Governance, risk & compliance

Biometric privacy laws beyond Illinois and Texas RCW 19.375; C.R.S. 6-1-1314 (HB 24-1130); local ordinances

This framework covers biometric laws outside Illinois (BIPA, framework IL_BIPA) and Texas (CUBI, in TX_STATE), which are not repeated; where a control exists in those packs it is mapped by name.

Washington (RCW ch. 19.

375, 2017 c 299): a person may not enroll a biometric identifier in a database for a commercial purpose without notice, consent or a way to prevent later commercial use (. 020(1)); notice is context-dependent and is not itself consent; disclosure is limited to listed cases; the holder must take reasonable care and keep the identifier no longer than reasonably necessary; enrolling for a security purpose is outside the notice and consent rule (.

020(7)); GLBA financial institutions and HIPAA activities are excluded (. 040); enforcement is by the Attorney General only (.

030(2)), so there is no private suit. The effective date was not read.

Colorado (C. R.

S. 6-1-1314, added by HB 24-1130, effective 1 July 2025 per section 5 of the act unless a referendum petition succeeded, which was not checked): any controller of biometric data is covered whatever its volume (6-1-1304(1)(b)); a written policy with a retention schedule, an incident protocol and deletion at the earliest of purpose met, 24 months after the consumer last interacted, or 45 days after a yearly review finds storage unnecessary; notice of purpose and retention period before collection; consent; no sale, lease or trade; employer consent limits; and a right of access for larger controllers.

How Colorado enforces the section was not read (6-1-1311 was not retrieved). Maryland Labor and Employment 3-717 limits facial recognition templates in interviews to a signed waiver.

New York Labor Law 201-a limits fingerprinting as a condition of employment (the penalty was not stated on the page read). Local ordinances: New York City Administrative Code Title 22, Chapter 12 (ss.

22-1201 to 22-1205, read from a secondary reproduction) requires signs at commercial establishments that collect biometric identifier information and bars selling it, with a private right of action after a 30-day cure period for sign violations; Portland, Oregon City Code 34. 10 bars private entities from using face recognition technologies in places of public accommodation, with a private right of action ($1,000 per day or damages, whichever is greater, after a 30-day written demand).

A 2026 secondary tracker found no other enacted biometric-specific laws in 2025 or 2026; this was not independently confirmed, and biometric rules inside state privacy acts (for example sensitive data consent) belong to those acts. A section applies existing law to AI tools (face, voice and gait analysis in vendor products).

General information, not legal advice.

Assessment tiers & levels Lavawall supports

Lavawall assesses Biometric privacy laws beyond Illinois and Texas at every level below, so you can start where you are and step up as your program matures.

How Lavawall® helps you get to Biometric privacy laws beyond Illinois and Texas compliance

Most of Biometric privacy laws beyond Illinois and Texas comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to Biometric privacy laws beyond Illinois and Texas, and tracks your posture continuously instead of once a year at audit time.

• Assess your current state against Biometric privacy laws beyond Illinois and Texas in the Lavawall GRC module, with the questionnaire and control set built in.
• Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
• Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.

Related

Lavawall® supports Biometric privacy laws beyond Illinois and Texas as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.