Texas Biometric Law: Consent, Retention, and Penalties

Texas biometric law lives mainly in Chapter 503 of the Business and Commerce Code, known as the Capture or Use of Biometric Identifier Act, or CUBI. If your business collects fingerprints, face scans, voiceprints, or similar identifiers for a commercial purpose, you must tell people before you capture the data, get their consent, keep it secure, avoid selling or sharing it, and destroy it within a year after you no longer need it. The Texas Attorney General enforces the statute, and each violation can cost up to $25,000.¹

What Counts as Biometric Data

CUBI covers five identifiers: retina scans, iris scans, fingerprints, voiceprints, and records of hand or face geometry.¹ These are traits physically tied to a person that cannot be reset the way a password can. The list is deliberately narrow. DNA, blood type, and behavioral data like typing rhythm or walking gait sit outside the statute.

The other gate is the “commercial purpose” requirement. CUBI only applies when biometric data is captured for commercial reasons. The statute does not define the term, so the label matters less than what the data actually supports. If it underpins customer transactions, workforce management, or day-to-day business operations, treat it as commercial. Assuming otherwise is where many companies get into trouble.

When You Need Consent, and How to Get It

Before capturing a biometric identifier for a commercial purpose, you must inform the person that capture will occur and receive their consent.¹ The statute does not lock you into a particular format. Written forms, electronic agreements, and other documented methods all work. What matters is that the person knows collection is happening and affirmatively agrees.

Publicly available images are a common trap. A biometric identifier is not considered consented to just because a photo or recording of the person exists somewhere online. The only exception is if the individual themselves posted the image publicly.¹ Scraping social media images uploaded by someone other than the person depicted does not create consent.

In practice, an employer rolling out fingerprint time clocks needs to notify each employee individually and document consent before the system goes live. A retailer using facial recognition at checkout needs a disclosure mechanism at the point of collection. Nothing in CUBI forces you to offer a non-biometric alternative, but a consent process where refusing is not actually feasible invites scrutiny over whether the consent was genuine.

Limits on Sharing Biometric Data

Consent to collect is not consent to share. Anyone who possesses a biometric identifier captured for a commercial purpose generally may not sell, lease, or otherwise disclose it to another person.¹ The prohibition is broad, and there are only four ways out.

Disclosure is permitted when:

The individual consented specifically to disclosure for identification if they disappear or die.
The disclosure is needed to complete a financial transaction the individual requested or authorized.
A federal or state statute other than the Texas Public Information Act requires or permits the disclosure.
The disclosure is made by or to a law enforcement agency in response to a warrant.¹

Outside those four situations, moving biometric data to a third party violates the statute. That has real consequences for businesses using cloud-based fingerprint authentication or other vendor services that process biometric identifiers. Review any arrangement that could involve transferring the underlying identifier, not just processing it under your control.

How Long You Can Keep It

Biometric data must be stored using reasonable care, at least the same standard you apply to other confidential information. You must also destroy the identifier within a reasonable time and no later than one year after the purpose for collecting it expires.¹ If an employee whose fingerprint scan controlled building access leaves, the one-year clock starts on that departure.

There is one adjustment. When a biometric identifier is connected to an instrument or document that another law requires to be retained longer, the deadline shifts. In that case, destruction must occur within a reasonable time and no later than one year after the associated document is no longer legally required to be maintained.² This can come up when biometric authentication is tied to financial records with multi-year retention obligations under other regulations.

The statute does not prescribe a specific destruction method. Secure deletion of digital records, overwriting storage media, and physical destruction of hardware are all reasonable approaches. Indefinite retention with no deletion schedule is the riskiest posture. It almost guarantees a violation once the original purpose expires.

Who’s Exempt, and Who Isn’t

The exemption list is shorter than many businesses expect. CUBI does not apply to:

Voiceprint data retained by a financial institution or its affiliate, as defined by federal law at 15 U.S.C. § 6809. Other biometric identifiers held by those same institutions are still covered.¹
Biometric identifiers involved in developing, training, evaluating, or offering artificial intelligence models or systems, unless the system is used to uniquely identify a specific individual.¹
Developing or deploying AI systems to prevent security incidents, detect identity theft or fraud, preserve system integrity, or investigate illegal activity.¹

That is the complete list. There is no blanket exemption for healthcare providers, HIPAA-covered entities, or government agencies. Public agencies often fall outside CUBI because they lack a commercial purpose, but the statute contains no explicit carve-out for them. Healthcare organizations using biometric check-in or staff access should assume they are covered.

The AI exemptions have a hard edge worth understanding. Training a general facial recognition model on biometric data does not require CUBI consent. The moment that same model is deployed to identify specific individuals for a commercial purpose, the exemption disappears. Development and deployment are not the same thing under the statute.

Penalties and Who Enforces the Law

Only the Texas Attorney General can enforce CUBI. Unlike Illinois’ Biometric Information Privacy Act, Texas gives individuals no private right of action, so no one can file their own lawsuit for a violation. Each violation carries a civil penalty of up to $25,000, and the Attorney General can bring actions to recover those penalties.¹

$25,000 per violation may sound modest in isolation. The per-violation structure is what makes it dangerous. When a company collects biometric data from millions of people, exposure compounds fast. In February 2022, the Attorney General sued Meta over facial recognition run on photos uploaded to Facebook, alleging that records of facial geometry were captured from millions of Texans without informed consent. The suit relied on CUBI and the Texas Deceptive Trade Practices Act.³

Meta settled in 2024 for $1.4 billion, payable over five years.³ The absence of a private right of action does not mean low enforcement risk. It means enforcement runs through one office with the resources to pursue cases at that scale.

How CUBI Fits With Other Laws

CUBI is not the only law that touches biometric data in Texas. The Texas Data Privacy and Security Act (TDPSA), effective in 2024, treats biometric data processed to uniquely identify a person as “sensitive data,” and businesses may not process sensitive data without the consumer’s consent. The TDPSA defines consent tightly: it must be freely given, informed, and unambiguous, which rules out dark patterns and burial in broad terms-of-service language.⁴ A consent flow that satisfies CUBI can still fall short under the TDPSA if it relies on pre-checked boxes or confusing opt-outs. Build your program to satisfy both.

At the federal level, there is no comprehensive biometric statute, but the Federal Trade Commission has said it will scrutinize businesses that mislead consumers about biometric data or fail to assess foreseeable harms before collecting it.⁵ Following CUBI to the letter but making misleading claims about how biometric data is used can still draw FTC action under its unfair and deceptive practices authority.

1
State of Texas. Texas Business and Commerce Code Chapter 503 – Biometric Identifiers
2
State of Texas. Texas Business and Commerce Code Chapter 503 – Biometric Identifiers
3
Office of the Texas Attorney General. Attorney General Ken Paxton Secures $1.4 Billion Settlement with Meta Over Its Unauthorized Capture of Personal Biometric Data
4
Office of the Texas Attorney General. Texas Data Privacy and Security Act
5
Federal Trade Commission. Commission Policy Statement on Biometric Information