Biometrics as Personal Private Property

A Practical Educational Framework

Introduction

Biometrics is a major privacy and rights concern in 2026. Facial geometry, fingerprints, iris scans, voiceprints, gait patterns, and similar identifiers are increasingly used by companies, platforms, employers, schools, airports, and government agencies. Many people provide biometric data without understanding how it may be stored, analyzed, shared, monetized, or reused.

This article is educational. It does not provide legal advice and does not tell any person what to file, argue, sign, refuse, or demand in any specific situation. Its purpose is to explain why biometric identifiers are often treated by modern law as a highly protected personal interest connected to identity, consent, privacy, and control.

HoMF’s educational position is that people should understand biometrics as more than “just data.” Biometric identifiers are attached to the person. They are difficult or impossible to replace. Unlike a password, a person cannot simply change their face, fingerprints, iris pattern, or voice if that information is copied or misused.

For that reason, HoMF’s notice templates are designed as educational record tools. They place recipients on notice that the sender treats biometric identifiers as private, personal, and protected information; that the sender does not grant open-ended permission for biometric collection or use; and that the sender requests disclosure of the claimed authority, purpose, retention policy, sharing policy, and consent basis for any biometric use.

This does not mean government or private actors can never collect biometrics. Government may claim lawful authority in certain settings, including public safety, identification, licensing, law enforcement, border control, or regulated access. Private entities may claim contractual consent, statutory authorization, or operational necessity. The issue is not whether biometrics can ever be collected. The issue is whether collection, retention, use, disclosure, and reuse occur within recognized legal limits.

I. Biometrics and the Legal Idea of Personal Control

American law does not use one single doctrine to describe biometric rights. Instead, several legal areas overlap: privacy law, biometric statutes, consumer protection, right of publicity, property-like control, consent, data protection, employment law, and constitutional limits where government action is involved.

The central theme across these areas is control. The law increasingly recognizes that a person has an important interest in controlling the commercial or institutional use of identity-linked information. Biometrics intensify that concern because they allow identity to be converted into a machine-readable template.

In this sense, biometrics can be understood as a modern identity-control issue. They are not ordinary facts like a mailing address or phone number. A biometric template can be used to identify, authenticate, track, exclude, monitor, or profile a person across contexts.

That is why biometric disputes are often framed around notice, consent, retention, disclosure, sale, and deletion. These are the legal pressure points that determine whether collection is transparent and limited or hidden and open-ended.

II. Identity as a Protected Interest: The Right-of-Publicity Bridge

One conceptual bridge for understanding biometric protection comes from right-of-publicity law. Right-of-publicity cases recognize that a person’s identity, name, likeness, and performance may have commercial value and cannot always be used by others without permission.

In Zacchini v. Scripps-Howard Broadcasting Co., the Supreme Court treated the unauthorized broadcast of a performer’s entire act as implicating a protectable proprietary interest. The case is not a biometric case, but it is important because it recognizes that identity and performance can carry legally protected value. Zacchini v. Scripps-Howard Broadcasting Co., 433 U.S. 562 (1977).

That principle helps explain why biometric control matters. Biometrics are machine-readable aspects of identity. If law recognizes that a person’s name, likeness, or performance can be commercially appropriated, it is understandable that modern courts and legislatures would treat biometric templates as sensitive personal identifiers requiring special rules.

The Michael Jordan litigation illustrates the same identity-control principle in a modern commercial context. In Jordan v. Jewel Food Stores, Inc., the Seventh Circuit addressed whether a retailer’s congratulatory advertisement using Michael Jordan’s identity could be treated as commercial speech. The court recognized that a company’s use of identity can serve a promotional purpose even when presented as praise or tribute. Jordan v. Jewel Food Stores, Inc., 743 F.3d 509 (7th Cir. 2014).

These cases do not establish that every biometric issue is a property claim. They do show that American law has long treated identity as more than a public free-for-all. Biometrics build on that logic because they allow identity to be captured, stored, and reused at scale.

III. Biometric-Specific Law: BIPA and the Consent Model

The strongest U.S. biometric protections currently come from statutes, especially the Illinois Biometric Information Privacy Act, commonly known as BIPA. BIPA is significant because it treats biometric identifiers and biometric information as legally sensitive and regulates how private entities collect, store, use, and disclose them.

In Rosenbach v. Six Flags Entertainment Corp., the Illinois Supreme Court held that a person may be “aggrieved” under BIPA when a private entity violates the statute’s notice-and-consent duties, even without alleging additional consequential harm. Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186, 129 N.E.3d 1197 (Ill. 2019). The educational importance of Rosenbach is that the statutory violation itself was treated as meaningful because the statute protects a person’s control over biometric information.

