Texas's $1.4 billion settlement with Meta, announced by Attorney General Ken Paxton in July 2024, is the largest privacy settlement any single state has ever obtained, and it was won under a biometric-specific law most businesses have never heard of: the Texas Capture or Use of Biometric Identifier Act. Illinois's BIPA gets most of the attention because it lets any person sue directly, but Texas, Washington, and Colorado have each built a different kind of biometric law, and two cities have added their own rules on top.
How many states have passed a law specifically about biometric data?
Most privacy coverage treats "biometric law" as a synonym for Illinois's BIPA, but BIPA is one of four state statutes written specifically to regulate fingerprints, face scans, and voiceprints, separate from the general "sensitive data" category inside a state's broader consumer privacy law. Illinois passed the first one, the Biometric Information Privacy Act, in 2008. Texas followed a year later with the Capture or Use of Biometric Identifier Act. Washington added its own biometric-specific statute in 2017, and Colorado became the fourth state in 2024 when it passed HB 1130, a law that took effect July 1, 2025.
Figure 1: Four states and two cities have each passed a biometric-specific rule since 2008. Source: 740 ILCS 14, Tex. Bus. and Com. Code Ch. 503, RCW 19.375, Colorado HB24-1130, Portland City Council, NYC Local Law 3 of 2021.
Two more jurisdictions round out the list at the city level rather than the state level: Portland, Oregon banned private-sector facial recognition use in places of public accommodation starting January 1, 2021, and New York City's Local Law 3 took effect July 9, 2021, requiring signage and banning the sale of biometric data collected from customers. Both add a private right of action layered on top of whatever state law otherwise applies.
How does Texas's CUBI compare to Illinois's BIPA?
The two laws share a target, biometric identifiers, but differ almost entirely in how they are enforced. BIPA lets any aggrieved person sue directly, with statutory damages of $1,000 per negligent violation and $5,000 per intentional or reckless violation under 740 ILCS 14/20. CUBI has no private right of action at all: only the Texas Attorney General can bring a case, but the civil penalty runs up to $25,000 per violation with no cap on the total, which is what let Texas negotiate a settlement more than double Facebook's largest BIPA payout from a single enforcement action.
Figure 2: Texas's uncapped per-violation penalty is what produced the largest privacy settlement on record. Source: Tex. Bus. and Com. Code 503.001, Colorado Consumer Protection Act (C.R.S. 6-1-112), RCW 19.375, 740 ILCS 14/20.
Washington's biometric law, RCW 19.375, sits closer to CUBI's model: no private right of action, Attorney General enforcement only, and civil penalties of up to $7,500 per violation under the state's Consumer Protection Act. For a full breakdown of which states let consumers sue over a privacy violation at all, not just a biometric one, see our state-by-state private right of action comparison, which covers BIPA alongside all 20 comprehensive state privacy laws.
Which biometric law actually applies to your business?
A business collecting fingerprints, face scans, or voiceprints has to check three layers before assuming it is covered: whether a dedicated biometric statute applies in the state where its users live, whether a city ordinance adds a further rule, and whether the state's general comprehensive privacy law treats biometric data as sensitive information requiring its own consent step.
Figure 3: Most businesses face at least one of these four layers once biometric data is involved. Source: state biometric statutes above, NYC Local Law 3, Portland City Council ordinance.
That fallback layer covers more ground than it looks. The same 20 comprehensive state privacy laws in effect nationwide generally classify biometric identifiers as sensitive personal data requiring consent before processing, according to a comparison published by the National Law Review. Most of those states require opt-in consent for sensitive data, while California, Utah, and Iowa give residents only an opt-out right rather than requiring consent up front, so a business outside the four dedicated-statute states is rarely operating in a total regulatory vacuum.
Do New York City and Portland add another layer of biometric law?
