Illinois Biometric Information Privacy Act
Illinois (home state)
face + video
Strict-liability statute with an uncapped private right of action and per-person statutory damages; Rosenbach v.
To prove a signature, YouSignedHere can capture the three most heavily regulated categories of consumer data at once. This is the full map: which law reaches each one, in its own citation, why each needs a lawyer’s sign-off, and what we commit to do.
yousignedhere.com is an Illinois-based "provable" e-signature product whose proof mechanism combines the three single most heavily regulated categories of consumer data at once: a photograph plus a liveness check, precise GPS/IP geolocation, and an audio-video recording of the signer (the liveness check scores motion and creates no face template — see the architecture). That stack sits at the intersection of biometric-privacy statutes, wiretap/recording-consent laws, comprehensive state privacy acts, and the ESIGN/UETA validity regime — and the company's home state (Illinois) hosts the two highest-exposure laws in the country for this exact fact pattern (BIPA face-scan class actions and all-party eavesdropping liability). Real litigation exposure is concentrated in the private-right-of-action, statutory-damages laws: Illinois BIPA (face scan), California CIPA plus the ~12 all-party-consent recording states (the verification video), and — on international expansion — GDPR/UK GDPR/LGPD/Quebec Law 25. AG-enforced regimes (Texas CUBI/TDPSA, the Colorado/Maryland/Washington comprehensive and health-data acts, and FTC Section 5 across all three data types) form a strong second tier. After merging seven expert catalogs and applying adversarial verification, six citations were corrected and three claims adjusted (VPPA exposure raised, SCA requirement narrowed, Quebec biometric obligation re-attributed to CQLR c. C-1.1). Nothing here is legal advice; every launch decision below requires licensed-counsel sign-off.
These carry a private right of action with statutory damages, so they drive class-action risk regardless of any regulator. Everything else is a strong second tier.
Strict-liability statute with an uncapped private right of action and per-person statutory damages; Rosenbach v.
Plaintiffs' firms actively mine consumer-facing recording features for class actions, and the $5,000-per-violation statutory floor multiplies across a class.
The product records signers nationwide, so a lawful design must satisfy the strictest state, not Illinois alone.
Most of the law below turns on one question: does this product create a biometric identifier? That is a question about implementation, not intent, so here is the exact data flow — and the one line that decides the answer.
A signed attestation from your phone that a user-verified person is present — the cryptographic result of the same check that unlocks the phone, verified on our server for its user-present and user-verified flags. Coordinates, if you tapped Allow on the location prompt. The consent record, with its timestamp. No photograph, no motion samples, no video — no image of any kind.
Sent to our server — fallback lane (the camera presence check, for devices without a platform authenticator)Motion samples — your phone samples a 64×48 grid of brightness values per frame and computes the frame-to-frame differences itself; only the resulting delta numbers are sent, and the server scores them to reach the presence verdict. A photograph of the surroundings (JPEG) — only if the signer chooses the street-imagery location upgrade; the standard fallback sends no photo. Coordinates, if location permission was granted. The consent record, with its timestamp.
Never created, never sent, never stored — either laneA face template. No template of face geometry is computed by us — not on the phone, not on the server. There is no face-matching code in the product. The motion samples are brightness deltas used to tell live motion from a held-up photo: on the standard check they watch the signer for a blink or a turn; on the optional street-imagery upgrade the camera faces the surroundings, so the samples score handheld scene motion while the scene match answers where. Either way they are mathematically incapable of identifying anyone. On the default lane, the face never reaches us in any form — the match happens inside your phone's secure hardware.
Illinois BIPA defines a biometric identifier as “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry,” and then says the term “do[es] not include writing samples, written signatures, photographs…” A photograph is excluded by name. A grid of brightness values is not a scan of face geometry. Neither is a biometric identifier, so the duties that attach to one do not attach here.
The photograph exclusion holds only because nothing derives a face template from the photograph. Illinois courts have been explicit on this: the image is excluded, but a scan of face geometry extracted from that image is a biometric identifier — the reasoning behind the largest BIPA settlements on record. Adding face matching to this product would move it from outside the definition to squarely inside it, along with the private right of action and per-scan damages. That is the single change most capable of altering this document.