In Patel v. Facebook, Inc., the Ninth Circuit held that alleged nonconsensual creation of face templates under BIPA could amount to a concrete injury for federal standing purposes. Patel v. Facebook, Inc., 932 F.3d 1264 (9th Cir. 2019). That case is important because it treats loss of control over biometric identifiers as more than a technical paperwork issue.

Together, Rosenbach and Patel show the modern biometric-rights frame: biometric collection is not merely about data possession. It is about whether the person had notice, whether consent was obtained, whether the purpose was disclosed, and whether the entity complied with retention and disclosure limits.

IV. Workplace Biometrics and Repeated Scans

Two additional Illinois cases show how biometric control can matter in workplace and repeated-use settings.

In McDonald v. Symphony Bronzeville Park, LLC, the Illinois Supreme Court held that BIPA claims were not barred by the exclusivity provisions of the Illinois Workers’ Compensation Act. McDonald v. Symphony Bronzeville Park, LLC, 2022 IL 126511, 193 N.E.3d 1253 (Ill. 2022). The significance is that the alleged injury was not treated merely as an ordinary workplace injury. It was treated as an invasion of a legally protected biometric interest.

In Cothron v. White Castle System, Inc., the Illinois Supreme Court addressed when BIPA claims accrue and held that a claim may accrue each time biometric information is scanned or transmitted in violation of the statute. Cothron v. White Castle System, Inc., 2023 IL 128004, 216 N.E.3d 918 (Ill. 2023). The educational point is that repeated biometric use can matter. A system that scans a worker, customer, or member repeatedly may create repeated legal consequences if the required consent and compliance steps were not followed.

These cases do not mean every biometric scan is unlawful. They show that repeated biometric collection can become legally significant when statutory duties apply and are not followed.

V. Real-World Outcomes: Facebook, Meta, and the Monetary Value of Biometric Control

The Facebook biometric litigation demonstrates how serious biometric claims can become when applied to large-scale platforms. In In re Facebook Biometric Information Privacy Litigation, courts addressed claims involving Facebook’s alleged collection and use of face templates under BIPA. The litigation resulted in a major class settlement. In re Facebook Biometric Information Privacy Litigation, 326 F.R.D. 535 (N.D. Cal. 2018); 522 F. Supp. 3d 617 (N.D. Cal. 2021).

Texas also pursued biometric claims against Meta under state biometric law, resulting in a large settlement. The educational takeaway is not that every person automatically has the same claim or remedy. The takeaway is that regulators, courts, and companies increasingly recognize biometric data as valuable, sensitive, and legally consequential.

These outcomes reinforce the basic theme of this article: biometric data is not ordinary information. It is identity-linked data. The law increasingly treats loss of control over that data as a serious issue.

VI. How to Understand Biometrics as “Property-Like”

It is useful to be precise. Not every court will describe biometrics as “property” in the same way it describes land, a car, or a bank account. The law may instead use terms like privacy, statutory control, right of publicity, biometric identifier, personal information, sensitive data, or consent interest.

But the practical consequences often resemble property-like control. The person may have an interest in excluding unauthorized use, limiting the purpose, refusing disclosure, requiring deletion, or controlling commercial exploitation.

That is why “property-like” may be the better educational phrase. Biometrics are not always treated as traditional property, but they are often treated as a protected personal interest with control, consent, and exclusion features.

The core idea is this: a biometric template is not merely about the company that stores it. It is about the person from whom the identifier was taken.

VII. Government Collection and Public-Safety Claims

Government use of biometrics raises a different set of questions because constitutional and statutory rules may apply. Government may claim authority to collect biometrics in contexts such as arrest, licensing, identification, public benefits, border entry, aviation security, or law enforcement.

That does not mean government use is unlimited. Even when government has lawful authority to collect biometric information, questions may remain about scope, purpose, retention, sharing, database access, error rates, alternatives, due process, Fourth Amendment limits, equal protection concerns, and administrative accountability.

The educational framework is not “government can never collect biometrics.” The better framework is: what is the lawful basis, what is the stated purpose, what limits apply, what records exist, and what remedies or review channels are available if the use exceeds the stated authority?

VIII. Private Companies and Consent-Based Collection

Private biometric collection often occurs through consent forms, app terms, workplace systems, customer verification, security systems, health platforms, gyms, schools, financial services, and device authentication.

The key educational questions are usually:

What biometric identifier is being collected?

Is a template created?

Where is it stored?

Who controls it?

How long is it retained?

