Texas SB 820 compliance: where biometric data programs fail the consent and retention evidence test
Sienna VanceApril 29, 2026
Key takeaways
Texas SB 820 creates a private right of action with statutory damages up to $5,000 per violation -- and each individual whose biometric data was captured without a compliant written notice is a separate violation, not a single organizational failure.
Verbal consent is not sufficient for biometric data capture under Texas SB 820. The written notice must specify the biometric identifier being collected, the purpose, and the retention period before collection begins -- not at onboarding or in a general privacy policy.
Purpose limitation under SB 820 prohibits using biometric data for any purpose outside the original consent without additional authorization. A facial recognition system deployed for building access cannot later be used for attendance tracking or behavioral analysis without new consent.
Biometric data is immutable. Unlike a compromised password, a compromised fingerprint template or facial geometry cannot be reset. This changes the risk calculus for retention: data held beyond its stated retention period is not a documentation gap, it is a permanent liability.
Third-party vendors processing biometric data on behalf of Texas businesses are not insulated from SB 820 obligations by contract. Businesses remain liable for vendor practices. Contracts that lack specific data security standards, incident notification timelines, and prohibition on vendor repurposing of biometric data are compliance gaps.
Illinois BIPA litigation has produced the enforcement pattern Texas investigators will follow. Consent notice deficiencies, over-retention, and vendor repurposing are the three fact patterns that generate the largest damages in BIPA cases -- and SB 820 covers all three.
TL;DR
Texas SB 820 is not a security framework requirement. It is a consent and purpose limitation statute with a private right of action attached. The organizations most exposed are not the ones with weak encryption -- they are the ones running fingerprint timekeeping systems or facial recognition access controls whose written consent notices are buried in onboarding paperwork, reference the wrong purpose, or were never presented at all. The per-violation damages structure makes headcount a direct multiplier of legal exposure. Most organizations have not counted how many individual violations their current biometric data program has already accumulated.
The consent notice that does not survive a plaintiff attorney's first motion
A mid-size Texas logistics company deployed fingerprint terminals for employee time and attendance at seven facilities. The system had been running for three years. The vendor was a reputable HR technology provider with SOC 2 Type II certification. Employee onboarding packets contained a privacy notice section that mentioned biometric data collection in the third paragraph of a general data handling disclosure. The notice did not specify the retention period for fingerprint templates. It did not state whether templates would be shared with the vendor's infrastructure or retained only on-site. Consent was obtained by signature on the general onboarding packet, not through a separate biometric-specific acknowledgment. When a plaintiff attorney filed under SB 820 on behalf of two employees, the complaint focused on three facts: the notice did not meet the written specificity requirement, consent was not obtained before the first fingerprint scan, and the vendor's contract did not prohibit the vendor from retaining template data for system improvement purposes.
The company's legal team discovered that the vendor contract included a clause permitting the vendor to use anonymized biometric data to improve the accuracy of their recognition algorithms. The company had not read that clause as a biometric data use restriction problem. It was. SB 820 prohibits profiting from biometric data without express consent. The vendor's algorithm improvement program, funded by subscription revenue, made the vendor's use of template data a commercial use. The company had consented to this on behalf of employees who had not.
Why consent notice deficiencies are the most common SB 820 failure mode
Texas SB 820 requires written notice before collecting biometric identifiers. The notice must state the specific biometric identifier being collected, the purpose for which it is being collected, and the period for which the data will be retained. These three elements are conjunctive -- all three must be present. A notice that states 'we collect fingerprints for security purposes' without specifying a retention period fails the requirement. A notice that specifies a retention period of 'as long as necessary for business purposes' fails because it is not a defined period. A general privacy policy that addresses biometric data among other data types fails because SB 820 requires a specific written notice for biometric data capture, not general disclosure in an omnibus document. The practical problem is that most consent notices were drafted by legal teams reviewing the statute's language and were designed to satisfy a document review, not to satisfy an evidentiary standard in litigation. The question a plaintiff attorney asks is not 'does a notice exist' -- it is 'was this specific individual presented with a compliant written notice before the first scan of their biometric data.' Those are different questions, and the second one is much harder to answer affirmatively when consent was obtained through a general onboarding process.