The photograph is still personal data — excluded from biometric identifier, not from privacy law generally — so the stronger architecture removes our need to receive an image at all, by using the verification your phone already performs.
Face ID and Android’s biometric prompt already authenticate you dozens of times a day, including for card payments. The device holds the biometric, performs the match in secure hardware, and releases only a result. Built on that, a signature can be produced by a key held in the phone’s secure element that only unlocks on a successful biometric check, and the phone then signs the document hash directly. The signature itself becomes cryptographic proof that the enrolled owner authenticated — while we receive no image and no template.
Shipped, 2026-08-15 — and now the default. The signer's presence check
is delegated to the phone's platform authenticator (the WebAuthn ceremony behind Face ID / fingerprint),
with the user-present and user-verified flags verified on our server against a server-minted, single-use
challenge. The sender's signature already works the same way: a key in the platform authenticator signs
the document's hash directly. Verifiable in source — server.js (the /m ·
authn lane), lib/webauthn.js, test/mobile-platform-authn.test.js,
test/ceremony-verification.test.js. The camera flow described above remains as the
fallback for signers whose device has no platform authenticator — or who prefer not to use one.
A platform biometric proves that the enrolled owner of this device authenticated. It does not prove which named human that is — the phone attests to its owner, not to an identity. So identity is established once, at enrollment, and the device attestation binds each later signature to that enrolled person. This is the same trust model banks rely on for payment confirmation, and it is why the location and video steps still matter: they answer where and when, which no credential can.
Your phone's unlock and our fallback camera check both point a camera at a face, and that is where the similarity ends. They answer different questions, and the difference is exactly what the biometric statutes turn on.
Uses a stored template of your face geometry — created once when you enrolled, held in the phone's secure hardware, matched on-device every time. It answers “is this the enrolled owner?” — an identity check. That template exists because you chose to enroll it with Apple or Google under their biometric terms; it never leaves the device and we never receive or touch it — we receive only the signed yes/no result.
Our fallback presence check (the V1 camera lane)Stores nothing and matches against nothing — there is no template anywhere, ours or the phone's. Brightness deltas across a few frames prove a live human is present rather than a held-up photo. It answers “is a real person here?” — a presence check, deliberately identity-blind. Stated honestly: anyone in front of the camera would pass it. It defeats a still image — the which human comes from the signing session's authentication, not from the face.
Some people choose not to enroll Face ID or fingerprint unlock at all — that choice should not cost them the ability to sign. The camera presence check is offered for exactly that reason: it requires no stored face template on your phone, and creates none anywhere — not on the device, not on our servers. Nothing biometric leaves your phone on either lane; on the fallback, what leaves is the motion evidence of a live presence (and, only if you choose the location upgrade, a photograph of your surroundings — never required). Both lanes end at the same sealed evidence record.
These are the laws that reach a face — the highest-exposure statutes in the country. They are catalogued here in full because the analysis must survive a change of implementation. On the current architecture they largely do not attach: on the default lane no image of any kind reaches us (your phone's own authenticator does the matching, on-device), and on the camera fallback no face template is created — BIPA excludes photographs from “biometric identifier” by name (see what actually leaves your phone). Add face matching by us and every duty below applies in full.
Before capturing a scan of face geometry, give written notice of the specific purpose and retention period, obtain a written release (e-signature satisfies this under PA 103-0769, eff. Aug. 2, 2024), publish a written retention/destruction schedule, and never sell or profit from the data.
Why we get a sign-offStrict-liability statute with an uncapped private right of action and per-person statutory damages; Rosenbach v. Six Flags holds a bare notice/consent violation is independently actionable without proven harm. Illinois is the home jurisdiction, and a product in this category is one implementation decision away from the statute — this is the single highest litigation-exposure law in scope and has produced nine-figure settlements against face-scan products.
Inform the individual and obtain consent before capturing a biometric identifier (face geometry) for a commercial purpose, and destroy the identifier within a reasonable time, not later than one year after the collection purpose ends.