Can it be sold, shared, or disclosed?

Can consent be withdrawn?

Is deletion available?

Is there a non-biometric alternative?

Those questions are not legal advice. They are basic literacy questions for understanding biometric exposure.

IX. Comparative Common-Law Developments

Other common-law jurisdictions are also moving toward greater protection of identity, privacy, and biometric or data-related interests.

In Canada, cases such as Krouse v. Chrysler Canada Ltd., Athans v. Canadian Adventure Camps Ltd., and Jones v. Tsige show legal recognition of identity, privacy, and intrusion concerns. Canada also has federal and provincial privacy frameworks that may apply depending on the actor and context.

In the United Kingdom, R (Bridges) v. Chief Constable of South Wales Police addressed automated facial recognition by police and the need for adequate legal controls. The U.K. Data Protection Act 2018 and UK GDPR also regulate biometric data in many settings.

In Ireland, the Data Protection Act 2018 and cases such as Doolin v. Data Protection Commissioner reflect the importance of purpose limitation and data-protection discipline.

In New Zealand, Hosking v. Runting and the Privacy Act 2020 reflect privacy protection and data-handling principles.

In Australia, the Privacy Act 1988 (Cth) and determinations involving Clearview AI and 7-Eleven show regulatory concern over facial recognition and biometric collection.

The comparative pattern is clear: biometric and identity-linked data are increasingly treated as sensitive information requiring lawful basis, transparency, limits, and accountability.

X. Educational Use of This Framework

This framework may help readers understand biometric issues in three settings.

First, in policy discussions, it helps connect older identity-control cases like Zacchini and Jordan with modern biometric decisions like Rosenbach, Patel, McDonald, and Cothron. The point is not that all cases say the same thing. The point is that they show a legal movement toward control over identity-linked information.

Second, in private transactions, this framework encourages careful review of consent, data minimization, retention, deletion, and disclosure terms. A person who understands the issue can ask better questions before enrolling in a biometric system.

Third, in public-institution settings, the framework helps identify the relevant issues: lawful basis, purpose limitation, retention limits, non-biometric alternatives, error risk, and review procedures.

Conclusion

Biometrics are not ordinary data. They are identity-linked identifiers attached to the person and capable of repeated use across systems. American law does not always label biometrics as traditional property, but it increasingly treats them as a protected personal interest involving consent, control, privacy, and exclusion.

The most accurate educational summary is this: biometrics are property-like because they involve control over identity. Whether the legal label is publicity, privacy, statutory consent, sensitive data, or personal information, the central issue is the same. No person should casually assume that their face, fingerprints, iris pattern, voiceprint, or other biometric identifiers may be captured, stored, shared, or monetized without legally meaningful limits.

Key U.S. Authorities

Zacchini v. Scripps-Howard Broadcasting Co., 433 U.S. 562 (1977).

Jordan v. Jewel Food Stores, Inc., 743 F.3d 509 (7th Cir. 2014).

Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186, 129 N.E.3d 1197 (Ill. 2019).

Patel v. Facebook, Inc., 932 F.3d 1264 (9th Cir. 2019).

McDonald v. Symphony Bronzeville Park, LLC, 2022 IL 126511, 193 N.E.3d 1253 (Ill. 2022).

Cothron v. White Castle System, Inc., 2023 IL 128004, 216 N.E.3d 918 (Ill. 2023).

In re Facebook Biometric Information Privacy Litigation, 326 F.R.D. 535 (N.D. Cal. 2018); 522 F. Supp. 3d 617 (N.D. Cal. 2021).

Comparative Quick-Cite Authorities

Canada: Krouse v. Chrysler Canada Ltd. (1973), 1 O.R. (2d) 225 (C.A.); Athans v. Canadian Adventure Camps Ltd. (1977), 17 O.R. (2d) 425 (H.C.J.); Jones v. Tsige, 2012 ONCA 32, 108 O.R. (3d) 241.

United Kingdom: R (Bridges) v. Chief Constable of South Wales Police [2020] EWCA Civ 1058; Data Protection Act 2018; UK GDPR; Lloyd v. Google LLC [2021] UKSC 50.

Ireland: Data Protection Act 2018; Doolin v. Data Protection Commissioner [2020] IEHC 90; [2022] IECA 117.

New Zealand: Hosking v. Runting [2005] 1 N.Z.L.R. 1 (C.A.); Privacy Act 2020.

Australia: Privacy Act 1988 (Cth); Clearview AI Pty Ltd Determination, OAIC, [2021] AICmr 54; 7-Eleven Stores Pty Ltd Determination, OAIC, [2021] AICmr 50.