Example
In Vulnox gap analyses of Texas biometric data programs, the most consistent finding is that consent notices meet the content requirements when reviewed in isolation but fail the sequencing requirement. The notice existed. It was presented to employees during onboarding. The biometric enrollment -- the first fingerprint scan -- occurred at the same onboarding session, sometimes before the paperwork was completed, sometimes in a different room by a different person. SB 820 requires consent before collection. 'At the same time as' does not satisfy 'before.'
The sequencing problem has a technical analog in biometric system deployment. Fingerprint terminals that enroll a template on first use -- capturing the biometric data as the mechanism for registering the employee -- cannot satisfy the 'before collection' requirement without a process that gates enrollment behind a confirmed consent record. Systems that enroll on first touch, without a prior consent confirmation step in the workflow, are structurally non-compliant regardless of what the paperwork says.
What gap analyses find in Texas biometric data programs
Assessment base: Vulnox Texas SB 820 gap analyses and biometric data program assessments, 2023-2025, covering logistics, retail, healthcare, and manufacturing clients operating biometric timekeeping, access control, and facial recognition systems in Texas
Retention schedules stated in consent notices that are not enforced in the system
Texas SB 820 requires that biometric data be retained only as long as the stated purpose requires and then be securely destroyed. In Vulnox assessments of organizations running fingerprint and facial recognition systems, the consent notice states a retention period -- typically '30 days after the employment relationship ends' or 'no longer than three years.' The biometric system's actual retention configuration does not match. Templates are retained in the vendor's system until the business account is closed or until a manual deletion request is submitted. No automated deletion process runs at the stated retention date. Former employees' biometric templates remain in the system months or years after the retention period in their consent notice has expired.
Each day of retention beyond the stated period is continued collection and storage without the consent that was obtained. The consent defined a retention period. Operating outside that period is operating outside the consent's scope. In a litigation context, this creates a continuing violation argument -- not a single historical failure but an ongoing one that compounds daily for every template retained past its stated date.
Vendor contracts permitting biometric data repurposing for system improvement
HR technology vendors offering biometric timekeeping and access control systems frequently include contractual clauses that permit use of biometric data or derived data for algorithm training, system improvement, or anonymized benchmarking. The language varies -- 'anonymized data,' 'aggregated templates,' 'de-identified biometric signals' -- but the underlying activity is using biometric data captured for a defined business purpose for a second purpose: improving the vendor's commercial product. Most business customers do not identify this as a biometric data use restriction problem when reviewing vendor contracts.
SB 820 prohibits profiting from biometric data without express consent. A vendor whose commercial product improves from algorithm training on customer biometric data is benefiting commercially from that data. The business customer who signed the contract enabling that use has consented on behalf of individuals whose consent was obtained for a different purpose. The individual employees whose fingerprints trained the vendor's algorithm did not consent to that use.
Facial recognition systems deployed for access control later used for attendance tracking
Several organizations assessed had deployed facial recognition for one purpose -- building access, visitor management, or secure area entry -- and subsequently extended the same system's data to a second purpose: employee attendance monitoring, dwell time analysis, or behavioral pattern review. The extension was an operational decision made by facilities or HR teams. It was not reviewed against the original consent notice, which specified the access control purpose only.
SB 820's purpose limitation is specific. Consent obtained for access control does not cover attendance monitoring. The two applications may run on identical infrastructure and use the same biometric templates, but they are distinct purposes requiring distinct consent. Organizations that expanded biometric system use without revisiting consent have accumulated violations proportional to the number of employees affected by the expanded use and the duration of that use.
Biometric data in cloud backups outside the stated retention scope
Organizations using cloud-hosted biometric management systems back up their environments on vendor-standard schedules. Those backups include biometric template data. When an employee's template is deleted from the active system -- because the employment ended, because the retention period lapsed, because the employee requested deletion -- the template persists in backup snapshots that were not included in the deletion workflow. The active system reflects compliance. The backup environment retains the data.