Why we get a sign-offNo private right of action, but the Texas AG is the most aggressive biometric enforcer in the country ($1.4B Meta and $1.375B Google settlements) with $25,000-per-violation authority; the notice/consent script and the one-year destruction commitment need sign-off before Texas signers are scanned.
Private entities are prohibited outright from using face recognition technology in places or services of public accommodation within Portland city limits; consent does not cure the violation.
Why we get a sign-offThis is a categorical ban, not a consent regime, enforceable by a private litigant for the greater of actual damages or $1,000/day per violation plus fees. Counsel must decide whether the liveness check even qualifies as 'face recognition' and whether it can lawfully run at all for any signer located in Portland.
Commercial establishments collecting biometric identifier information must post clear signage at customer entrances and are flatly barred from selling, leasing, trading, or otherwise profiting from that data.
Why we get a sign-offCarries a private right of action with statutory damages (the sale/profit ban has no cure period), but it is unclear without legal analysis whether a remote e-signature platform is a 'commercial establishment' (a term built around physical storefronts) — a scoping question for counsel.
Companies using biometric technologies should assess and mitigate foreseeable harms, avoid surreptitious collection, vet third-party biometric vendors, train staff, and substantiate accuracy/bias claims before deployment.
Why we get a sign-offThe statement previews the exact enforcement theories (deceptive accuracy claims, unfair collection/retention) the FTC would apply to a liveness product; counsel should map the product against each listed practice pre-launch.
A business may not 'enroll' a biometric identifier (convert a face scan into a matchable reference template) in a database for a commercial purpose without first giving notice and obtaining consent or providing a prevention mechanism.
Why we get a sign-offThe 'enroll' trigger turns on template creation, not mere capture, creating real ambiguity about whether a one-time liveness check that discards the template is even covered — a legal-interpretation question, not an engineering one.
With actual knowledge a signer is under 13, the service may not collect biometric identifiers (facial templates), precise geolocation, or photos/videos of the child without verifiable parental consent and clear notice.
Why we get a sign-offThe 2025 Rule amendments newly classify facial/biometric templates as personal information, and e-signature use cases (minor beneficiaries, custody/school forms) create real exposure to underage signers, so age-gating and parental-consent design need counsel review before biometric/geo capture triggers COPPA.
Recording the signer is not just biometric source data — it is a recording, and recording-consent law is a second critical axis with its own private lawsuits and, in some states, criminal penalties.
All parties to a 'confidential communication' must consent before it is recorded by electronic device; California courts have extended CIPA to in-app and web session capture. (Note: the modern web/in-app session-recording cases usually run through the companion § 631 'interception in transit', while § 632 governs recording a 'confidential communication' — the video step implicates § 632.)
Why we get a sign-offPlaintiffs' firms actively mine consumer-facing recording features for class actions, and the $5,000-per-violation statutory floor multiplies across a class. The verification-video feature is a direct hit; the exact consent-capture sequencing and disclosure language need counsel review before any California rollout.
Every party to a recorded conversation must consent; the same verification-video flow that is lawful in a one-party state can be a criminal offense in these states unless explicit, logged consent is obtained before recording begins. (Precision: Oregon and Nevada are split — all-party for in-person, one-party by phone — so the strict-state design should key on the genuinely all-party states.)
Why we get a sign-offThe product records signers nationwide, so a lawful design must satisfy the strictest state, not Illinois alone. These statutes carry criminal penalties AND private civil damages, and consent must be preserved as evidence for every session.
All-party consent is required to record any 'private conversation' (including audio captured during the video step); surreptitious non-consensual recording is a felony.
Why we get a sign-offA signer recording themselves in an app they opened is defensible as consented, but if the flow ever captures a second person's voice (a witness, notary, or bystander) without that person's own consent it becomes felony eavesdropping exposure with a companion civil remedy.
Recording an oral, wire, or electronic communication is lawful under federal law with at least one party's consent, and never for a criminal or tortious purpose.
