Biometric Data Collection at Work in California: Your Rights

Federal law does not impose a comprehensive biometric privacy requirement for private employers. The Americans with Disabilities Act (ADA) addresses biometric data only to the extent it relates to disability discrimination and reasonable accommodations. The Health Insurance Portability and Accountability Act (HIPAA) regulates biometric information held by covered health plans and healthcare providers, but does not apply broadly to employers outside the healthcare and health insurance context. The Federal Trade Commission (FTC) has authority to regulate unfair or deceptive practices involving biometric data collection under Section 5 of the FTC Act, but this is narrow and does not create a private right of action for employees.

At the federal level, several states (Illinois, Texas, Washington, and others) have enacted specific biometric privacy statutes, but no federal statute creates a general private right of action for biometric data misuse by employers. The National Institute of Standards and Technology (NIST) has issued guidance on biometric security standards, but compliance is voluntary for private employers. Federal contractors and employers subject to background check regulations may have limited restrictions on fingerprint collection for compliance purposes, but this is exception-based and does not prohibit collection under federal law.

California goes significantly further than federal law in protecting biometric data. The state recognizes a private right of action for biometric information privacy violations, allowing employees to sue employers directly without filing an administrative complaint with the California Labor Commissioner or another agency first. This is a major distinction from federal law, which typically requires administrative exhaustion before litigation.

California Labor Code § 226.1 requires employers to notify employees in writing before collecting biometric information. The notice must disclose: (1) what biometric identifiers will be collected, (2) the specific purpose and use, (3) the length of time the biometric data will be retained, and (4) the employer's policies governing retention and destruction. This statute applies to all employers in California, regardless of size—there is no employee count threshold.

The California Consumer Privacy Act (CCPA), codified at California Civil Code § 1798.100 et seq., explicitly classifies biometric information as "personal information" and grants consumers (including employees) the right to know, delete, and opt out of sale of their biometric data. Biometric data is defined broadly to include fingerprints, facial geometry, voiceprints, iris or retina scans, keystroke patterns, gait analysis, and other unique biological or behavioral patterns used to identify an individual.

Unlike federal law, California does not carve out exceptions for law enforcement compliance or government-mandated fingerprinting for background checks in the employment context. However, California courts have recognized that certain statutory or regulatory fingerprinting (e.g., for state licensing) may not violate the law if the fingerprints are mandated by law and the employer does not collect additional biometric data beyond what is required.

Remedies under California law are broader than federal remedies. Employees can recover statutory damages of $100 to $750 per employee per intentional or negligent violation, plus reasonable attorney's fees and costs. This creates a significant financial incentive for class action litigation and makes even single-violation cases economically viable for employees to pursue.

Written consent required before any biometric data collection—no threshold.

Statutory damages: $100 to $750 per employee per violation.

No minimum employer size threshold; law applies to all California employers.

No specific filing deadline for private lawsuits; standard civil statute of limitations (generally 4 years for contract claims, 2 years for tort claims under California law).

Notice requirement must be satisfied before collection; retroactive consent does not cure violations.

No safe harbor for employers who comply with federal law alone; California law is independent and stricter.

California law contains limited exceptions to the biometric data consent requirement. First, employers are not prohibited from collecting biometric data if the collection is mandated by federal or California state law, regulation, or court order—for example, fingerprinting required for a state professional license or Department of Justice background check. However, the exception applies only to the specific biometric data required by law; an employer cannot use this exception to collect additional biometric data beyond what the legal mandate requires.

Second, employers may collect biometric data without prior written consent in narrow circumstances involving security or fraud prevention, but California courts have not definitively clarified the scope of this exception. Some courts have suggested that collection for "legitimate business purposes" (such as time and attendance tracking) may not require consent if the employer provides notice, but the case law is unsettled and most employers should treat notice and consent as mandatory.

Third, an employer collecting biometric data for a lawful purpose (e.g., access control) does not violate the law if the employee voluntarily uses a biometric system knowing its purpose, provided the employer has given written notice of what data is collected and how it will be used. However, this is not truly an exception—it is compliance with the notice requirement.

Fourth, the CCPA contains a limited exemption for employee records and employment-related personal information, but this exemption does not eliminate the requirement to obtain written consent under Labor Code § 226.1. Courts have held that the CCPA exemption does not override the Labor Code § 226.1 requirement.

Employers are not required to obtain consent for biometric data collected from non-employees (e.g., customers or visitors), but the data must still be collected lawfully and cannot be used for purposes not disclosed. At-will employment status does not exempt employers from the biometric consent requirement; California law protects at-will employees and employees with cause equally.

Step 1: Document the biometric data collection. Keep written records of when biometric data was collected, what type of data was collected (fingerprint, facial scan, etc.), what system or device was used, who collected it, what the stated purpose was, and how long it was retained. If possible, preserve screenshots of the consent form (or lack thereof), any written notice given, and communications from the employer about the biometric system. Save emails, policy documents, and employee handbooks that reference the biometric collection. If the employer destroyed biometric data, document when and under what circumstances.

Step 2: Attempt an internal complaint process. Although California employees have a private right of action and do not need to file with the state first, sending a written demand letter to your employer (via email or certified mail) may preserve evidence and give the employer an opportunity to correct the violation. Include in the letter: (1) what biometric data was collected, (2) when it was collected, (3) that you did not provide written consent, (4) the employer's failure to provide the required written notice, and (5) a demand for destruction of the data and compensation. Keep a copy for your records. If the employer does not respond within 10-14 days or refuses to comply, proceed to the next step.

Step 3: File a private lawsuit in California Superior Court (district court in your county) or arbitration (if you signed an arbitration agreement). Unlike EEOC charges filed under Title VII or ADA, California biometric data violations allow you to sue directly without filing an administrative complaint first. You will file a complaint in civil court alleging violation of California Labor Code § 226.1 or CCPA § 1798.100 et seq. Include: your full name, the employer's name and address, dates of biometric data collection, specific biometric identifiers collected, copies of any written notice (or evidence of lack thereof), and a demand for statutory damages ($100–$750 per violation), actual damages, and attorney's fees. You may sue as an individual or as part of a class action. Many biometric violations are pursued as class actions because multiple employees are typically affected. No government agency filing is required; you proceed directly to court.

Step 4: Expect discovery and possible investigation. If you file a lawsuit, your employer will likely deny the allegations and claim they provided proper notice, obtained consent, or that the collection was legally mandated. The discovery process (exchange of documents and witness statements) will take 6–12 months. If you pursue a class action, the case will likely take 2–3 years or longer. During this time, the employer may argue that the consent requirement does not apply to their specific use of biometric data, or that you consented by accepting employment or using the biometric system. However, California courts have held that silence or continued employment does not constitute written consent.

Step 5: Consult an employment attorney who specializes in biometric privacy and California labor law. Given the statutory damages of $100–$750 per violation and the private right of action, most employment attorneys will handle biometric cases on a contingency fee basis (they take a percentage of the recovery rather than charging hourly fees). An attorney can advise you whether you have an individual claim or whether joining a class action is more advantageous. They can also assess whether the employer's use of biometric data falls within any narrow exception. Look for an attorney with experience in California CCPA and Labor Code § 226.1 claims, as these are specialized areas.