Free Compliance Tool
Check your state time-clock rules
Biometric laws are only three states so far. See what else your state requires, free.
Run the State Compliance Checker →Blog · Payroll Management
Biometric Time Tracking Laws and Payroll Compliance
Illinois, Texas, and Washington each regulate biometric time clocks differently. Illinois BIPA requires written notice and consent with damages up to $5,000 per violation, Texas CUBI caps a civil penalty at $25,000 with no private lawsuit, and Washington requires notice or an opt-out mechanism. BEG processes the hours a biometric clock reports at $45 per employee monthly.
Three states, three different rulebooks
A fingerprint or face-scan time clock is not regulated the same way everywhere. Only three states have a dedicated biometric privacy statute today, and an employer running the same time clock hardware in all three is actually meeting three separate legal standards.
| State | Consent requirement | Retention rule | Enforcement |
|---|---|---|---|
| Illinois (BIPA) | Written notice and a written release before collection | Destroy at purpose satisfied or within 3 years of last interaction | Private lawsuit, $1,000 to $5,000 per violation plus fees |
| Texas (CUBI) | Inform the individual and obtain consent | Destroy within 1 year of purpose expiring (termination, for employers) | Attorney General only, civil penalty up to $25,000 |
| Washington (RCW 19.375) | Notice plus consent, or a way to opt out of commercial use | No longer than reasonably necessary | Security-purpose collection is exempt from notice and consent |
Illinois: the one with the private lawsuit
BIPA requires that before collecting a fingerprint, hand scan, or other biometric identifier, a private entity must inform the person in writing that it is being collected and stored, state in writing the specific purpose and length of term, and obtain a written release. In an employment setting, that release can be signed as a condition of employment. A public written retention and destruction policy is required too, and identifiers must be destroyed when the purpose is satisfied or within 3 years of the person's last interaction, whichever comes first.
BIPA carries a private right of action with liquidated damages of $1,000 per negligent violation or $5,000 per intentional or reckless violation, or actual damages if greater, plus attorneys' fees. Since August 2, 2024, a change under P.A. 103-769 counts repeated collection of the same identifier from the same person by the same method as one violation rather than one per scan, which meaningfully changes the math on a multi-year class claim.
Texas: no private lawsuit, but a real Attorney General penalty
Texas CUBI requires informing the individual and getting consent before capturing a biometric identifier for a commercial purpose, with destruction required within a reasonable time and no later than one year after the purpose expires. For an employer's security-purpose collection, that purpose is presumed to expire at termination of employment, which is what starts the one-year clock. There is no private right of action in the statute; the Attorney General enforces it, with a civil penalty up to $25,000 per violation. A 2026 amendment, H.B. 149, effective January 1, 2026, added exemptions for AI-training use.
Washington: notice, consent, or an opt-out path
RCW 19.375.020 bars enrolling a biometric identifier in a database for a commercial purpose without notice, consent, or a mechanism to prevent later commercial use, and requires reasonable care against unauthorized access along with retention no longer than reasonably necessary. Notably, 19.375.020(7) exempts collection in furtherance of a security purpose from the notice and consent requirement, which covers a meaningful share of workplace time-clock use.
What BEG does, and does not, own here
BEG processes the hours that come out of the client's time clock and keeps the pay records; it does not own the biometric device, the consent forms, or the retention policy. Whether a fingerprint or face-scan clock is lawful in a given state, the written release, the retention schedule, and the vendor contract stay with the client and its counsel. BEG's practical role is to flag when a client in Illinois, Texas, or Washington is sending time data from a biometric clock without a policy on file.
Full BEG managed payroll turns whatever hours the time clock reports into an accurate paycheck, regardless of which state the employee works in.
Managed Payroll, Handled.
BEG manages payroll at $45 per employee per month, all-inclusive. Get an instant cost comparison for your business.
Frequently Asked Questions
What does Illinois BIPA require before a fingerprint clock is used?
Written notice that a biometric identifier is being collected and stored, a written statement of the specific purpose and length of term, and a written release. In employment, that release can be signed as a condition of employment.
How long can an employer keep biometric data under BIPA?
Identifiers have to be destroyed when the purpose is satisfied or within 3 years of the person’s last interaction with the company, whichever comes first. BIPA also bars selling or profiting from biometric data outright.
What are the damages for a BIPA violation?
Liquidated damages of $1,000 per negligent violation or $5,000 per intentional or reckless violation, or actual damages if higher, plus attorneys’ fees, through a private right of action. A 2024 amendment changed how violations are counted.
Does every fingerprint scan count as a separate BIPA violation?
Not anymore. Under P.A. 103-769, effective August 2, 2024, repeated collection of the same identifier from the same person by the same method counts as one violation, not one violation per scan.
How is Texas CUBI different from Illinois BIPA?
Texas requires informing the individual and getting consent before capturing a biometric identifier for a commercial purpose, and destruction within a reasonable time, no later than one year after the purpose expires. Unlike Illinois, there is no private right of action. The Texas Attorney General enforces it, with civil penalties up to $25,000 per violation.
When does the retention clock start for an employee time clock in Texas?
For an employer’s security-purpose collection, the purpose is presumed to expire at termination of employment, which starts the one-year destruction clock under Texas law.
What does Washington state require for biometric time clocks?
RCW 19.375.020 bars enrolling a biometric identifier in a database for a commercial purpose without notice, consent, or a mechanism to prevent later commercial use, plus reasonable care against unauthorized access. Collection for a security purpose is exempt from the notice and consent requirement under 19.375.020(7).
Does BEG manage biometric consent forms or the time clock itself?
No. BEG processes the hours the client’s time clock reports and keeps the pay records. The device itself, the consent forms, and the retention policy belong to the client and its counsel.
What does BEG managed payroll cost?
$45 per employee per month, all-inclusive, inside the payroll software you already use, or on BEG's isolved HCM at the same rate.
Related Resources
Anthony leads payroll solutions at Business Executive Group, a national managed payroll firm serving businesses across industries. BEG manages payroll at $45 PEPM, all-inclusive, with deep expertise in compliance, multi-state filing, and industry-specific payroll requirements. Get instant pricing at beghr.com.
Sources: Illinois Biometric Information Privacy Act, 740 ILCS 14; Texas Business and Commerce Code 503.001; Washington RCW 19.375.020. This is general compliance information, not legal advice.
From the blog