Four US States Pass Privacy Laws Affecting Biometric Data

Alabama, Louisiana, Oklahoma and Vermont have passed comprehensive consumer privacy laws that introduce stricter requirements for collecting, processing and disclosing sensitive data, including biometric information, according to a JD Supra legal update dated October 29, 2026.

The Oklahoma Consumer Data Privacy Act is scheduled to take effect on January 1, 2027, followed by the Alabama Personal Data Protection Act on May 1, 2027. The laws in Louisiana and Vermont are also set to take effect in stages.

What the laws mean for biometric data handling

For businesses using facial or iris recognition, the changes make it important to review how biometric information moves through their operations. That review may cover where the information is collected, how it is processed and when it is disclosed. The practical requirements for each business will depend on the provisions of the applicable state laws.

The different implementation dates also make timing relevant: businesses affected by more than one law may need to assess their data handling against each state's requirements and track when those requirements take effect. The specific dates and provisions for Louisiana and Vermont are among the details to watch as implementation approaches.