Biometric Privacy Compliance for Fintechs: What BIPA, Texas CUBI, and the KYC Vendor Gap Actually Require

TL;DR:

• Financial institutions are exempt from BIPA — but their KYC vendors generally are not. Courts have rejected the argument that a vendor collecting facial scans for a financial institution’s customers inherits the GLBA exemption (Davis v. Jumio Corp., N.D. Ill.).
• Texas CUBI has become the new enforcement signal: the Texas AG settled with Meta for $1.4 billion (July 2024) and Google for $1.375 billion (May 2025), ending 15 years of minimal enforcement.
• Employee biometrics — fingerprint timekeeping, facial access control — are outside GLBA’s scope and fully subject to BIPA in Illinois.
• Compliance requires three distinct workstreams: vendor contract requirements, employee biometric consent programs, and customer-facing notice and consent flows.

Your KYC Tool Has a Biometric Problem You May Not Know About

Every modern KYC onboarding flow uses biometrics. Liveness checks. Facial matching against a government ID. Voiceprint authentication for call center verification. In most fintech stacks, these are handled by a third-party vendor — Jumio, Onfido, Persona, Socure, Stripe Identity, or one of a dozen others.

Here’s the compliance problem most teams miss: your GLBA status doesn’t protect your vendor.

Illinois’s Biometric Information Privacy Act — the most litigated biometric privacy law in the country — does contain a financial institution exemption. Banks and their affiliates subject to Title V of GLBA are broadly exempt from BIPA. That exemption is well-known and well-litigated. What’s less known: in Davis v. Jumio Corp., a federal court in the Northern District of Illinois rejected the argument that a KYC vendor serving a cryptocurrency exchange could rely on that exemption. The vendor was collecting biometric data on behalf of a financial services company. The court held the vendor wasn’t itself a GLBA-covered financial institution and couldn’t borrow its client’s status.

For most fintechs, this means the facial recognition tool doing your KYC liveness check has its own BIPA compliance obligation — independent of and not covered by yours.

The Three Places Biometric Data Shows Up in Financial Services

Biometric privacy compliance requires mapping where biometric data actually exists in your operations. For most financial institutions and fintechs, there are three distinct contexts, each with a different compliance profile.

1. Customer-Facing Identity Verification (KYC and Liveness Checks)

The most common biometric touch point. Almost every digital account opening flow includes a liveness check — a selfie matched against a government ID. Face geometry extracted from that selfie is a biometric identifier under both BIPA and CUBI.

Who typically owns the compliance obligation: The vendor, based on Davis v. Jumio Corp. and similar decisions. But the contractual responsibility for ensuring the vendor has adequate consent flows, retention schedules, and destruction procedures lands on you in vendor due diligence and contract negotiations.

2. Voice Authentication for Phone Banking

Many financial institutions use voiceprint authentication for call center verification. Voiceprints are explicitly covered under BIPA and CUBI. CUBI has a specific exemption for using voiceprints “for fraud prevention purposes” and to “complete an authorized financial transaction” — but that exemption is narrow. Using voice data for authentication (as opposed to processing the transaction itself) may not cleanly qualify, and legal counsel should evaluate whether the exemption applies to your specific implementation.

Who typically owns the compliance obligation: The financial institution directly when operating its own call center authentication system. If using a vendor (Nuance, Pindrop, and similar), the same vendor gap analysis from KYC applies.

3. Employee Biometrics (Timekeeping, Building Access, Device Authentication)

This is where the GLBA exemption most clearly does not help. Employee biometric timekeeping systems — fingerprint clocks, facial recognition entry systems, hand geometry scanners — fall entirely outside GLBA’s scope. GLBA covers your customers’ financial information, not your employees’ physical access records.

Who owns the compliance obligation: You, directly. If your Illinois locations use fingerprint timekeeping or facial recognition access control, BIPA applies in full: written employee consent before collection, a public retention and destruction policy, restrictions on third-party disclosure, and a destruction schedule triggered by the shorter of three years or when the purpose ends (typically employment termination).

BIPA class action history is dominated by employee timekeeping cases. Notable settlements include Clearview AI ($51.75 million), Speedway ($12.1 million), and Biometric Impressions ($10.85 million). A financial institution’s GLBA status provides no protection for its own employee biometric programs.

The Two Laws That Matter Most

Why BIPA’s Private Right of Action Changed the Litigation Landscape

BIPA generated thousands of class actions because individuals can sue without proving actual harm — statutory damages of $1,000 to $5,000 per violation create enormous class-wide exposure when violations are systemic. A 2024 amendment redefined “repeated collection or transmission of the same biometric data by the same party” as a single violation rather than counting each capture separately, significantly limiting potential class damages. The Seventh Circuit confirmed in April 2026 that this amendment applies retroactively to pending cases. BIPA class action filings dropped to approximately 150 new lawsuits in 2025 — the lowest level in eight years — and total settlements declined to $136.6 million from $206 million in 2024. The law is still active; the exposure is just more bounded.