Why we get a sign-offFederal one-party consent is only a floor that does not preempt the ~12 stricter all-party-consent states; violations carry civil damages, punitive damages, fees, and criminal penalties, so the design must defer to the strictest applicable state law.
Applies to disclosure of a consumer's PII about PRERECORDED audiovisual content they obtained — 18 U.S.C. § 2710(c) gives a private action ($2,500 min). It is not a general 'video = liability' rule.
Why we get a sign-offHARDENED (re-verified 2026-07-23): applicability here is LIKELY MINIMAL. VPPA targets a 'video tape service provider' that delivers PRERECORDED audiovisual content and then discloses a consumer's viewing PII; recording a user's own live verification video does not fit that trigger. The $2,500 damages/private action are real, but the statute is a poor fit unless the product also serves prerecorded video library content.
18 U.S.C. § 2707 gives a private action (min. $1,000) — but chiefly against unauthorized access to stored communications, not first-party custody of your own users' evidence.
Why we get a sign-offHARDENED (re-verified 2026-07-23): as a theory against the company storing its OWN users' captured evidence, this is WEAK. The SCA targets unauthorized third-party access to a communications facility, or a public provider's wrongful disclosure — not a custodian holding data it captured from its own users (§ 2701(c) exempts service-authorized conduct). Real exposure is if an outsider breaches the store.
Capturing GPS/IP location triggers electronic-tracking statutes and precise-geolocation "sensitive data" rules — consent is a precondition, not a nicety.
It is unlawful to use an electronic tracking device to determine a person's location or movement absent consent; the statute frames its consent exception around the registered owner/lessor/lessee of a vehicle.
Why we get a sign-offAs the home-state criminal hook, this makes documented, unambiguous consent a precondition (not an optional nicety) for every precise-location capture; whether the vehicle-framed consent exception cleanly covers app-based phone GPS is a legal-interpretation question counsel must resolve.
Collecting or sharing precise location data — especially data revealing visits to sensitive locations — without clear consumer knowledge and consent is an unfair or deceptive practice.
Why we get a sign-offEven where no state statute governs, Kochava establishes a national floor requiring documented consent and a sensitive-location screening program before precise geolocation is captured, used, or shared with the street-view verification vendor.
Using an electronic tracking device to determine a person's location is unlawful absent consent; § 637.2 gives any injured person a civil action for the greater of $5,000 per violation or treble actual damages.
Why we get a sign-offPairs a criminal prohibition with an uncapped statutory-damages private right of action; consent must be captured before, not merely alongside, GPS acquisition. The statute's consent exception is framed around the vehicle owner/lessor/lessee, so its applicability to app-based phone GPS is a legal question.
The state consumer-privacy acts and the FTC treat biometric and precise-geolocation data as sensitive across the board — most require opt-in consent.
'Consumer health data' is defined broadly enough to sweep in biometric and precise-geolocation data tied to inferences about physical/mental health; it requires opt-in consent to collect/share, separate written authorization to sell, and bans geofencing near health facilities even with consent.
Why we get a sign-offEnforceable by a private right of action through the Washington CPA with treble damages up to $25,000 per violation plus fees; the live risk is that the product's biometric/geolocation data is inadvertently characterized as 'consumer health data.'
Data practices around biometrics, precise location, and video must match the company's privacy representations; surreptitious collection, inadequate security, or undisclosed secondary use is an unfair or deceptive practice.
Why we get a sign-offSection 5 is the FTC's primary general biometric/location enforcement tool, and the FTC has stated that state-law compliance does not preclude a Section 5 action; marketing accuracy claims ('proof'/'liveness') and consent flows need legal review before launch.
Biometric information used for unique identification and precise geolocation (within ~1,850 feet) are sensitive personal information; give notice at or before collection, limit use to what is reasonably necessary, and honor the consumer's right to limit use/disclosure (California uses an opt-OUT/right-to-limit model, not opt-in).
Why we get a sign-offNo general private right of action (breach claims only, § 1798.150), but active CPPA/AG enforcement and the largest US consumer base make the 'Limit the Use of My Sensitive Personal Information' mechanics and notice high-stakes — and they must coexist with the evidentiary-retention purpose the product is built around.
