Why biometrics need special care
Biometric identifiers cannot be changed if leaked, so several US states regulate them closely. Illinois's Biometric Information Privacy Act (BIPA) is the strictest. It requires informed written consent before collecting biometric identifiers, bans selling or otherwise profiting from them, and gives individuals a private right of action (Illinois General Assembly). Texas and Washington have biometric laws too, and several comprehensive state privacy laws treat biometrics as sensitive data.
Where biometrics appear in AI training data
- Faces in images and video
- Voices in call recordings, podcasts and meetings
- Handwriting and signatures in scanned documents
- Gait and body movement in video
Not every photo or recording counts as biometric data under every law; it often depends on whether identifiers are extracted. Buyers still treat faces and voices cautiously.
How deals handle it
- Model and speaker releases that cover AI training
- Excluding or blurring bystanders' faces
- Bans on creating face or voice templates, or digital replicas
- Excluding data collected from Illinois residents without consent