Biometric member data arrives on a gym floor the way most compliance problems do: as a feature on a quote. A console with fingerprint sign-in, a turnstile with face recognition, a body-composition station that reads a hand scan. Each one can turn an equipment purchase into a records obligation backed by liquidated damages in Illinois and state civil penalties in Texas, and in both the obligation starts before the first scan is taken.
- Which states put duties on biometric member data
- The amendment that changed the arithmetic in Illinois
- Who holds the duty, the dealer or the operator
- Six checks on biometric member data before you specify the feature
- A worked example, with the assumptions stated
- Records to keep, and who keeps them
- Warning signs and common mistakes
- Do these laws apply outside Illinois and Texas?
- Can a written release be collected on a screen?
Which states put duties on biometric member data
Illinois and Texas both regulate the capture of biometric identifiers by private businesses, and they do it differently. Illinois gives the individual a private right of action with fixed statutory amounts. Texas gives enforcement to the attorney general alone. A dealer selling into both markets is selling into two different risk shapes.
Nothing here is legal advice, and whether a particular scanner captures a regulated identifier is a determination that turns on the statute’s definitions and on how the system works. The point for an equipment business is narrower: the questions to ask before the feature is specified.
| Illinois, 740 ILCS 14 (BIPA) | Texas, Bus. and Com. Code 503.001 (CUBI) |
|---|---|
| Written notice and a written release required before collection | Notice and consent required before capture for a commercial purpose |
| Public written policy with a retention schedule, and destruction when the purpose is satisfied or within 3 years of the person’s last interaction, whichever is first | Destruction within a reasonable time, and no later than one year after the purpose of collection has expired, subject to exceptions |
| Private right of action: liquidated damages of $1,000 per negligent violation or actual damages, whichever is greater | Civil penalties of up to $25,000 per violation |
| Liquidated damages of $5,000 per intentional or reckless violation or actual damages, whichever is greater, plus attorneys’ fees and costs | Enforced exclusively by the Texas Attorney General |
The Illinois damages and the single-violation rule are set out in Section 20 as amended by Public Act 103-0769, which took effect on August 2, 2024. The act also added a definition of “electronic signature” to Section 10, covering “an electronic sound, symbol, or process attached to or logically associated with a record” that is executed or adopted with the intent to sign. The act text is on the Illinois General Assembly site.
The Texas duties and penalty are described by the enforcing agency itself. Its guidance states that a business must “Provide notice and obtain the consent of an individual prior to capturing the individual’s biometric identifier,” that a captured identifier must be destroyed “no later than one year after the purpose of its collection has expired,” that the attorney general “has exclusive authority to enforce CUBI,” and that relief can include “civil penalties of up to $25,000 per violation.” That page is the Texas Attorney General overview of the Biometric Identifier Act.
Section 503.001 was amended by House Bill 149, the Texas Responsible Artificial Intelligence Governance Act, effective January 1, 2026. That amendment added exemptions for developing or training artificial intelligence models, except where the system is used to uniquely identify a specific individual, and for AI deployed to detect or respond to security incidents and fraud. It did not change the notice and consent duty, the one-year destruction deadline, the attorney general’s enforcement role or the $25,000 per violation penalty described above.
The amendment that changed the arithmetic in Illinois
Before August 2024, the per-scan theory of damages was the reason Illinois exposure looked unbounded. Public Act 103-0769 addressed it directly. Under the amended Section 20, a private entity that repeatedly collects the same biometric identifier or biometric information from the same person by the same method “has committed a single violation of subsection (b) of Section 15,” and the aggrieved person is entitled to at most one recovery for that.
For a gym, that is the difference between one violation per member and one violation per check-in. It does not reduce the duty, and it does not reduce the per-person amount. It changes the size of a class action, which is why the underlying notice and release paperwork now carries more weight than the per-scan count ever did.
The same act’s electronic signature definition is the practical half. A written release can be captured electronically if it meets that definition, which means the enrollment flow on a kiosk or app is where compliance is designed or lost.
What Illinois actually requires before a scan
Section 15(b) of the statute sets three conditions before a private entity may collect a biometric identifier (the subsection also reaches capturing, purchasing, receiving through trade or otherwise obtaining one). It must inform the subject in writing that a biometric identifier or biometric information is being collected or stored. It must inform the subject in writing of the specific purpose and length of term for which it is being collected, stored and used. And it must receive a written release executed by the subject.
Section 15(a) adds the policy requirement: a written policy, made available to the public, establishing a retention schedule and guidelines for permanent destruction. Section 15(d) restricts disclosure and redisclosure without consent. The consolidated statute text is available from Justia’s publication of 740 ILCS 14.
Read in sequence, the biometric member data provisions describe an enrollment script, a public policy document and a deletion routine. None of the three is equipment. All three are things a console vendor’s default configuration will not supply.
