Biometric Time Tracking Risks: Understanding BIPA Compliance

Fingerprint scanners, facial recognition cameras, and iris readers have become popular tools for verifying employee identity at clock in. Biometric time tracking removes the possibility of buddy punching, eliminates shared PINs, and creates attendance records that are tied to a specific physical person rather than a badge or password. For many businesses, it is the most reliable attendance verification technology available.

But biometric time tracking also comes with legal obligations that many employers are not fully aware of until they face a lawsuit or regulatory inquiry. The Illinois Biometric Information Privacy Act, commonly known as BIPA, was one of the first laws in the United States to impose strict requirements on how businesses collect, store, use, and destroy biometric data.

In this article we will explain what BIPA requires, what the most common compliance mistakes are, how similar laws in other states are expanding these obligations, and how Open Time Clock approaches biometric verification in a way that supports compliance.

What Is BIPA and Who Does It Apply To?

The Illinois Biometric Information Privacy Act was enacted in 2008 and applies to any private entity that collects, captures, purchases, receives through trade, or otherwise obtains a person's biometric identifier or biometric information. Biometric identifiers under BIPA include fingerprints, retina scans, iris scans, voiceprints, and scans of hand or face geometry.

BIPA applies to any employer that collects biometric data from Illinois employees, regardless of where the employer is located. A company headquartered in Texas that uses fingerprint time clocks at an Illinois facility is subject to BIPA for those Illinois employees. The law's reach is determined by where the data is collected, not where the business is based.

BIPA creates four core obligations for covered employers. First, the employer must develop and make available a written policy governing the retention and destruction of biometric data. Second, before collecting any biometric information, the employer must inform the employee in writing of what is being collected and the purpose and length of collection. Third, the employer must obtain a written release from the employee before collection begins. Fourth, the employer must not sell, lease, trade, or profit from biometric data, and must not disclose it without consent except in specific limited circumstances.

Common BIPA Compliance Mistakes Employers Make

The most frequent reason employers find themselves facing BIPA litigation is not that they used biometric technology maliciously. It is that they deployed fingerprint scanners or facial recognition time clocks without knowing that BIPA existed or without understanding what the law specifically required before collection began.

Collecting Biometric Data Without Written Notice

The single most common BIPA violation is collecting biometric data without first providing written notice to employees explaining what data is being collected, the specific purpose for which it will be used, and how long it will be retained. Handing an employee a device and asking them to scan their fingerprint without any written disclosure is a violation even if the employee agrees verbally.

The notice must be provided in writing before any biometric data is collected. It must identify the type of biometric data being collected and explain the retention period and the reason for collection. A general employee handbook clause buried among other policies may not satisfy the written notice requirement if it does not specifically address biometric data collection.

Failing to Obtain a Signed Written Release

In addition to providing written notice, BIPA requires employers to obtain a written release signed by the employee before collecting their biometric data. This is a separate requirement from the notice. The employee must affirmatively consent in writing, and that consent must be obtained before the first scan.

Many employers obtain signatures on general employment agreements or technology use policies and assume this satisfies the BIPA consent requirement. Courts have generally required that consent be specific to the biometric data collection rather than embedded in general employment documents.

Not Having a Written Retention and Destruction Policy

BIPA requires employers to establish a written policy governing how long biometric data is retained and the procedures for destroying it. The policy must be publicly available. Biometric data must be destroyed within three years of the last time it was used for the purpose for which it was collected, or when the initial purpose for collection is fulfilled, whichever comes first.

An employer that retains fingerprint data for former employees indefinitely without a documented destruction policy is violating BIPA regardless of whether any other requirements were satisfied.

Sharing Biometric Data With Third Parties

Biometric time tracking systems often involve a third party vendor that processes or stores the biometric data. Under BIPA, sharing biometric data with a third party without obtaining the employee's consent to that specific sharing is a violation. This means employers must disclose not just that they are collecting biometric data, but that it will be shared with and processed by a specific vendor, and must obtain consent for that sharing separately.

Which Other States Have Biometric Privacy Laws?

While BIPA is the most well known biometric privacy law because of the extensive litigation it has generated, other states have enacted or are enacting similar requirements that employers must understand.

Texas enacted the Capture or Use of Biometric Identifier Act, which requires informed consent before collecting biometric identifiers and prohibits selling biometric data. Unlike BIPA, the Texas law does not include a private right of action and is enforced only by the state attorney general, which has made it significantly less litigious than BIPA to date.

Washington enacted the Washington My Health MY Data Act and has broader privacy legislation that intersects with biometric data use. Washington does not have a standalone biometric law equivalent to BIPA but does impose requirements on the collection and use of biometric data under its broader privacy framework.

New York City has enacted its own biometric privacy ordinance that applies to commercial establishments including employers. The ordinance requires businesses to post signs informing customers and employees that biometric data is being collected and prohibits selling biometric data.

How to Use Biometric Time Tracking Compliantly

Despite the significant compliance requirements, biometric time tracking can be used legally and safely when employers follow the correct procedures.

Conduct a Compliance Review Before Deployment

Before deploying any biometric time clock system, employers should identify which states the system will be used in and research the specific biometric privacy requirements in each state. In Illinois, this means a full BIPA compliance review including policy drafting, consent form preparation, and vendor agreement review. In other states, the requirements will differ but the starting point is always understanding the specific law in each jurisdiction.

