Biometric authentication has become unremarkable. Unlocking your phone with your face, verifying a payment with your fingerprint, passing through an airport with facial recognition — these feel like background features of modern life rather than significant privacy decisions. That comfort is worth interrogating.
Biometric data is categorically different from a password. A compromised password can be changed. A compromised fingerprint template or facial geometry map cannot. The privacy stakes around biometric data are higher than the stakes around almost any other category of personal information, and the legal landscape governing it is inconsistent enough that users cannot assume it is being handled uniformly.
What “Biometric Data” Actually Means
The term covers several distinct categories of information, each with different technical properties and different risk profiles.
Fingerprint templates. A fingerprint scanner doesn’t store an image of your fingerprint — it stores a mathematical representation derived from the ridge patterns. This template can be used to verify a presented fingerprint, but a well-implemented system cannot reverse-engineer the original image from the template. Modern systems store templates in secure hardware (the Secure Enclave on Apple devices, or Trusted Execution Environments on Android) rather than in regular app storage.
Facial geometry. Face ID-style 3D facial recognition works by projecting infrared dots onto your face and capturing a depth map. The stored representation is a mathematical model, not a photograph. Like fingerprint templates, well-implemented systems store this data in secure hardware that is inaccessible to the operating system itself.
2D facial recognition. This is the category with the most significant privacy risks. Apps, websites, and third-party services that use facial recognition from 2D camera images — for identity verification, age estimation, emotion detection, or security screening — typically process and may store a different kind of facial data than device-level Face ID. The storage and retention practices vary enormously.
Voice biometrics. Voice pattern recognition, used for authentication in some banking and phone services, creates a mathematical voice “voiceprint” that can be used to verify identity. As with face and fingerprint data, the template is the sensitive asset.
These categories have very different risk profiles. Device-level biometrics stored in secure hardware are meaningfully safer than biometric templates stored in third-party databases. Understanding which category applies in any given situation matters.
Device-Level Biometrics: Apple and Android
On both Apple and Android devices, the design philosophy for device-level biometric authentication is isolation: the biometric data never leaves the device, and other apps and even the operating system cannot access it.
On Apple devices, Face ID and Touch ID data is stored exclusively in the Secure Enclave — a dedicated security processor that is physically isolated from the main processor and cannot be accessed by iOS, iCloud, or any application. Apple has confirmed that Face ID data is never backed up to iCloud and never shared with Apple or third-party apps. When you delete Face ID or Touch ID from your device settings, the data is cryptographically erased from the Secure Enclave.
On Android, the implementation varies by manufacturer and chipset, but modern Android devices use a Trusted Execution Environment (TEE) or dedicated secure hardware for biometric storage. Google’s Android Compatibility Definition Document requires that biometric data be stored in a way that prevents access by any other process, including the kernel. The quality of implementation varies more than on Apple devices because Android runs on hardware from many manufacturers.
The practical takeaway: device-level biometric authentication, on modern devices from reputable manufacturers, is genuinely private in the sense that the biometric data does not leave your device and is not accessible to anyone outside the secure hardware.
Third-Party Apps and Biometric Access
The privacy picture changes significantly when you move from device-level authentication to biometric features in third-party apps.
Many apps now use biometric features that go beyond simply asking iOS or Android “is this the same person who set up Face ID?” They request access to the device camera to implement their own facial recognition, or they collect biometric data as part of identity verification flows.
When an app implements its own facial recognition — rather than simply asking the operating system to verify a face against its own securely stored model — that app’s servers may receive and store a facial template or image. The retention and use of that data is governed by the app’s own privacy policy, not by Apple’s or Google’s biometric protection guarantees.
The apps most likely to implement their own biometric collection include: age verification services, identity verification platforms (common in fintech and gig economy apps), workplace attendance systems, and some security camera and smart home apps.
The question to ask when an app requests camera access for a biometric purpose: is this app using the OS-level biometric verification framework (in which case your face data stays on your device), or is it capturing and transmitting image or template data to its own servers?
The Legal Landscape: Where Protection Exists
Biometric data privacy law is a patchwork that varies significantly by jurisdiction.
Illinois (USA): BIPA. The Illinois Biometric Information Privacy Act is the strongest biometric protection law in the United States. It requires companies to obtain written informed consent before collecting biometric data, to publish a retention schedule, and to never sell or profit from biometric data. Violations carry statutory damages of $1,000 per negligent violation and $5,000 per intentional violation — and because it allows private right of action, it has produced billions of dollars in class action settlements since its passage in 2008. Meta settled for $650 million in 2021, Google for $100 million in 2022, and settlements against Illinois employers have continued at pace through the mid-2020s.
Texas and Washington (USA). Both states have biometric privacy laws modelled on BIPA, though Washington’s law has weaker enforcement mechanisms and Texas’s law can only be enforced by the attorney general, not through private lawsuits.