Obtain clear, affirmative, freely-given opt-in consent before processing biometric-for-identification now, and precise geolocation from Aug. 12, 2026; a controller may not condition service on that consent or penalize refusal.
Why we get a sign-offColorado has the most detailed AG rulemaking on valid opt-in consent, and its anti-conditioning provision may directly conflict with a product where the facial scan IS the proof mechanism — a legal design question — plus the geolocation category needs a compliance-date-aware update before August 2026.
Biometric data processed for unique identification and precise geolocation are sensitive data requiring prior opt-in consent before processing.
Why we get a sign-offThe Texas AG is the most aggressive comprehensive-privacy and biometric enforcer, and TDPSA overlaps the standalone CUBI statute, so dual exposure warrants dedicated review even without a private right of action.
Biometric data (even if not used for identification) and precise geolocation (~1,750 feet) are sensitive data that may only be collected/processed/shared when 'strictly necessary' to the requested product, and MODPA imposes an absolute ban on selling sensitive data that consumer consent cannot override.
Why we get a sign-offThe strict-necessity standard is stricter than ordinary opt-in consent and the sale ban is absolute, so counsel must confirm the facial-scan/video/geolocation flow — including vendor sharing for street-view verification — does not constitute a 'sale' or exceed strict necessity.
Obtain clear, affirmative opt-in consent before processing biometric-for-identification and precise geolocation (sensitive data); as of July 1, 2026 a controller may not sell precise geolocation at all.
Why we get a sign-offAG-only enforcement with a cure period, but counsel must confirm any sub-processor sharing (e.g., street-view verification vendors) does not cross into a now-banned 'sale' for Virginia residents.
Obtain prior opt-in consent before processing biometric-for-identification and precise geolocation; from Oct. 1, 2026 precise geolocation may not be sold by a controller or third party.
Why we get a sign-offConnecticut requires opt-in specifically for precise geolocation, and the same sale-vs-processing line-drawing as Virginia applies to the evidentiary video/location bundle shared with any downstream verification partner.
Biometric data and precise geolocation (~1,750 feet) are sensitive data requiring opt-in consent, and as of Jan. 1, 2026 Oregon bans the sale of precise geolocation outright regardless of consent.
Why we get a sign-offThe 2026 sale ban applies even with consumer consent, so counsel must confirm the video/location-verification workflow and vendor sharing do not cross into a prohibited 'sale'; Portland's facial-recognition ban stacks on top for Portland signers.
If the identity-verification/liveness output (or a vendor's assembled report on the signer) is used or expected to be used to help decide eligibility for credit, employment, insurance, or a similar purpose, the entity assembling/furnishing it must meet FCRA's accuracy, disclosure, and dispute obligations as a consumer reporting agency.
Why we get a sign-offWhether the verification output is a 'consumer report' is a fact-specific classification question turning on how it is marketed and reused downstream by customers, which counsel must resolve before any customer uses the identity data for an eligibility decision.
The signature is generally fine — the ESIGN Act and state UETA make it binding. The sign-off is needed on the proof method, not the signature.
An electronic signature/record may not be denied legal effect for being electronic where intent and attribution are shown; before substituting an electronic record for a required consumer paper writing, give the § 7001(c) disclosures and obtain affirmative, informed consent (including the right to paper and to withdraw); retained records must remain accurate and accessible.
Why we get a sign-offThe product's entire value is courtroom-admissible proof, so the consent-disclosure and record-retention flow must strictly track § 7001(c)/(d) or the evidentiary chain can be attacked on ESIGN-compliance grounds.
An electronic signature is attributable to a person if it was that person's act, determined from surrounding circumstances including any security procedure used; New York governs purely intrastate e-signatures under ESRA rather than UETA.
Why we get a sign-offThe biometric/geo/video proof is precisely the 'security procedure'/surrounding circumstance courts use for UETA attribution, and New York's ESRA diverges from the 49-state UETA text the product is otherwise designed around.
