Short answer: BIPA compliance for facial recognition access control comes down to repeatable steps: define the purpose, give written notice, get a written release before any scan, publish a retention policy, offer alternatives and delete data on schedule or on request. Edge.AI by Proptech.AI is designed to help, with consent as the first enrollment step and PII kept off the device. Building compliance in from day one is also the most cost-effective route.
Key takeaways
- Illinois BIPA requires notice and a written release before collection, a published retention policy, and destruction once the purpose is met or 3 years after the last interaction, whichever comes first.
- GDPR places identifying biometric data in its special categories under Article 9, and the CCPA grants California consumers rights over their personal information.
- Texas, Colorado, New York City, Canada and cities such as Portland add their own rules, so map every site before enrolling anyone.
- A consent-first enrollment flow with QR and RFID alternatives, deletion on request and PII separation covers much of the operational work.
- Getting consent right at enrollment costs less than retrofitting it later, which strengthens the business case for AI access control.
Which laws apply to facial recognition access control?
That depends on where each site is and who enrolls, since biometric rules are set at state, city and national level.
This is general information, not legal advice. Laws change, so confirm current requirements with counsel for every location.
| Rule | Where it applies | What it asks of operators, in brief |
|---|---|---|
| Illinois BIPA, 740 ILCS 14 | Private entities collecting biometrics in Illinois | Notice in writing, a written release, a published retention schedule, destruction on time, and no sale of or profit from biometric data |
| GDPR Article 9 | EU organizations, and some outside the EU that serve people there | Identifying biometric data is special-category data that needs an exception, such as explicit consent |
| California CCPA | Businesses that meet its thresholds | Consumer rights such as knowing what is collected and requesting deletion |
| Texas Business and Commerce Code ch. 503 | Capture or use of biometric identifiers in Texas | Notice and consent before capture for a commercial purpose |
| Colorado HB24-1130 | Colorado | Privacy rules for biometric identifiers and data |
| NYC Local Law 3 of 2021 | Covered commercial establishments, such as retail, food and drink and entertainment venues | Signage at customer entrances when biometric identifier information is collected; selling biometric data is prohibited |
| Portland, Oregon ordinance (2020) | Places of public accommodation in Portland | Private use of face recognition is banned, so use non-biometric credentials |
| OPC Canada guidance (2025) | Businesses in Canada | Express consent is generally appropriate for biometrics; Quebec has additional reporting requirements |
| FTC Policy Statement (May 2023) | Businesses in the United States | Unsubstantiated claims about the accuracy of biometric technology can be deceptive |
What does BIPA require from property operators?
BIPA stands out because individuals can sue for liquidated damages, so each duty carries real exposure:
- Notice and release: written notice that biometric data is being collected, for what purpose and for how long, plus a written release before collection.
- Retention policy: a written policy, available to the public, with a schedule for destroying biometric data.
- Destruction: once the original purpose has been met, or 3 years after the person last interacted with the entity, whichever is sooner.
- No profiting: biometric data may not be sold, leased, traded or otherwise used for profit.
- Damages: $1,000 per negligent violation and $5,000 per intentional or reckless violation, with a 2024 amendment that limits repeated identical collections from the same person to one violation.
Read the full text of 740 ILCS 14 with counsel before enrolling anyone at an Illinois site.
How do GDPR and the CCPA change the picture?
They widen it beyond Illinois. Under GDPR Article 9, biometric data processed to uniquely identify a person is special-category data, and processing it is prohibited unless an exception applies, such as explicit consent; GDPR Article 4 sets out the definitions. In practice, that means a clear purpose, explicit consent and a genuine alternative for anyone who declines.
California’s CCPA lets consumers exercise rights over personal information held by covered businesses, including biometric information: they can ask what is collected and request deletion, so build both into your process.
What should an operator’s compliance checklist include?
These steps form a practical baseline for any biometric proptech deployment, in any jurisdiction:
- Purpose: document that biometrics are used for access control and nothing else.
- Location map: list every site and the state, city and national rules that apply to it.
- Notice: tell people in writing what is collected, why and for how long, and post signage where the law requires it.
- Consent first: collect a written release or explicit consent before any biometric data is captured.
- Alternatives: offer a non-biometric credential, such as a QR code or card, with no penalty for choosing it.
- Retention policy: publish a written schedule for destroying biometric data.
- Deletion: honor requests promptly and delete data when people leave.