Yes, and both give an individual customer the right to sue, which none of the four state-level AG-enforced laws besides BIPA allow. New York City's Local Law 3 applies to commercial establishments, entertainment venues, retail stores, and food and drink establishments, and lets a customer recover $500 per violation for a missing notice sign or a negligent sale of their biometric data, rising to $5,000 for an intentional or reckless sale. Portland's ordinance goes further on the number: a business found to have violated the ban owes $1,000 per day the violation continued, plus attorney's fees.
Figure 4: Half of the six dedicated biometric laws in effect, counting Illinois plus the two city ordinances, let an individual sue directly. Source: 740 ILCS 14, NYC Local Law 3, Portland City Council ordinance, CUBI, RCW 19.375, Colorado HB 1130.
Neither city ordinance requires a minimum company size or revenue threshold, which means a single-location retailer using a fingerprint time clock in Manhattan or a face-scanning kiosk in Portland can face the same private lawsuit exposure as a national platform, something the state-level AG-only laws do not create on their own.
Is the biometric privacy patchwork still growing in 2026?
Yes, on two fronts that pull in opposite directions. New biometric-specific legislation kept moving in the 2026 session: at least seven states, including Massachusetts, New York, and Pennsylvania, had introduced new biometric privacy bills as of a January 2026 tracker published by Bryan Cave Leighton Paisner, and that count typically grows as sessions continue through the year. At the same time, Illinois' own BIPA activity is shrinking: new class-action filings dropped to 150 in 2025 from 427 in 2024, after an August 2024 reform capped damages to one violation per person per collection method rather than one per scan.
Figure 5: The count of states with a law written specifically for biometric data has grown slowly but steadily since 2008. Source: 740 ILCS 14, Tex. Bus. and Com. Code Ch. 503, RCW 19.375, Colorado HB24-1130.
A similar growth pattern shows up in state health data privacy laws beyond HIPAA: a narrow federal gap gets filled slowly, state by state, rather than closed by one comprehensive federal statute. For a business already updating its privacy disclosures to keep pace, a privacy policy generator that lets you add biometric and other sensitive-data categories as separate clauses is a faster way to keep that documentation current than rewriting a static template every time another state acts.
How does each state's biometric law compare at a glance?
| State or city | Law (year) | Enforcement | Max penalty |
|---|---|---|---|
| Illinois | BIPA (2008) | Private lawsuit, any person | $1,000-$5,000 per violation |
| Texas | CUBI (2009) | Attorney General only | $25,000 per violation, no cap ($1.4 billion Meta settlement, 2024) |
| Washington | RCW 19.375 (2017) | Attorney General only | $7,500 per violation |
| Colorado | HB 1130 (2025) | Attorney General and DAs | $20,000 per violation |
| New York City | Local Law 3 (2021) | Private lawsuit, commercial establishments | $500-$5,000 per violation |
| Portland, OR | Facial recognition ban (2021) | Private lawsuit | $1,000 per day of violation |
Source: State statutes and municipal ordinances cited above, as summarized by the law firm analyses listed in Where the Numbers Come From.
The Bottom Line
Biometric privacy law in the United States is not one rule, it is at least six overlapping ones, and the state getting the most attention right now is not the one with the most lawsuits. Illinois still produces the highest volume of individual claims because BIPA lets anyone sue, but Texas's CUBI proved in 2024 that an Attorney General with an uncapped per-violation penalty and no private right of action to share the recovery with can extract a bigger single payout than years of Illinois class actions combined. A business collecting fingerprints, face scans, or voiceprints from users in Illinois, Texas, Washington, Colorado, New York City, or Portland needs to treat each of those six regimes as a distinct compliance obligation, and everywhere else, the fallback is still whatever that state's comprehensive privacy law says about sensitive data. None of that patchwork is likely to consolidate into one federal standard soon, so the safer default is a privacy policy that discloses biometric collection specifically, rather than folding it into a generic data category and hoping it covers whichever of the six regimes actually applies.
