Face recognition and US biometric privacy requirements
US biometric privacy requirements vary by jurisdiction and workflow. Illinois BIPA includes written notice, a written release and a public retention policy for covered entities. FaceTagr offers on-device recognition and offline liveness, but the employer or platform must assess applicable law, document data flows and implement required notices and permissions before collecting biometric data.
Last reviewed: 18 October 2026 · FaceTagr team
What should US organizations have in place?
| Issue | Assessment |
|---|---|
| Applicable law | Identify relevant state and local rules for workers and operations |
| Illinois notice and release | Explain collection, purpose and term, and obtain the required written release |
| Retention policy | Under BIPA, publish the retention and destruction policy required by section 15 |
| Deletion timing | BIPA: purpose satisfied or three years after last interaction, whichever is first |
| Alternatives and vendors | Define a practical fallback and record vendor access and disclosures |
What changed in Illinois in August 2024?
Public Act 103-0769 treats repeated specified collection or disclosure violations involving the same person as a single violation for damages and expressly permits electronic signatures for a written release. It does not remove notice, release, policy or other duties. Seek advice on the law's application to your workflow.
Does local processing mean no biometric data is held?
Face templates are biometric data, even when capture photos are not retained. Define the lawful basis, notice and consent where required, retention, access controls and a workable non-face alternative before rollout. On-device processing does not by itself establish legal compliance.
Plan a pilot around your workflow
For privacy or deletion requests, contact support@facetagr.com. Read our privacy policy.
Sources
Product capabilities describe FaceTagr's supported workflows, not third-party endorsement. This page is general information, not legal advice. Check your obligations with your data protection officer or adviser.
Frequently Asked Questions
Does processing on the device remove privacy obligations?
Face templates are biometric data, even when capture photos are not retained. Define the lawful basis, notice and consent where required, retention, access controls and a workable non-face alternative before rollout. On-device processing does not by itself establish legal compliance.
Are workers' photos stored?
Configured mobile attendance workflows can avoid retaining check-in photos or video. Enrolment references, templates and attendance records still need a documented retention policy. Customer-built SDK apps and CCTV may store images according to their configuration; confirm the data flow before deployment.
Can it work without a network?
Yes. FaceTagr's mobile SDK supports fully offline 1:1 verification, 1:N identification and passive liveness on Android and iOS. Reporting and integration need a connection when records are synchronised.
Does FaceTagr provide a BIPA compliance guarantee?
No. Product capabilities can support a deployment, but legal requirements and implementation must be assessed independently.