Why Texas CUBI Is the Enforcement Signal to Watch

CUBI had near-zero enforcement for fifteen years after its 2009 enactment. That changed with two massive settlements:

• July 2024: The Texas AG settled with Meta for $1.4 billion over facial recognition features in Facebook and Instagram that captured face geometry from Texas users without CUBI-compliant consent.
• May 2025: The Texas AG settled with Google for $1.375 billion over CUBI violations combined with Texas Data Privacy and Security Act claims.

These settlements — totaling nearly $2.8 billion — reflect an AG’s office that has concluded biometric data is an enforcement priority and is willing to pursue technology companies at the largest scale. Financial institutions offering account opening with facial KYC or voice authentication in Texas should evaluate their CUBI compliance against the standards these settlements imply. The AG’s theory in both cases centered on collecting face geometry without adequate notice and consent before collection — the exact mechanism used in standard fintech KYC liveness checks.

The State Patchwork Beyond BIPA and CUBI

Illinois and Texas have standalone biometric privacy laws with specific requirements. Beyond those, biometric data is increasingly classified as “sensitive data” requiring heightened protection under comprehensive state privacy laws:

According to Husch Blackwell’s 2025 State Biometric Privacy Law Tracker, multiple additional states are actively considering biometric-specific legislation. The trajectory is clear: biometric data is moving from unregulated to sensitive-data-with-opt-in across the country, with no federal preemption creating a floor.

For financial institutions with customers and employees in multiple states, the compliance obligation compounds quickly. The State Privacy Laws and the GLBA Safe Harbor analysis covers the broader question of which state laws financial institutions can rely on GLBA to preempt — and biometric laws are a significant exception to that general analysis.

What Fintechs Actually Need to Do

Biometric privacy compliance is a three-workstream problem.

Workstream 1: Vendor Assessment

For every vendor that touches biometric data on your behalf — KYC liveness checks, voice authentication, facial recognition for account access, document verification with face matching — conduct a biometric-specific vendor review:

• What biometric identifiers does the vendor collect, in which states, from which individuals?
• Does the vendor maintain a BIPA-compliant written policy on biometric data retention and destruction?
• Does the vendor obtain appropriate consent — and does that consent flow satisfy requirements for each customer’s jurisdiction?
• What happens to biometric data after account closure or end of the vendor relationship?
• What is the vendor’s incident notification procedure if biometric data is exposed in a breach?

This due diligence should be documented and updated at each vendor review cycle. For a structured approach to the questionnaire and evidence review, our post on vendor due diligence techniques covers the framework.

Workstream 2: Employee Biometrics

If you operate fingerprint timekeeping, facial recognition building access, or any employee biometric system in any covered state:

1. A written, publicly available biometric data retention and destruction policy (posted on your intranet and available to employees on request)
2. Written informed consent from each employee before any biometric collection
3. A destruction schedule (shorter of 3 years or when employment purpose ends under BIPA; 1 year after purpose expires under CUBI)
4. Restrictions on third-party disclosure to only: completing the service, complying with law, or with the employee’s consent

If you use a third-party time-and-attendance vendor for fingerprint clocking, request their BIPA compliance documentation and confirm whether they’ve indemnified you against biometric privacy claims arising from their collection methodology.

Workstream 3: Customer-Facing Notice and DPA Review

Even where GLBA exemptions apply or vendor obligations control, your customer-facing privacy notices should describe biometric data collection as part of your identity verification process. The Privacy Impact Assessment process is a useful framework for assessing consent adequacy, data minimization, and vendor data processing agreement requirements for each biometric use case.

Review existing vendor DPAs to confirm they address: (a) purpose limitation for biometric data, (b) retention and destruction timelines by jurisdiction, (c) prohibition on selling or disclosing biometric data, and (d) incident notification obligations specific to biometric data breaches.

So What?

If your compliance team’s working assumption is “GLBA covers our biometric privacy obligations,” this post is the correction. GLBA covers you; it doesn’t cover your vendors, and it doesn’t cover your employee programs. The Texas AG’s enforcement wave against Meta ($1.4B) and Google ($1.375B) demonstrates that biometric privacy is active enforcement risk in states where your customers and employees live and work.

Three items to put on your compliance calendar:

1. Map every vendor that collects biometric data in your KYC, authentication, or operations stack — and confirm they have standalone biometric compliance documentation, not borrowed financial institution status
2. Audit employee biometric programs in Illinois, Texas, and Washington for consent, policy, and retention schedule compliance
3. Review vendor contracts to confirm biometric data handling obligations — consent ownership, retention timelines, incident notification, destruction — are explicit and allocated

For a comprehensive privacy compliance framework covering multi-state obligations including biometric data requirements, vendor DPA checklists, and consumer rights workflows, the Data Privacy Compliance Kit includes a 19-state applicability matrix built for financial services teams navigating this landscape.