Are Biometric Time Clocks Legal? A State-by-State Rundown

Yes, biometric time clocks are legal in most of the United States, but the rules change significantly once you cross state lines, and Illinois is where employers get burned. If your team operates in Illinois, New York, Texas, Washington, or California, you’re not looking at a general privacy suggestion. You’re looking at statutes with teeth, and in Illinois’ case, a private right of action that turns a bad rollout into a class action.

Three things to do before you scan a single fingerprint:

• Map your jurisdictions. Know exactly which states your employees clock in from, including remote workers.
• Pause on consent. If any location falls under a written-consent statute, don’t collect a single biometric until you have signed consent on file.
• Draft a retention and destruction policy now. Several statutes require a public schedule before you collect anything.

Key Takeaways

Biometric time clocks are legal across most of the U.S., but Illinois’ private right of action makes it the state that decides how cautious your rollout needs to be.

Point	Details
Illinois carries the most risk	BIPA’s private right of action and statutory damages make Illinois the top litigation concern.
Consent and retention come first	Written consent and a public retention/destruction policy are non-negotiable where required by law.
Enforcement varies by state	Texas and Washington rely on attorney general enforcement, not private lawsuits.
No federal biometric law exists	State statutes, not federal rules, drive most compliance obligations.
Kloqk avoids biometric exposure	Kloqk’s free photo verification and GPS geofencing track hours without storing biometric templates.

Where to Verify Your State’s Biometric Rules

• Illinois BIPA amendment coverage Reuters
• Employer biometric checklist Littler
• Employer responsibilities for biometric data Miller Nash

Table of Contents

• Which States Regulate Biometric Time Clock Laws?
• What Legal Requirements Apply to Biometric Time Clocks?
• How Do Biometric Laws Differ by State?
• How Should Employers Prepare Before Deploying Biometric Clocks?
• What Happens When Employers Get Sued Over Biometric Data?
• Sources

Which States Regulate Biometric Time Clock Laws?

Several states now have laws that specifically address biometric identifiers, and numerous others treat biometric data as a protected category inside broader privacy statutes. That number keeps climbing. Employee-monitoring shows a steady expansion of state activity, and legislatures introduce new biometric bills nearly every session.

The table below covers the states that matter most for employers running time clocks.

Local ordinances complicate this further. Some cities have layered their own biometric rules on top of state law, and new bills surface every legislative session. Treat this table as a starting point, not a final verdict, and confirm current status with counsel before you deploy anything.

What Legal Requirements Apply to Biometric Time Clocks?

Every state biometric statute rests on a handful of repeatable obligations, even though the details shift. Here’s what you’ll typically face:

1. Written, informed consent. Illinois’ BIPA requires consent before collection, and a compliant form should state what’s being collected, why, how long it’s retained, and who might see it. Employee-monitoring.net notes BIPA includes statutory damages for negligent or intentional/reckless violations, which makes the consent paperwork critical.
2. Retention and destruction schedules. Several states require a public policy stating how long you’ll keep biometric data and when you’ll destroy it, typically tied to employment termination or the purpose being satisfied.
3. Security safeguards and vendor limits. Statutes commonly prohibit selling biometric data and require “reasonable” security. Vendor contracts need explicit language on this.

There’s no comprehensive federal biometric privacy law. Federal exposure comes indirectly, through the ADA if a disability prevents someone from using a scanner, or through EEOC scrutiny if a biometric requirement disproportionately affects a protected class.

Pro Tip: Keep signed consent forms in the same file as your retention policy. If a claim ever surfaces, the strength of your paper trail often matters more than the technology you used.

How Do Biometric Laws Differ by State?

Illinois (BIPA). Written informed consent, a public retention policy, and a private right of action make this the state to worry about most. Illinois lawmakers passed SB 2979 in August 2024, which collapsed repeated scans by the same method into a single violation instead of counting each scan separately. That’s meaningful relief, but the underlying consent and retention duties haven’t gone anywhere.

Texas (CUBI). Requires consent and destruction within a reasonable window, but only the attorney general can sue. Civil penalties can still run into real money per violation.

