before the first scan.

What counts as biometric: under BIPA, a biometric identifier is a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry, and biometric information is anything based on one of those that's used to identify a person. Many fingerprint clocks store a mathematical template rather than an image, but a template used to identify someone is still covered. Plain photographs are excluded from BIPA's definition, though a system that runs face matching on photos is a different matter.

Illinois BIPA and time clocks

BIPA (740 ILCS 14) is the strictest biometric law in the US and lets individuals sue directly. Before an employer collects a fingerprint or face scan in Illinois, section 15 requires it to:

1. 1Publish a retention policy. A written policy, available to the public, with a schedule for destroying biometric data when the initial purpose is satisfied or within 3 years of the person's last interaction with the employer, whichever comes first.
2. 2Give written notice. Tell the employee in writing that biometric data is being collected or stored, the specific purpose, and how long it will be kept.
3. 3Get a written release. In employment, a release signed as a condition of employment counts, and since 2024 an electronic signature does too.
4. 4Never sell or profit from it. No selling, leasing or trading biometric data.
5. 5Limit disclosure. Don't share it with others, which can include vendors, without consent or another listed exception.
6. 6Protect it. Store and transmit it with a reasonable standard of care, at least as carefully as other confidential information.

Many BIPA suits have also named the time clock or payroll vendor that stored the data, so the vendor contract matters as much as your own forms.

BIPA damages

Section 20 lets anyone aggrieved by a violation sue.

On top of that come reasonable attorneys' fees and costs, plus injunctive relief. Three Illinois Supreme Court decisions shaped how big these cases got:

• Rosenbach v. Six Flags (2019): a person doesn't have to show harm beyond the violation itself to sue.
• Tims v. Black Horse Carriers (2023): a five-year statute of limitations applies to BIPA claims.
• Cothron v. White Castle (2023): each scan without consent was a separate violation, which could multiply damages by every clock-in.

The 2024 BIPA amendment

In August 2024, Illinois amended BIPA (SB 2979, Public Act 103-0769) so that repeatedly collecting the same person's biometrics by the same method counts as a single violation, with at most one recovery per person, reversing the per-scan result in Cothron. It also confirmed that an electronic signature can satisfy the written release. Whether it applies to cases already pending when it passed has been disputed in court.

The amendment lowered the ceiling; it didn't change the duties. An employer with 100 workers clocking in by fingerprint without consent forms still faces $100,000 in liquidated damages at $1,000 each, or $500,000 if the violation is found reckless, plus attorneys' fees.

Texas: the Capture or Use of Biometric Identifier Act

Texas regulates biometric identifiers under Business and Commerce Code section 503.001, often called CUBI. It covers retina or iris scans, fingerprints, voiceprints, and records of hand or face geometry captured for a commercial purpose.

• Inform the person and get their consent before capturing a biometric identifier.
• Don't sell or disclose it except in limited cases, and protect it with reasonable care.
• Destroy it within a reasonable time, generally no later than one year after the purpose for collecting it expires.

There's no private right of action: the Texas attorney general enforces it, with civil penalties of up to $25,000 per violation. Employers using biometric clocks in Texas are generally advised to treat it as applying to them.

Washington: RCW 19.375

Washington's biometric identifier law (RCW 19.375, enacted 2017) bars enrolling a biometric identifier in a database for a commercial purpose without first giving notice, getting consent, or providing a way to prevent later commercial use. Its definition of commercial purpose centers on selling or disclosing data for marketing, so it reaches an in-house time clock less clearly than BIPA does; notice and consent are still the safe default. The attorney general enforces it under the state's Consumer Protection Act, and there's no private right of action.

Colorado and other states

Colorado added employer-specific biometric rules in 2025; elsewhere the rules are narrower or still developing.

• Colorado (since July 1, 2025): HB24-1130 amended the Colorado Privacy Act with biometric rules that reach employers. An employer may require employees to consent only for certain purposes, which include recording the start and end of the full workday (including meal or rest breaks over 30 minutes), access to secure locations or systems, and workplace safety. It must adopt a written policy with a retention schedule and an incident-response plan, and delete biometric identifiers within set deadlines. The attorney general and district attorneys enforce it; there's no private right of action.
• New York: Labor Law section 201-a generally bars requiring fingerprinting as a condition of employment, with exceptions. How it applies to fingerprint time clocks is unsettled, so voluntary enrollment with an alternative is the cautious route.
• Elsewhere: comprehensive privacy laws in other states often treat biometric data as sensitive data, though many exempt employee data, and new biometric bills appear most years. Check the law in each state where you have a clock before installing one.

Biometric time clock consent form: what to include

A consent form for a biometric time clock should cover, at minimum:

• What's collected (for example, a fingerprint template, not an image), by which device and which vendor
• The specific purpose: verifying identity when clocking in and out
• How long it's kept and when it's destroyed (in Illinois, when the purpose ends or within 3 years of the last interaction, whichever comes first)
• Who it's shared with, such as the time clock vendor or payroll provider, and a promise it won't be sold
• How it's protected
• Where to find the public retention policy
• The employee's signature and the date (electronic signatures are allowed in Illinois since 2024)
• An alternative way to clock in for anyone who declines, if you offer one

Biometric time clock compliance checklist

Work through this list before the first employee enrolls, and again whenever you add a state or switch vendors.

1. 1Map the law. List every state where a clock sits or an enrolled employee works.
2. 2Question the vendor. Find out what the device stores (image or template), where, for how long, and who can access it.
3. 3Publish the retention policy before anyone enrolls.
4. 4Collect signed consent from every employee before their first scan, including current employees when you switch clocks.
5. 5Sign a vendor contract covering storage, security, disclosure and deletion.
6. 6Delete on schedule when people leave or the purpose ends, and keep a record that you did.
7. 7Train managers so nobody is enrolled before the form is signed.
8. 8Review every year, since these laws change often.

Non-biometric alternatives and their trade-offs

Biometrics are popular because they stop buddy punching. Other methods can do much of the same without collecting body data.

If you're weighing a phone app instead, read can employers require personal phones first. For a fuller comparison, see QR code vs NFC vs biometric time clocks.

How a badge clock fits

TrackBadges uses printed QR badges that a supervisor scans with a phone, so it collects no fingerprints or face scans and needs no biometric consent forms; the check against buddy punching is the supervisor seeing the person. It isn't for every setup. An unattended door with nobody to scan is where biometrics or photo capture earn their keep, though a kiosk time clock with badges or PINs is the no-biometrics option there. More on the badge time clock page.