Frequently Asked Questions
How many states have a dedicated biometric privacy law in 2026? Four states, Illinois, Texas, Washington, and Colorado, have enacted a privacy statute specifically dedicated to biometric identifiers as of 2026, alongside two city ordinances, New York City's Local Law 3 and Portland, Oregon's facial recognition ban, that add their own rules on top of state law.
What is the largest biometric privacy settlement to date? 1.4 billion dollars, the amount Meta agreed to pay Texas in July 2024 to resolve claims under the Texas Capture or Use of Biometric Identifier Act, according to Attorney General Ken Paxton's office. It is the largest privacy settlement any single state has ever obtained, more than double Facebook's earlier 650 million dollar BIPA settlement in Illinois.
Which state biometric privacy laws let consumers sue directly? Only Illinois's BIPA among the four dedicated state laws, carrying damages of 1,000 to 5,000 dollars per violation. Texas, Washington, and Colorado all enforce their biometric laws exclusively through the state Attorney General, with per-violation penalties of 25,000 dollars, 7,500 dollars, and 20,000 dollars respectively.
Does Colorado's biometric law work the same way as Illinois's BIPA? No. Colorado's HB 1130, effective July 1, 2025, combines BIPA-style consent and retention obligations with the broader duties of a comprehensive privacy law, but unlike BIPA it has no private right of action and is enforced only by the state Attorney General and district attorneys under the Colorado Consumer Protection Act.
Where the Numbers Come From
- Office of the Texas Attorney General. (2024). "Attorney General Ken Paxton Secures $1.4 Billion Settlement with Meta Over Its Unauthorized Capture of Personal Biometric Data." Announced July 30, 2024, described as the largest settlement obtained from an action brought by a single state.
- Office of the Texas Attorney General. "Texas Capture Or Use Of Biometric Identifier Act." Civil penalties of up to $25,000 per violation, enforced solely by the Attorney General.
- Illinois General Assembly. 740 ILCS 14, the Biometric Information Privacy Act. Section 14/20 sets damages of $1,000 per negligent violation and $5,000 per intentional or reckless violation.
- Washington State Legislature. RCW 19.375, Biometric Identifiers. Enacted via HB 1493 (2017); Attorney General enforcement only, penalties up to $7,500 per violation.
- Colorado General Assembly. HB24-1130, "Privacy Of Biometric Identifiers And Data." Signed May 31, 2024, effective July 1, 2025.
- Colorado Consumer Protection Act enforcement summary. Civil penalties of up to $20,000 per violation under C.R.S. 6-1-112; no private right of action; cure period requirement ended January 1, 2025.
- Morrison Foerster. (2021). "Open for Business: Are You Prepared for New York City's Biometric Identifier Information Law?" Local Law 3 of 2021, effective July 9, 2021; damages of $500 to $5,000 per violation.
- Hunton Andrews Kurth. (2020). "Portland, Oregon Becomes First Jurisdiction in U.S. to Ban the Commercial Use of Facial Recognition Technology." Ordinance passed September 9, 2020, effective January 1, 2021; liquidated damages of $1,000 per day of violation.
- National Law Review. "Update: Processing Sensitive Personal Information under U.S. State Privacy Laws." Comparison of opt-in versus opt-out consent for biometric and other sensitive data, including the California, Utah, and Iowa opt-out exception.
- Legal Newsline, reporting on Duane Morris' 2026 Class Action Review. (2026). 150 new BIPA class actions filed in 2025, down from 427 in 2024, following the August 2024 damages-cap reform.
- Bryan Cave Leighton Paisner. (2026). "U.S. Biometric Laws & Pending Legislation Tracker." Published January 16, 2026; at least seven states with new biometric bills introduced in the 2026 session.
Note: All figures verified as of August 2026. The BCLP legislative tracker reflects a live, rolling count as of its January 2026 publication date and will change as the 2026 legislative sessions in tracked states continue or close. This tally is refreshed as new biometric statutes, settlements, or amendments are announced.
