Glossary · Law
Biometric data
Biometric data is personal data derived from a person's physical or behavioural characteristics, such as a face, fingerprint, iris or voice, that can identify them. In law the term usually means the processed form, a template or embedding, not the photo itself. Because a face cannot be changed like a password, most privacy laws give biometric data a higher level of protection and require explicit consent or a specific legal basis to process it.
Updated November 6, 2026 · 2 min read
Is a photo biometric data?
Under the GDPR, a photo is biometric data only when it is processed by a specific technical means that allows unique identification, which is what a face search engine does when it computes a face embedding. The photo on your profile is ordinary personal data; the template an engine builds from it is special-category biometric data. Illinois' BIPA draws the line in the same place by naming "scan of face geometry" as a biometric identifier and excluding photographs.
How do the main laws treat it?
| Regime | Status | What is required |
|---|---|---|
| GDPR (EU) and UK GDPR | Special category (Article 9) | Explicit consent or another Article 9 condition; impact assessment; processing public photos is not exempt |
| BIPA (Illinois) | Biometric identifier | Written informed consent before collection, retention policy, no sale; private right of action with statutory damages |
| CUBI (Texas) and Washington | Biometric identifier | Notice and consent; state attorney general enforcement |
| CCPA/CPRA (California) | Sensitive personal information | Right to limit use; disclosure duties |
| DPDP Act (India) | Personal data (no separate biometric category in the Act) | Consent or a listed legitimate use; children's data restrictions |
| PIPEDA (Canada) and Privacy Act (Australia) | Sensitive information | Consent, with the Clearview findings as the leading applications |
Why the higher protection?
- It cannot be revoked. A leaked password is replaced; a leaked face template is not.
- It is collected at a distance, without the person knowing, from a photo or a camera.
- It links records across contexts: one template matches the same person on a dating site, a conference page and a court document.
- Errors fall unevenly: accuracy testing shows demographic differences, so misidentification risk is not shared equally.
What does this mean for face search engines?
Every face search engine computes templates for faces on public pages without those people's consent. Regulators have treated that as processing special-category data without a lawful basis in the Clearview decisions (ICO, Dutch DPA, CNIL) and the PimEyes proceedings in Germany and Belgium. Engines respond with opt-outs, regional blocks and claims that their templates are not retained. The opt-out routes directory records what each one offers.
Questions
Is my face biometric data when I upload it to a face search engine?
The upload is a photo. The moment the engine computes a template to compare it, it is processing biometric data of you, and in the EU and UK that needs a lawful basis, normally your explicit consent given in the terms.
Does BIPA apply to a company outside Illinois?
Courts have applied it to companies that collect Illinois residents' biometrics regardless of where the company sits; Clearview and Facebook settlements followed that reading.
Sources
- 1.Regulation (EU) 2016/679 (GDPR), Article 4(14) and Article 9 (checked November 6, 2026)
- 2.Illinois Biometric Information Privacy Act, 740 ILCS 14/10 (definitions) (checked November 6, 2026)
Entry reviewed November 6, 2026. Found an error? Tell us.
Related entries
- Term Face embedding Face embedding defined: the numeric vector a network computes from a face, why same-person vectors sit close, how it is compared, and why it is biometric data.
- Term Consent (data protection) Consent in data-protection law: what makes it valid, when it must be explicit, why a public photo is not consent, and why face search engines rarely have it.
- Law General Data Protection Regulation (GDPR) and biometric data GDPR and face search: Article 9 biometric data, the household exemption, territorial reach under Article 3(2), fines up to 4%, and the Clearview and PimEyes cases.
- Law Illinois Biometric Information Privacy Act (BIPA) Illinois BIPA (740 ILCS 14): consent before collecting face geometry, a private right of action, $1,000 to $5,000 per violation, the 2024 amendment, and face search.
- Case Information Commissioner v Clearview AI (United Kingdom) ICO v Clearview AI: the GBP 7.5 million fine, the 2023 tribunal loss, the October 2025 Upper Tribunal judgment, and the Court of Appeal stage pending in 2026.
- Directory Opt-out routes for every face search engine Opt-out routes for 20 face and image search engines side by side: form or email, verification asked for, stated timeline, cost and link. Checked Nov 6, 2026.
Cite this entry
FaceSearch Wiki editors. "Biometric data". FaceSearch Wiki, updated November 6, 2026. https://facesearch.wiki/glossary/biometric-data/