This mirrors the Vermont Act 171 archival gap for a different data type with higher stakes. Biometric data in a backup that is later restored -- for any reason, including disaster recovery -- reactivates data that the consent notice said would be destroyed. The restoration does not create a new consent obligation in any automatic sense. It reintroduces data that the organization had represented to the individual would no longer exist.
The SOC 2-certified vendor does not reduce your SB 820 exposure
Common belief
Organizations selecting biometric data vendors with SOC 2 Type II certifications assume the certification provides meaningful protection against SB 820 liability. The vendor has documented security controls, has been audited by a third party, and has demonstrated compliance with industry security standards. The business customer's obligation is satisfied by selecting a compliant vendor.
What we found
In the logistics company assessment described above, the vendor's SOC 2 report was current. The security controls over template storage, transmission, and access were adequate by any reasonable standard. The compliance failure was entirely in the contract clause permitting algorithm improvement use and in the consent notice that did not disclose that use. Neither failure was addressable by reviewing the SOC 2 report. The report did not cover contract terms.
SOC 2 certifications document the vendor's security controls over the vendor's infrastructure. They do not document whether the vendor's contractual terms comply with SB 820's restrictions on biometric data use, whether the vendor's data retention practices match the periods stated in the customer's consent notices, or whether the vendor's system architecture permits repurposing biometric data for purposes outside the customer's stated consent. These are contract and data governance questions, not security questions. A vendor can hold a current SOC 2 Type II report and include a contract clause permitting algorithm training on customer biometric data simultaneously. The certification addresses one dimension of risk. The contract clause creates a different dimension of liability. SB 820 liability for third-party processing follows the business that collected the biometric data, not the vendor that processed it. The business remains the entity that obtained consent, defined the purpose, and stated the retention period to the individual. If the vendor's actual practices diverge from what that consent authorized, the business that signed the vendor contract is the party that over-authorized use of data it collected.
What Texas organizations believe before the assessment, and what sits underneath
'We put the biometric disclosure in our employee handbook. Everyone signs the handbook at onboarding. That covers the consent requirement.'
Root cause:SB 820 requires written notice and consent before collection. Handbook signatures are typically obtained at onboarding alongside numerous other acknowledgments. If biometric enrollment -- the first scan -- occurs at the same session before the handbook is reviewed, or occurs at a different point in the onboarding process than the signature, the sequencing requirement is not met. Additionally, a handbook disclosure that addresses biometric data among many other topics may not meet the specificity requirement for the notice: the specific identifier, the specific purpose, and the specific retention period. A sentence in a general employee handbook that says 'we may collect biometric data for timekeeping purposes' does not specify a retention period and does not create a record that this specific individual received and acknowledged this specific information before their first scan.
'We only use biometrics for timekeeping. That's a legitimate business purpose. We're not selling the data or using it for anything invasive.'
Root cause:Purpose legitimacy is not the question SB 820 asks first. The first question is whether a compliant written notice was provided and consent was obtained before collection. A timekeeping purpose is legitimate. A timekeeping purpose without compliant pre-collection consent is still a violation. The per-violation damages structure applies regardless of whether the purpose was legitimate. Additionally, the question of whether biometric data was used outside the stated purpose is not controlled entirely by the business's intent -- it is also controlled by what the vendor contract permits. A legitimate timekeeping purpose stated in the consent notice does not prevent liability if the vendor contract allows a use the consent notice did not cover.
'Our biometric system vendor handles all the data processing. They're responsible for compliance with their part of the obligation.'
Root cause:Texas SB 820 liability does not transfer to the vendor through a data processing agreement. The business that collected the biometric data -- that presented the consent notice, or failed to, and that enrolled the individuals -- retains liability for the collection and the obligations that flow from it. A vendor contract can allocate indemnification between parties, but it cannot transfer the statutory obligation to the vendor. The individual whose biometric data was mishandled has a claim against the business that collected it, not against the vendor whose infrastructure processed it. Vendor contracts that do not specifically prohibit repurposing, do not specify deletion timelines, and do not require incident notification within defined periods are gaps in the business's compliance program, not gaps the vendor is responsible for filling.
How SB 820 litigation develops in Texas over the next two years
The first wave of Texas SB 820 class actions will target retail and hospitality employers running fingerprint timekeeping systems, because those industries have the highest ratio of hourly employees to enrolled biometric records and the most variable consent documentation practices.
