Exam CIPP-US topic 1 question 135 discussion

There is no federal regulation on the collection and use of this biometric data. Illinois became the first state to pass a biometric data privacy law, the Biometric Information Privacy Act (BIPA), in 2008, allowing for a private right of action However, the states of Illinois, Texas, and Washington have enacted state laws regulating biometric data in the workplace. In general, these state laws require employers to notify employees to explain their use of biometric data; obtain consent from employees; create policies for securing, managing, and purging biometric data; and refrain from disclosing or selling biometric data to third parties. Washington was the third U.S. state to enact legislation to regulate biometric data. Illinois and Texas both have laws on the books to regulate biometric data collection. As of 2020, California became the fourth state to regulate biometric data under the California Consumer Privacy Act.

Illinois Biometric Information Privacy Act