- Vendor diligence: confirm where data is stored, how PII is separated, that data is not sold and how accuracy claims are substantiated, using independent programs such as the NIST Face Recognition Technology Evaluation as context.
- Training and review: train staff on the policy and revisit it each year or when the law changes.
How does Edge.AI support each step?
It builds the privacy steps into enrollment and data handling: Proptech.AI designed Edge.AI facial recognition access control to help operators meet BIPA, GDPR and other federal, state and municipal privacy requirements, without offering legal advice.
- Consent first: app-less enrollment opens with the biometric privacy consent screen, and the built-in forms set out two limits in writing: no sale of data to third parties, and no use without authorization.
- Alternatives: anyone who declines gets a non-biometric route in, either an RFID card or a phone QR code that needs no app.
- Deletion: every record tied to a person can be deleted when they ask.
- PII separation: PII is separated from the Edge.AI device and from the management console, and the split hardware design keeps sensitive data away from the user-facing unit.
- Analytics: reports come from a separate platform, not the management console, and use tokenized data with PII removed.
- Security and hosting: Proptech.AI describes end-to-end encryption, data anonymization and stringent access controls, with cloud or on-prem hosting.
What extra care do minors, residents and employees need?
More attention to whether consent is a real choice. Where minors are involved, at pools, climbing gyms, recreation centers or in student housing, a parent or guardian has to consent before enrollment, and a non-biometric alternative has to be on offer.
In senior living, consent should come from the resident or a legally authorized representative. For employees and contractors, offering a QR code or card alongside facial recognition helps show that enrollment is voluntary. Government-operated facilities may face different rules altogether.
Why is compliance by design the cost-effective choice?
Because fixing consent after the fact costs more than getting it right at enrollment. BIPA exposure is counted per violation, so a system that collects a release before the first scan, offers alternatives and deletes data on schedule turns compliance into routine operations rather than a legal project.
Handled this way, compliance strengthens the case for AI access control as the most cost-effective proptech investment, set out in full in the 2026 analysis of AI access control costs. For setting-specific guidance on consent, signage and alternatives, see the guides to AI access control by industry.
Frequently asked questions
Before collecting biometric identifiers, a private entity covered by the Illinois Biometric Information Privacy Act must give written notice and obtain a written release; it must also publish a written retention policy and destroy the data once the purpose is met or 3 years after the person’s last interaction, whichever is sooner. BIPA also bans selling or profiting from biometric data and provides liquidated damages. This is general information, not legal advice.
GDPR Article 9 places biometric data used to single out an individual in the special categories of personal data, which means processing is prohibited unless an exception, such as explicit consent, applies. Facial recognition access control can be designed around explicit consent, a clear purpose and a non-biometric alternative for anyone who declines. Confirm the lawful basis and any further obligations with counsel. This is general information, not legal advice.
Under the CCPA, California consumers have rights over personal information held by covered businesses, and biometric information is a category of personal information. A covered business using facial recognition access control should be ready to explain what it collects and to honor deletion requests. Edge.AI by Proptech.AI supports deletion of all data upon request. This is general information, not legal advice.
Under Local Law 3 of 2021, New York City requires covered commercial establishments, a group that includes retail stores, food and drink establishments and entertainment venues, to display signs at customer entrances if they collect biometric identifier information, and the law bars the sale of biometric data. Whether a specific property or tenant is covered depends on its use, so check the DCWP rule with counsel. This is general information, not legal advice.
Edge.AI by Proptech.AI is designed to help operators comply with BIPA, GDPR and other privacy frameworks. Enrollment starts with biometric privacy consent, the built-in forms rule out selling data to third parties, people who decline can choose QR codes or RFID cards, every record can be deleted on request, and PII is kept off the reader and out of the management console. Proptech.AI does not provide legal advice.
A minor can be enrolled in facial recognition access control only after a parent or guardian consents, and the minor must also be offered a non-biometric way in, for example a QR code or an RFID card. Pools, climbing gyms, recreation centers and student housing should build guardian consent into enrollment and confirm local rules. Government-operated facilities may face different requirements. This is general information, not legal advice.
Review your consent flow with Proptech.AI
See Edge.AI’s consent-first enrollment, opt-out alternatives and data deletion in a demo, or ask for a subscription quote for your sites. Use the contact form at the bottom of this page or email sales@proptech.ai.