Washington (RCW 19.375). Notice and consent before enrollment, enforced by the AG rather than private plaintiffs.

New York. Labor Law §201-a and DOL guidance have repeatedly pushed back on mandatory fingerprinting as a condition of employment, per Timeclock44’s state breakdown.

California and other privacy states. No BIPA-style statute, but CPRA classifies biometric data as sensitive personal information, triggering disclosure and opt-out obligations. Colorado and Maryland’s comprehensive privacy laws touch biometrics similarly, though with lighter enforcement teeth than Illinois.

How Should Employers Prepare Before Deploying Biometric Clocks?

1. Map every jurisdiction where employees physically clock in, including remote staff logging hours from home in a different state.
2. Get legal review before purchase, then draft a written biometric policy with a public retention and destruction schedule.
3. Build a real consent form that names the data collected, the purpose, retention period, and third parties with access, and lock down vendor contracts with security and breach-notification terms, per Littler’s guidance.
4. Plan for opt-outs. Some employees will have ADA-based objections or state-law rights to refuse.
5. Update insurance to confirm biometric-specific liability is covered, not excluded.
6. Operationalize compliance with audit logs, documented approvals, and a periodic review cycle.

Pro Tip: Build a rollback plan before launch, not after a demand letter arrives. If litigation risk spikes in one state, you want the ability to switch that location to a non-biometric method without rebuilding your whole system.

What Happens When Employers Get Sued Over Biometric Data?

Illinois is where the private right of action turns a compliance gap into a lawsuit. BIPA’s litigation exposure has driven years of class actions against employers who skipped consent forms or never published a retention policy, and the 2024 SB 2979 amendment only reduced the per-scan multiplier, not the underlying duty to get consent.

Texas and Washington work differently. Only the attorney general can bring an action, so there’s no private class-action machinery, but civil penalties can still add up if the AG investigates.

• Keep signed consent records indefinitely for terminated employees, not just current staff.
• Confirm your vendor contract bans data sale and covers breach notification.
• Talk to your broker about whether your general liability policy actually covers biometric claims.

When Do Non-Biometric Alternatives Make More Sense?

App-based clocks with photo verification and GPS geofencing solve the same buddy-punching problem without storing a biometric template, which sidesteps BIPA-style exposure entirely. That’s especially useful if your team spans multiple states, operates in a high-risk jurisdiction like Illinois, or simply doesn’t have IT staff to manage biometric security and consent paperwork.

Should You Move Slowly on Biometric Adoption?

Pilot in one location first, document every decision and consent, and pause expansion anywhere private lawsuits are a real possibility. Loop in labor counsel and check your insurance and vendor contracts before scaling past that pilot. Rushing a multi-state biometric rollout is how companies end up explaining themselves in a BIPA complaint.

Saad

A Lower-Risk Way to Track Hours Without the Biometric Paperwork

Kloqk skips biometric templates entirely and still solves the problem employers actually care about: knowing who’s really on the clock.

Instead of fingerprint or facial scans, Kloqk uses photo verification at clock-in and GPS geofencing to confirm employees are actually on-site, which handles buddy-punching without triggering BIPA-style consent and retention obligations. The platform is free, includes overtime and break calculations, and exports straight to payroll, with compliance settings for federal and state labor rules built in. For restaurant, construction, and retail teams spread across more than one state, that means one less legal category to manage.

Check out Kloqk’s free time tracking features to see whether a non-biometric setup fits your team better than a fingerprint scanner would.

Sources

• Illinois governor approves business-friendly overhaul of biometric privacy law Reuters
• Dear Littler: What Does Our Company Need To Do Before We Begin Using Biometric Timeclocks? Littler
• From fingerprints to facial recognition: Employer responsibilities for biometric data management Miller Nash

Recommended

• Biometric Time Clocks: What They Are and Why Apps Win | Kloqk
• How to Track Employee Clock In and Clock Out Times | Kloqk
• Best Time Clock Apps for Small Business in 2026 | Kloqk
• What Does on-the-Clock Mean Legally? 2026 Guide | Kloqk