European Union: GDPR. Under GDPR, biometric data processed for the purpose of uniquely identifying a person is classified as “special category data” — the same category as health data, political opinions, and religious beliefs. Processing it requires explicit consent or other specific lawful grounds, and it is subject to the GDPR’s more stringent requirements. This provides meaningful protection for EU residents whose biometric data is collected by services subject to GDPR enforcement.
India: DPDP Act. India’s Digital Personal Data Protection Act, which came into force in 2025-2026, includes biometric data within its scope as sensitive personal data, requiring explicit consent for collection and processing.
Most of the United States: Outside Illinois, Texas, and Washington, there is no federal biometric privacy law and most states have no state-level biometric protection. This means companies operating in most US states can collect, retain, and share biometric data under generic consumer privacy laws that provide far weaker protections than BIPA.
The Risks That Actually Materialise
Biometric data theft is documented, not theoretical.
In 2019, the Biostar 2 security platform — used for fingerprint-based access control at banks, gyms, and government facilities — suffered a breach that exposed over 1 million fingerprint records along with facial recognition data and personal information. Unlike a password breach, the affected individuals have no way to “change” their fingerprints.
A 2020 breach at the NEC facial recognition system exposed customer data including biometric templates. A 2023 series of breaches across identity verification services exposed facial scan data for millions of users who had completed biometric identity verification for gig economy platforms.
The consequences of biometric data breaches are uniquely severe because the compromised data is not revocable. A fingerprint template in a leaked database remains a risk for the lifetime of the person it belongs to. Security systems that rely on that biometric become permanently vulnerable in a way that password-protected systems are not, once you’ve changed the password.
Facial Recognition in Public and Semi-Public Spaces
Beyond personal device authentication and app-based identity verification, a third category of biometric data collection is expanding rapidly: facial recognition in physical spaces.
Airports, sports venues, retail stores, and transit systems in multiple countries have deployed or are piloting facial recognition systems that match faces against databases without individual users actively participating in a biometric transaction. The data flows for these systems — who stores the images, what templates are generated, how long they’re retained — are often opaque.
This is categorically different from choosing to use Face ID to unlock your phone. It is biometric collection that happens as a byproduct of being in a physical space, without explicit consent in any meaningful sense.
The legal protections here are thinner than in the app context. Most mass-deployment facial recognition in public spaces operates in legal grey areas in most jurisdictions, and the regulatory frameworks are still developing. EU AI Act provisions on “real-time” remote biometric identification are among the strongest restrictions enacted, but implementation and enforcement are ongoing.
Questions Worth Asking About Any Biometric Feature
When you encounter a biometric feature — in an app, a physical space, or a service — a few questions help assess the actual privacy risk.
Is this using OS-level verification or collecting its own data? Device biometrics via the OS framework are meaningfully safer than app-level biometric collection.
Where is the biometric template stored? On-device secure hardware versus company servers is a significant distinction.
What is the retention period? Some identity verification services retain facial scan data indefinitely; others delete it immediately after verification. The privacy policy should say which applies.
Can you delete it? Do you have a right to request deletion of your biometric template, and is there a documented process for exercising that right?
Are you in a jurisdiction with biometric privacy protections? If yes, the company collecting your data has specific legal obligations. If no, you’re largely relying on their stated policy commitments without legal recourse if those commitments are broken.
Protecting Personal Files in This Context
The biometric data question intersects with personal file storage when files are protected by biometric authentication: photos unlocked by Face ID, encrypted file vaults opened with a fingerprint.
Device-level biometric authentication for file access is a reasonable security measure. The biometric data stays on the device. The file encryption keys can be structured so that the biometric verification unlocks a hardware key that unlocks the file, without the biometric itself touching the file.
What this doesn’t protect against: the file contents themselves, if stored on a cloud service, are governed by that service’s own policies, independent of how you authenticate on your device. Using Face ID to open an app that then uploads unencrypted files to a server means your face protects the entry point, not the destination.
The security of biometric authentication is real and meaningful. It’s most effective when understood clearly — what it protects, at which layer, and where its protection ends.
The Unrevocable Problem
Every other password can be changed. Every other credential can be rotated. Biometric data cannot. Once a fingerprint template or facial scan is in a database that suffers a breach, the affected individuals have no technical recourse. You cannot be issued a new face.
This is the fundamental reason biometric data warrants more scrutiny than other categories of personal information, even when individual instances of collection seem minor. The consequence of a breach compounds over time as more systems adopt the same biometric as an authentication mechanism, and a compromised template undermines all of them simultaneously.
The standard of care applied to biometric data — by companies collecting it, and by individuals deciding when to provide it — should reflect that asymmetry.