As employers deal with mounting pressure or desire to implement artificial intelligence in the workplace, they should not forget the laws in several states and localities that place limitations on the use and collection of biometric information—data commonly used in workplace artificial intelligence products.
Employers may use products that rely on artificial intelligence to monitor employee safety, check productivity, and prevent accidents. For example, artificial intelligence products connected to cameras can detect an employee’s improper use or lack of personal protective equipment, scan the floor for hazardous conditions such as a precariously placed extension cord or other tripping threat, and alert an employee who accidentally enters a restricted work zone. New artificial intelligence products claim to detect an employee’s fatigue or use of substances like alcohol or drugs. These artificial intelligence products may monitor an employee’s heartrate, speech (including pronunciation and tone), or facial biomarkers around the eyes or jaw. Artificial intelligence products may also collect data for monitoring employee safety and productivity from sensors or devices worn by employees, real-time scanning of face and body movements, or analyzing video footage.
The use of artificial intelligence in the workplace can no longer be ignored in the competitive market; however, employers should be aware of potential litigation stemming from the use of artificial intelligence—specifically the use of an employee’s biometric information without consent. Various forms of biometric information privacy laws exist in several states and localities including (among others) Illinois,1 Texas,2 Washington,3 and New York City.4 These laws regulate the collection, use, and storing of biometric information. Each law uses a different definition of “biometric information,” places varying limitations on the use of the information, requires specific consent and disclosure procedures, and may provide exceptions for security purposes. Some of these laws provide for private causes of action, while others are enforced by the state attorney general. The monetary consequences for violations vary by state. Employers that know the applicable laws and litigation risks can implement procedures to comply with the law while still using artificial intelligence as a tool in preventing workplace accidents, keeping employees safe, and monitoring productivity.
For example, companies in Illinois or ones that have employees in Illinois need to know the requirements of Illinois’ Biometric Information Privacy Act (BIPA). The BIPA has sparked the majority of litigation in this area because, unlike some of the other laws, individuals harmed by a violation of BIPA may file a claim against the employer and obtain monetary relief. A successful plaintiff can recover their attorney’s fees and costs, an order to stop the violation, and monetary damages for each violation. The monetary damages that a plaintiff can recover are either $1000 per violation ($5,000 for reckless or intentional violations) or the actual damages, whichever is greater.
Like similar state and local laws, the BIPA restricts how employers collect, retain, disclose and destroy biometric identifiers. Under the BIPA, employers must receive the individual’s informed, written consent before capturing, collecting, or otherwise obtaining biometric identifiers. A “biometric identifier” under the BIPA means “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry” but does not include “writing samples, written signatures, photographs, human biological samples used for valid scientific testing or screening, demographic data, tattoo descriptions, or physical descriptions such as height, weight, hair color, or eye color.” Courts that have interpreted the BIPA found that a photograph and perhaps, by extension, a video is not itself a biometric identifier.
Under these biometric information privacy laws, employers are at risk for lawsuits from employees or an investigation by the attorney general if they implement artificial intelligence products that collect biometric data without following consent procedures. For example, on March 30, 2025, the Northern District of Illinois declined to dismiss a lawsuit by a former truck driver against his employer, a motor transportation company. The former driver brought a proposed class action due to the company’s installation of a video monitoring system inside of the trucks that used artificial intelligence to detect distraction and risk on the road and/or caused by the driver including cell phone use, eating or drinking, smoking, seatbelt use, and general inattentiveness. The former employee alleged the technology learned the drivers’ habits by capturing a driver’s face and recognizing their facial features using the individual’s unique facial geometry. The former employee sued under BIPA alleging the video monitoring system captured his biometric identifiers while he was driving, compared his identifiers with other drivers’ identifiers to enhance the facial recognition software, and stored the identifiers online for the employer to view – all without the employer receiving consent from the drivers to collect or store the biometric identifiers or biometric information.
The employer asked the court to dismiss the claims arguing, in part, that the video monitoring system did not violate the language in BIPA because it was not using “biometric identifiers.” The court did not dismiss the case. Instead, the court noted that if the former employee’s allegations were true, the employer violated BIPA because a scan of face geometry that can identify a particular driver qualifies as a “biometric identifier” that requires the driver’s consent before obtainment. The case remains ongoing.
While a decision has not yet been reached, the case described above has implications for employers with workers who perform any work in Illinois, even if they do not live or regularly work in Illinois. First, the court declined—at least at the current stage—to remove non-Illinois residents from the proposed class definition because discovery is needed first and there is no bright-line exclusion of non-Illinois-residents from this particular BIPA claim. Second, the court refused to dismiss the claim based on the employer’s argument that resolution would require an application of Illinois law to individuals outside of the state. Though the court acknowledged that BIPA does not apply to conduct that happens outside of Illinois, the court stated, “the Illinois state legislature might very well have intended for BIPA to cover non-resident visitors and workers to encourage them to visit and do business here.”
The nuances of this case should cause employers to be cautious when implementing similar artificial intelligence that collects biometric data. Employers should consider not only the laws of the state in which they are located or the states in which their workers reside, but also the laws in the states where their workers perform work. When using such systems, employers should first ensure they have provided the required notice or obtained the necessary consent. While we do not know if the Northern District of Illinois will ultimately find in favor of the former employees, the employer must continue spending time, money, and resources to defend against the claims and engage in discovery. It is better to consider the legal implications and take steps to ensure compliance before someone asks you to defend your actions in court.
[1] Illinois' Biometric Information Privacy Act (“BIPA”) (740 ILCS 14/15(b)).
[2] Texas Capture Or Use Of Biometric Identifier (“Cubi”) (Tex. Bus. & Com. Code Ann. § 503.001 et seq).
[3] Washington’s Privacy Act (Wash. Rev. Code §§ 19.375.010 to 19.375.900).
[4] New York City Administrative Code §§ 22-1201 to 22-1205.