Illinois BIPA class action practice followed exactly this pattern. The industries with the largest workforces using biometric timekeeping -- logistics, food service, retail -- became the primary targets because the per-violation damages structure scales with enrollment count. A 500-employee distribution center with deficient consent notices represents up to $2.5 million in statutory damages before attorney fees. Plaintiff attorneys in Texas are already familiar with BIPA mechanics. The same litigation model applies directly to SB 820, and the same industry targets present the same economic profile.
Confidence: highFirst five SB 820 class action complaints filed in Texas state or federal court. If the majority name retail, logistics, food service, or hospitality defendants, the prediction holds. If they concentrate in technology or financial services, it does not.Within 18 months, at least one SB 820 action will name a biometric technology vendor as a co-defendant alongside the business customer, based on the vendor contract's algorithm improvement clause and a theory that the vendor profited from biometric data without the individual's express consent.
SB 820 prohibits any entity from profiting from biometric data without express consent. The vendor contract clause permitting algorithm training on customer biometric data is commercially documented -- the vendor charges subscription fees for a product that improves using customer data. The argument that this constitutes profiting from biometric data is legally available and has been made in analogous BIPA litigation. A plaintiff attorney who discovers such a clause in discovery will amend the complaint to include the vendor. Whether it succeeds depends on how courts interpret 'profit' in the vendor context, but the litigation will be filed.
Confidence: mediumA published SB 820 complaint naming a biometric technology vendor as a defendant under the profiting prohibition, filed before November 2027.
The Illinois BIPA experience is the most useful compliance input Texas organizations are ignoring
This is a stated opinion. Texas organizations preparing for SB 820 enforcement are reading the statute and comparing it to their current practices. They are not, in most cases, reading the Illinois BIPA litigation record in detail -- which is a more useful compliance input than the statute itself. BIPA has been litigated aggressively since 2019. The fact patterns that generate liability, the defenses that fail, the consent notice language that survives motions to dismiss, and the vendor contract clauses that create co-defendant exposure are all documented in publicly available case records. Texas SB 820 is not identical to BIPA, but it addresses the same subject matter and creates the same private right of action structure. A compliance program built against the BIPA litigation record will be more durable than one built solely against the SB 820 statutory text.
Counterargument
The counterargument is that Texas courts will interpret SB 820 independently, that Texas legislative history may differ from Illinois, and that importing BIPA compliance assumptions into a different statutory scheme could produce over-compliance in some areas and under-compliance in others. That argument is technically correct. The practical response is that over-compliance on consent notice specificity and retention enforcement costs almost nothing operationally. Under-compliance on those same dimensions, as the BIPA record demonstrates, costs a great deal. Where the two statutes' requirements overlap -- which is the core of both -- the BIPA record is the best available evidence of where compliance programs actually fail.
One audit worth running before the first SB 820 complaint arrives
Pull the consent notice that was actually presented to the first employee enrolled in your biometric system -- not the current version, the one in use when enrollment began. Check three things: does it name the specific biometric identifier being collected, does it state the purpose, and does it state a defined retention period. Then check whether the system's actual retention configuration enforces that period automatically or requires a manual deletion request. If the notice is missing any of the three elements, or if deletion requires manual action that is not tied to an automated trigger at the retention date, those are the two gaps that generate the most exposure under SB 820's per-violation damages structure. Both are fixable -- but fixing them prospectively does not address the historical enrollment count that occurred under the deficient notice.
Further Reading
Gap Analysis
framework gap analysisDigital Footprint
digital footprint analysesNIST Cybersecurity Framework 2.0
NIST Cybersecurity FrameworkNIST Vulnerability Assessment Definition
NIST's vulnerability assessment definitionThird-Party Risk Management
third-party risk management
Frequently Asked Questions
What does Texas SB 820 require in a written biometric consent notice?
The written notice must state the specific biometric identifier being collected (fingerprint, facial geometry, voiceprint, or retina scan), the purpose for which it is being collected, and the defined retention period. All three elements are required. A general privacy policy that addresses biometric data among other topics does not satisfy the requirement. The notice must be presented and consent must be obtained before the first collection event -- not at the same time as enrollment and not afterward.