Not current US exposure — flagged for counsel before any EU, UK, Canada, or Brazil launch. Each generally demands explicit consent for biometrics.
Biometric-for-identification data needs explicit consent (Art. 9(2)(a)) PLUS a separate Art. 6(1) basis; reading device location needs separate ePrivacy consent; transferring EU/UK data to US (Illinois) servers needs SCCs/adequacy plus a post-Schrems II transfer impact assessment; the UK additionally requires a Schedule 1 condition and Appropriate Policy Document.
Why we get a sign-offExplicit consent has a materially higher bar than ordinary consent (no bundling into general T&Cs), fines reach 4% of global turnover, individuals have a direct private right of action (Arts. 79/82), and US storage of biometric/location data is the exact Schrems II fact pattern regulators scrutinize. Currently monitor because the product operates from Illinois; jumps to high/critical on any EU/UK market entry.
Before creating any biometric database or using biometric characteristics to verify a Quebec signer's identity, obtain explicit consent AND notify Quebec's regulator (the CAI) at least 60 days before bringing the biometric database into service.
Why we get a sign-offThe 60-day pre-notification to the CAI is a hard procedural gate with no US equivalent, and Quebec's regulator applies an aggressively high bar to valid biometric consent (s. 93.1 mandates minimum $1,000 punitive damages). Adversarial review corrected the earlier misattribution: the biometric/60-day obligation lives in CQLR c. C-1.1, not P-39.1. Monitor until Quebec expansion.
Because facial-biometric and precise-location data are sensitive, PIPEDA requires express (opt-in) consent, telling the individual specifically what is collected, why, retention period, who can access it, and how to withdraw.
Why we get a sign-offThe 'private right of action' is qualified — it is a s.14 Federal Court application only after exhausting an OPC complaint, not a direct suit. OPC's 2025 biometrics guidance raised the bar on meaningful consent; a US-style clickwrap will likely fail. Monitor until Canadian (ex-Quebec) expansion.
Facial biometric data used to identify a person is sensitive personal data processable only with the data subject's specific, highlighted, free, informed and unequivocal consent, or a narrow indispensability exception (e.g., fraud prevention, Art. 11(II)(g)).
Why we get a sign-offLGPD demands a separate, prominent (non-bundled) consent distinct from general terms acceptance, ANPD enforcement is actively focused on facial biometrics, and Art. 42 supports a civil damages action. Monitor until Brazil expansion.
Each of these treats biometric identifiers and precise geolocation as sensitive data. The column that matters is whether collecting it needs opt-in consent — most now do.
| State | Law | Sensitive-data rule |
|---|---|---|
| California | California Consumer Privacy Act / CPRA | Opt-out / notice |
| Colorado | Colorado Privacy Act (CPA) | Opt-in required |
| Connecticut | Connecticut Data Privacy Act (CTDPA) | Opt-in required |
| Maryland | Maryland Online Data Privacy Act (MODPA) | Opt-in required |
| Montana | Montana Consumer Data Privacy Act (MCDPA) | Opt-in required |
| New Jersey | New Jersey Data Privacy Act (NJDPA) | Opt-in required |
| Oregon | Oregon Consumer Privacy Act (OCPA) | Opt-in required |
| Texas | Texas Data Privacy and Security Act (TDPSA) | Opt-in required |
| Utah | Utah Consumer Privacy Act (UCPA) | Opt-out / notice |
| Virginia | Virginia Consumer Data Protection Act (VCDPA) | Opt-in required |
| Washington | My Health My Data Act (MHMDA) | Opt-in required |
SCOPE ACHIEVED: This catalog covers all three data types in the product (facial/liveness biometrics, precise geolocation, and audio-video recording) plus the e-signature validity/consent layer and recording-consent law. FEDERAL coverage is reasonably complete (FTC Section 5 + 2023 Biometric Policy Statement + Kochava, ESIGN, Federal Wiretap Act/ECPA, Stored Communications Act, VPPA, FCRA, COPPA). STATE coverage is SELECTIVE, not all-50: biometric-specific statutes for Illinois (BIPA), Texas (CUBI), and Washington (RCW 19.375); municipal laws for New York City and Portland, OR; recording/tracking statutes for Illinois and California plus a representative ~12-state