Draft a Written Biometric Data Policy

Create a standalone written policy that specifically addresses biometric data collection. The policy should identify what biometric data is collected, the purpose for which it is collected, how long it is retained, and the procedures for destroying it when retention is no longer necessary. The policy must be made publicly available in Illinois and should be accessible to all employees regardless of state.

Obtain Specific Written Consent Before Collection

Create a consent form that specifically describes the biometric data being collected, the purpose of collection, the retention period, and any third parties with whom the data will be shared. Obtain a signed copy of this form from every employee before their first biometric scan. Retain these signed forms as compliance documentation.

Review Your Vendor Agreements

If your biometric time tracking system processes or stores biometric data through a third party vendor, review your vendor agreement to understand how the vendor handles the data, what security measures are in place, and whether the vendor's data practices are compatible with your compliance obligations. In Illinois, you may need a separate data handling agreement with your vendor that addresses BIPA requirements specifically.

Establish a Data Destruction Protocol

Document the procedure for destroying biometric data when an employee leaves the organization or when the data is no longer needed for its original purpose. Set a calendar reminder or automated process to ensure destruction happens within the legally required timeframe. Retain documentation that destruction occurred.

How Open Time Clock Approaches Biometric Verification

Open Time Clock offers facial recognition as a clock in verification method that supports attendance accuracy while giving employers the flexibility to implement it within their own compliance framework.

The platform's approach to biometric data is designed to support employer compliance rather than create additional obligations. Open Time Clock captures a verification image at the time of clock in and processes it for identity matching. Employers using the facial recognition feature are responsible for complying with the applicable biometric privacy laws in their jurisdictions, including obtaining required consents and establishing retention policies.

For employers in jurisdictions with strict biometric privacy laws who want the security benefits of identity verification without the regulatory complexity of biometric data collection, Open Time Clock offers equally effective alternatives.

Open Time Clock's photo capture feature takes a timestamped image of the employee at every clock in without performing automated biometric matching. Because no biometric template is created from the image and no automated identity matching occurs, this approach may fall outside the scope of biometric privacy laws in many jurisdictions while still providing a visual record that managers can review to verify identity.

Open Time Clock's GPS tracking and geofencing features provide location verification that confirms employees are at the right place when they clock in without collecting any biometric data at all. This is a highly effective fraud prevention measure that avoids biometric privacy law complexity entirely.

Open Time Clock's QR code time tracking feature provides strong individual identification through unique scannable badges without any biometric data collection. When combined with photo capture for visual verification, QR code clock in delivers accountability comparable to biometric systems without triggering biometric privacy law obligations.

Open Time Clock is completely free with no per user fees, giving employers the flexibility to choose the verification approach that best balances attendance security with their specific legal compliance requirements.

Conclusion

Biometric time tracking is one of the most effective ways to verify employee identity at clock in. But it comes with legal obligations that employers must understand and satisfy before deploying biometric systems. BIPA and similar laws in other states impose requirements for written notice, specific consent, data retention policies, and restrictions on sharing that must be met before the first scan is taken.

Employers who take the time to understand these requirements and implement compliant procedures can use biometric verification legally and safely. Employers who deploy biometric time clocks without addressing these requirements face class action exposure that can dwarf any operational benefit the system provides.

Open Time Clock gives employers the flexibility to choose the right verification approach for their specific legal environment, whether that is facial recognition with proper consent procedures in place, photo capture for visual verification without biometric matching, or GPS and QR code based systems that provide strong fraud prevention without any biometric data collection at all.

FAQ’s

Q1. What is BIPA and how does it affect employers using biometric time tracking?

BIPA is the Illinois Biometric Information Privacy Act. It imposes strict requirements on any employer that collects biometric data from Illinois employees, including written notice before collection, specific written consent, a publicly available retention and destruction policy, and restrictions on sharing data with third parties.

Q2. Does BIPA apply to employers outside Illinois?

Yes. BIPA applies to the collection of biometric data from Illinois employees regardless of where the employer is headquartered. A company based in California that uses a fingerprint time clock at an Illinois warehouse is subject to BIPA for those Illinois employees. The law's reach is determined by where the biometric data is collected, not where the business is incorporated or operated.

Q3. What is the difference between photo capture and biometric data collection under BIPA?

Photo capture takes an image of the employee at clock in but does not create a biometric template or perform automated identity matching based on facial geometry. BIPA specifically covers scans of face geometry used for identification purposes. A simple photo that a manager reviews visually may not constitute biometric data collection under BIPA, though employers should seek legal advice specific to their situation.

Q4. What non-biometric alternatives can prevent time fraud as effectively as fingerprint scanners?

GPS geofencing from Open Time Clock prevents clock ins from unauthorized locations, eliminating remote clock in fraud without any biometric data collection. QR code clock in combined with photo capture provides individual identification and visual verification without creating biometric templates.

Q5. Is Open Time Clock free for employers who want biometric or non-biometric time tracking?

Yes. Open Time Clock is completely free with no credit card required, no per user fees, and no feature restrictions. Facial recognition, photo capture, GPS tracking and geofencing, QR code clock in, leave management, overtime calculation, and over 80 payroll report formats are all available at no cost.