What are the penalties for violating Texas SB 820?
Texas SB 820 creates a private right of action with statutory damages up to $5,000 per intentional or reckless violation and up to $1,000 per negligent violation. Each individual whose biometric data was captured without a compliant written notice is a separate violation. A 200-person workplace with deficient consent notices represents up to $1 million in statutory damages exposure before attorney fees, applying the intentional violation rate.
Does a SOC 2-certified biometric vendor satisfy Texas SB 820 obligations?
No. SOC 2 certifications document the vendor's security controls over their infrastructure. They do not address whether the vendor's contract permits repurposing biometric data for algorithm training, whether the vendor's retention practices match the periods stated in your consent notices, or whether the vendor's system architecture creates uses outside the scope of collected consent. Texas SB 820 liability follows the business that collected the biometric data, not the vendor that processed it. Vendor contract review is a separate compliance requirement from vendor security assessment.
Can a vendor use biometric data to improve their recognition algorithms under Texas SB 820?
Not without express consent from the individuals whose biometric data is used. SB 820 prohibits profiting from biometric data without express consent. A vendor whose commercial product improves from algorithm training on customer biometric data is benefiting commercially from that data. If the employee consent notice did not disclose this use, the algorithm training falls outside the consent's scope. This vendor contract clause pattern is the most commonly missed SB 820 compliance gap in Vulnox assessments of Texas biometric programs.
What happens to biometric data in backups after the stated retention period expires?
Texas SB 820 requires secure destruction of biometric data when the stated retention period ends. Most biometric system deployments delete templates from the active system but do not address backup and snapshot copies. Those backups retain the biometric data past the stated retention period. Each day of retention beyond the period stated in the consent notice is continued storage outside the consent's scope. Organizations must include biometric data in backup retention policies and configure automated deletion or exclusion from restoration for data past its stated retention date.
How does Texas SB 820 interact with Illinois BIPA for multi-state employers?
Both statutes address biometric data collection, purpose limitation, retention, and private rights of action, but they are not identical. Illinois BIPA covers a broader range of biometric identifiers and has been litigated extensively since 2019 -- the case record documents the specific consent notice deficiencies, vendor contract clauses, and retention failures that generate liability. Texas SB 820 compliance programs benefit from reviewing the BIPA litigation record because the core failure patterns overlap. Multi-state employers should maintain a biometric data asset inventory by state, apply the stricter requirement where the statutes diverge, and ensure vendor contracts satisfy both statutes' restrictions.
What is purpose limitation under Texas SB 820 and how does it apply to facial recognition?
Purpose limitation under SB 820 prohibits using biometric data for any purpose outside the original consent without additional authorization. A facial recognition system deployed for building access cannot later be used for attendance tracking, dwell time analysis, or behavioral monitoring without new written consent disclosing the additional purpose. Extending a biometric system to a second use is a common compliance failure in organizations where facilities and HR teams make operational decisions about system capabilities without reviewing the original consent scope.
Related Articles
GovRAMP Moderate authorization: why the Significant Change Request process catches providers off guard
GovRAMP Moderate is the first tier where you need a government sponsor, annual 3PAO reassessment, and a Significant Change Request process that can pause normal product releases for months. Most providers who stall post-authorization were not prepared for what maintaining Moderate status actually costs operationally.
GovRAMP Low+ authorization: the impact level that punishes providers who get the CUI boundary wrong
GovRAMP Low+ is where providers handling limited Controlled Unclassified Information land — or discover they should not be there. The defining failure is not a missing control. It is a CUI boundary that was drawn before anyone asked what data the government actually sends through the system.
GovRAMP High authorization: why FIPS-validated crypto and personnel security controls catch providers off guard
GovRAMP High is where cloud providers discover that having strong encryption is not the same as having FIPS 140-2 validated encryption — and that distinction alone has derailed authorizations from vendors who passed every other control family. The architectural constraints at High are qualitatively different from every lower tier.
Ready to Secure Your Digital Assets?
Get a comprehensive vulnerability assessment for your website today.