all-party-consent list (CA, CT, DE, FL, IL, MD, MA, MT, NH, OR, PA, WA, split NV); and comprehensive consumer-privacy acts for CA, VA, CO, CT, UT, TX, OR, MT, MD, NJ plus Washington's MHMDA. NOT COVERED / UNVERIFIED: (1) the ~30 states with no comprehensive privacy law and states with enacted-but-unanalyzed acts (e.g., Iowa, Indiana, Tennessee, Florida FDBR, Delaware, Nebraska, New Hampshire, Minnesota, Rhode Island, Kentucky) — their sensitive-data/opt-in posture was not individually confirmed; (2) the full 50-state wiretap/recording map beyond the representative all-party list; (3) state-by-state pinpoint verification of every geolocation "sale ban" effective date; (4) sector-specific overlays (HIPAA, GLBA, notary/RON law) not requested. INTERNATIONAL (EU/UK/Canada/Quebec/Brazil) is included as EXPANSION-ONLY and is not an exhaustive treatment. Citations reflect adversarial skeptic review — several pinpoint cites were corrected — but statutes amend frequently; confirm current text before reliance. Educational research only, not legal advice. | CITATION HARDENING (2026-07-23): a second, independent verification pass re-checked the highest-stakes and previously-adjusted citations against primary sources. CONFIRMED: BIPA §§15/20 and damages, SB 2979 (PA 103-0769, eff. Aug 2 2024), CIPA §§632/637.2 and $5,000 private action, the all-party state list, Illinois Eavesdropping (post-2014 rewrite), Quebec C-1.1 ss.44-45, FTC v. Kochava (stipulated order 2026), and all four settlement figures ($650M / $68.5M Meta; $1.4B / $1.375B Texas AG). DOWNGRADED as overstated: VPPA and Stored Communications Act — the citations are correct but both are poor fits for a first-party recorder/custodian, so their real exposure is low. The $1.375B Google settlement bundled geolocation with biometric claims (not purely biometric).
A few technical facts about the product swing whole statutes in or out of scope. Counsel needs the answers.
Each law above names its own “why we get a sign-off.” The through-line: whether the liveness check legally counts as a “biometric identifier,” whether the video step triggers all-party recording law in a given state, whether the location flow is a prohibited “sale,” and whether the consent UX satisfies each statute’s specific form — these are legal determinations applied to our exact architecture. We build toward the strictest standard and hold the gate; counsel confirms it clears.
Everything this product asks for, your phone already does — and the way the established players do it is the reason it holds up. That pattern is worth stating plainly, because it is the pattern we build to.
Face ID and Android face unlock run from the moment you set the phone up. Google requires a user-verification step — face, fingerprint, or PIN — as the minimum bar for a passkey, which is the login method replacing passwords across the web.
Location, camera, microphoneBoth platforms already gate these behind an explicit, per-app, revocable prompt. Granting a map app your location is the same consent mechanism, worded the same way, that this product uses.
It is tempting to stop at “everyone does it.” That is the wrong lesson, and legally it is worth nothing — no biometric statute has a because-it-is-common exemption. BIPA’s notice and written-release duties attach to the private entity doing the collecting, however ordinary the practice.
The right lesson is architectural. Apple states that Face ID data never leaves the device; it lives in the Secure Enclave, and the images captured during a match are discarded immediately. With passkeys, the server never receives biometric data at all — the phone checks your face locally and sends a cryptographic result. Google never sees your face; it sees a public key.
Match on the device. Transmit only the outcome. Then get consent anyway, in writing, before anything is captured — because the architecture reduces the exposure, and the consent is what satisfies the statute.
A face check alone answers “is this the right person?” It cannot answer “were they actually there?” A stolen or replayed face credential works from anywhere in the world. Binding the signing moment to a device-reported location and a short recording is what makes that fail: the signature is tied to a person, a place, and a time, rather than to a credential that travels.
