Texas has enacted biometric privacy requirements that mandate employers to provide notice before collecting biometric data (fingerprints, retina/iris scans, voiceprints, hand scans, facial geometry, vein patterns), obtain written consent from employees, restrict data use and disclosure, and ensure confidentiality and proper data disposal. Employers must audit internal systems for biometric data collection (fingerprint timekeeping, facial recognition, dash-cams, voice recordings, video surveillance), implement compliant policies with notice and consent procedures, and ensure third-party vendor compliance.
Texas has enacted biometric privacy legislation that imposes mandatory notice, written consent, and data protection requirements on employers who collect biometric data from employees. The law applies to a broad range of biometric identifiers, including fingerprints, retina or iris scans, voiceprints, hand scans, facial geometry, and vein patterns. Employers must establish compliant collection, use, and disposal procedures before the law takes effect.
Who is affected
All Texas employers who collect, use, or store biometric data from employees are subject to these requirements. This includes organizations that use fingerprint timekeeping systems, facial recognition technology, voice recordings, video surveillance, or dash-mounted cameras that capture biometric information. Third-party vendors and service providers who process employee biometric data on behalf of employers are also covered.
What's changing
Employers must now:
- Provide advance notice to employees before collecting any biometric data, disclosing what data will be collected and how it will be used.
- Obtain written consent from each employee prior to biometric data collection. Consent cannot be a condition of employment unless biometric collection is essential to the job function.
- Restrict data use and disclosure to the purposes stated in the notice and consent documentation. Biometric data cannot be sold, shared, or used for secondary purposes without explicit authorization.
- Ensure confidentiality through reasonable security measures to protect biometric data from unauthorized access or breach.
- Implement proper data disposal procedures to securely delete or destroy biometric data when it is no longer needed for the stated purpose.
What NEO partners and clients should do
- Conduct an immediate audit of all systems, tools, and processes that collect or process biometric data—including timekeeping systems, security access controls, video surveillance, voice recordings, and any third-party applications.
- Draft or revise biometric data policies to include clear notice language, written consent forms, and documented procedures for data use, access, and deletion. Ensure policies align with Texas statutory requirements.
- Obtain written consent from all current employees who are subject to biometric data collection, and implement consent collection as part of onboarding for new hires.
- Audit and contractually bind third-party vendors (payroll processors, security firms, HR software providers) to ensure they comply with Texas biometric privacy requirements and maintain confidentiality standards.