Who holds the duty, the dealer or the operator
Responsibility for biometric member data belongs in the quote, because the answer depends on where the template is stored and who controls it. An on-equipment template that never leaves the machine, a template held in the operator’s access-control server, and a template held in a vendor cloud are three different arrangements.
In commercial practice the facility operator is generally the party enrolling members and therefore the party giving notice and taking the release. That does not make the dealer’s position irrelevant. A dealer who specifies, installs and configures the system is the party best placed to say what the system collects, where it is stored and how it is deleted, and leaving those points unanswered in the purchase documents leaves the seller with nothing to point to when something goes wrong.
The clean answer is to document it. Our checklist of eight questions that assign network, firmware and data responsibilities before installation is the right place to add the biometric lines, and the structure in our guide to building a connected-equipment data register already covers purpose, access, retention and vendor exit.
Six checks on biometric member data before you specify the feature
- Ask what the system stores, in technical terms. A raw image, a non-reversible template and a hashed token are different things. Get the answer in writing from the manufacturer, naming the model and firmware version.
- Ask where it is stored and for how long. On the device, on a local server, or in a vendor cloud. Then ask what the vendor’s own retention default is, because the default is set for the vendor’s convenience, not the operator’s retention schedule.
- Ask how a single person’s data is deleted. Not a factory reset of the unit. A named procedure for one member, with a confirmation record the operator can keep.
- Confirm the enrollment flow can show notice and capture a release. If the screen cannot display the required text and capture a written release, the notice and release generally have to be handled another way before the feature is used in Illinois.
- Check whether a non-biometric alternative exists. A key fob or a PIN is often sufficient for access control, and offering it keeps the obligation out of the building for members who decline.
- Put the answers in the contract, not the brochure. Data location, retention default, deletion procedure, breach notification and what happens at the end of the subscription all belong in the purchase documents.
A worked example, with the assumptions stated
The figures below are illustrative assumptions used to show the scale of the question. They are not case data, not a prediction, and not an estimate of any real exposure.
Assume a four-club Illinois operator enrolls 6,000 members on fingerprint check-in, and assume for the purpose of the illustration that the enrollment flow never captured a written release. At the statutory $1,000 in liquidated damages per negligent violation and one violation per person under the amended Section 20, the arithmetic is $6,000,000 before fees.
The same assumption at $5,000 for intentional or reckless conduct is $30,000,000. Those numbers are not a forecast of any outcome, because liability, class certification and defenses all turn on facts an article cannot supply. They do explain why a release checkbox in an enrollment screen is worth more attention than the console’s feature list.
The cost of getting it right is a page of notice text, a public policy document and a deletion procedure. That asymmetry is the entire argument for handling it at specification rather than after installation.
Records to keep, and who keeps them
- Equipment register flagging biometric-capable units. Model, serial, firmware and the feature’s enabled or disabled state.
- Enrollment records. The notice version shown, the release captured, and the date, held per member.
- Public retention policy, with a version history. Dated, so you can show what was published when.
- Deletion log. Member identifier, request date, completion date and who confirmed it.
- Vendor data-handling statement. Signed, naming storage location and retention default.
A register that already tracks model and serial detail makes the first of those almost free. Our guide to linking model and serial identifiers to location and service history covers the structure, and the biometric flag is one more field.
Warning signs and common mistakes
A warning sign is a vendor that answers a storage question with the word “encrypted.” Encryption describes protection in transit or at rest. It says nothing about what was collected, where it sits or when it is destroyed, which are the three things the statutes address.
Another is enabling a scanner because it shipped enabled. A feature switched on at commissioning, without an enrollment script behind it, creates the duty without the paperwork.
A third is treating a subscription end as a clean break. When a console platform lapses, member templates may remain with the vendor, which is a retention question nobody raised at purchase. The renewal and exit issues in our review of console software renewal cost, lapse behavior and exit rights are the same contract terms that govern this.
Do these laws apply outside Illinois and Texas?
Other states regulate personal data under broader privacy statutes, and the treatment of biometric information varies between them. Illinois and Texas are a useful planning baseline because they attach pre-collection duties and defined penalties to a private business capturing a biometric identifier, but they are not the only states to regulate the point: Washington, for example, bars enrolling a biometric identifier in a database for a commercial purpose without first providing notice, obtaining consent or providing a mechanism to prevent the subsequent commercial use of the identifier. A multi-state operator should have counsel review the states it actually operates in.
Can a written release be collected on a screen?
Public Act 103-0769 added an electronic signature definition to the Illinois statute, which contemplates a signature captured electronically where it meets that definition. Whether a specific kiosk flow satisfies it is a legal question about that flow, so it is worth a review before 6,000 members are enrolled through it.
The close is short enough to put in a quote template. Before any scanner is specified, get written answers on what is stored, where, for how long and how one person’s record is deleted, and confirm the enrollment screen can show notice and capture a release. If a vendor will not answer in writing, specify a fob.