That said, the location and video capture are severable by design. Turn them off and the product still works as an ordinary e-signature tool — a weaker evidentiary record, and a materially smaller legal footprint, which is exactly the trade-off a signer should be allowed to make for themselves.
Details you enter the first time are reused on every document afterward, and every stored value stays visible to you — editable, deletable, and groupable into separate sets for personal, employer, or client work, so the right information attaches to the right document without re-typing it.
Every source below was fetched and confirmed to resolve on 2026-07-30. Where the law itself is published online, we link the law — not an article about it. A copy of each text is archived alongside this document, so the governing language survives any one site going dark.
| Law | Source |
|---|---|
| Illinois BIPA — 740 ILCS 14/15 (notice, written release, retention) | link · the statute itself |
| Illinois BIPA — 740 ILCS 14/10 (DEFINITIONS: photographs and written signatures are excluded from 'biometric identifier') | link · the statute itself |
| Illinois BIPA — 740 ILCS 14/20 (private right of action, damages) | link · the statute itself |
| Texas CUBI — Bus. & Com. Code § 503.001 | link · the statute itself |
| Washington Biometric Privacy — RCW 19.375.020 | link · the statute itself |
| NYC Biometric Identifier Information — Admin. Code ch. 12 (§§ 22-1201–1205) | link · the statute itself |
| Portland Private-Sector Face Recognition Ban — PCC ch. 34.10 | link · the statute itself |
| FTC Policy Statement on Biometric Information & Section 5 (2023) | link · the regulator’s own page |
| Texas CUBI — AG enforcement page | link · the regulator’s own page |
| Law | Source |
|---|---|
| FTC v. Kochava — final order banning sale of sensitive location data (May 2026) | link · the regulator’s own page |
| CCPA/CPRA definitions incl. precise geolocation — Cal. Civ. Code § 1798.140 | link · the statute itself |
| Illinois Electronic Tracking Devices — 720 ILCS 5/21-2.5 | link · the statute itself |
| Washington My Health My Data (incl. precise location as consumer health data) — RCW 19.373 | link · the statute itself |
| Law | Source |
|---|---|
| California CIPA — Penal Code § 632 (all-party consent) | link · the statute itself |
| California CIPA — Penal Code § 637.7 (electronic tracking) | link · the statute itself |
| Illinois Eavesdropping — 720 ILCS 5/14-2 (all-party consent) | link · the statute itself |
| Federal Wiretap Act — 18 U.S.C. § 2511 | link · the statute itself |
| Florida Security of Communications — Fla. Stat. § 934.03 | link · the statute itself |
| Massachusetts Wiretap — Gen. Laws ch. 272 § 99 | link · the statute itself |
| All-party consent states — maintained survey | link · maintained multi-state survey |
| VPPA — 18 U.S.C. § 2710 | link · the statute itself |
| Stored Communications Act — 18 U.S.C. ch. 121 | link · the statute itself |
| Law | Source |
|---|---|
| ESIGN Act — 15 U.S.C. § 7001 | link · the statute itself |
| Illinois UETA — 815 ILCS 333 | link · the statute itself |
| Law | Source |
|---|---|
| COPPA Rule — 16 C.F.R. Part 312 (current text incl. biometric identifiers) | link · the statute itself |
| COPPA statute + Rule page — FTC | link · the regulator’s own page |
| Law | Source |
|---|---|
| FTC Act § 5 — 15 U.S.C. § 45 | link · the statute itself |
| Texas Data Privacy & Security Act — Bus. & Com. Code ch. 541 | link · the statute itself |
| Law | Source |
|---|---|
| Apple Platform Security — Face ID data never leaves the device (Secure Enclave) | link · the regulator’s own page |
| FIDO Alliance — passkeys: biometric never leaves the device; server gets a public key | link · the regulator’s own page |
| Google — passkeys: the server never sees biometric data | link · the regulator’s own page |
Links are re-checked mechanically before each publish, and the check fails the build if any source stops resolving. This appendix exists because an earlier version of this document cited a law firm’s summary of the New York City biometric ordinance instead of the ordinance itself — and that page was later taken down.