Illinois brands have paid out more than $130 million in biometric privacy settlements over the past few years. Now regulators in California and across the EU are catching up fast. If your virtual try-on tool or loyalty program scans a face, a fingerprint, or a gait pattern, GDPR and CCPA consent requirements for biometric data aren’t a legal footnote anymore — they’re the difference between a clean launch and a class action.
Let’s get specific about what “consent” actually means when the data in question is someone’s face.
Why Biometric Data Gets Special Treatment
Under GDPR, biometric data used “for the purpose of uniquely identifying a natural person” sits in Article 9’s special category — the same tier as health records and political beliefs. That’s not a technicality. It means the default legal basis brands rely on for ordinary marketing data, “legitimate interest,” doesn’t apply. You need explicit consent, full stop, unless a narrow exception fits.
CCPA (as amended by CPRA) takes a slightly different road but arrives at a similar destination. Biometric information is classified as “sensitive personal information,” giving California consumers the right to limit its use and, in many implementations, requiring an opt-in rather than a passive opt-out for the initial collection tied to try-on cameras or facial scanning.
If your consent flow for a virtual try-on feature looks like a standard cookie banner, you’re already non-compliant in at least one major jurisdiction.
This distinction matters because so many brands built their AR try-on and loyalty facial-recognition features on top of generic privacy infrastructure. A checkbox buried in terms of service does not satisfy explicit consent under GDPR, and it likely fails Illinois BIPA’s written-release standard too. We’ve covered the mechanics of this gap in detail in our biometric settlement breakdown, and the pattern keeps repeating: marketing teams ship the feature, legal finds out after launch.
Virtual Try-On: Where the Risk Actually Lives
Virtual try-on tools — think Warby Parker’s face scan for glasses, Sephora’s AR makeup mirror, or L’Oréal’s ModiFace integration — typically process facial landmark data locally or via API to render a product overlay. Sounds harmless. It isn’t, legally, if that data is stored, used to train models, or shared with a third-party vendor.
Here’s the operational question every brand should be asking: does our try-on vendor retain the facial geometry data after the session ends? If yes, you need:
- A standalone, specific consent screen before the camera activates — not bundled with general privacy policy acceptance
- Clear disclosure of retention period, even if that period is “zero, deleted on session close”
- An easy mechanism to withdraw consent that doesn’t require contacting support
- Documentation of the legal basis, retained for audit purposes
Emarketer data has repeatedly shown that AR try-on features lift conversion meaningfully in beauty and eyewear categories, which is exactly why brands are tempted to smooth over the consent friction. Don’t. A slower opt-in flow beats a regulatory inquiry. We break down the technical side of this in our AR try-on consent fix guide, and the minimization angle gets its own treatment in this data minimization policy piece.
What “Explicit” Actually Requires
GDPR’s Article 4(11) defines consent as “freely given, specific, informed and unambiguous,” delivered through a clear affirmative act. For biometric processing specifically, regulators expect an extra layer: a dedicated disclosure that names the biometric purpose, separate from general data processing consent. Pre-ticked boxes don’t count. Neither does “by using this feature you agree” language buried in a footer.
The UK’s Information Commissioner’s Office has published detailed guidance on special category data that applies the same logic EU regulators use — worth reviewing directly at ico.org.uk if you’re running try-on features for UK audiences alongside EU ones.
Loyalty Programs Have a Quieter, Bigger Problem
Try-on tools get the headlines. Loyalty programs are where biometric risk hides in plain sight. Facial recognition for in-store loyalty check-ins, fingerprint scans for reward redemption at kiosks, voiceprint authentication for phone-based support tiers — all of it counts as biometric processing, and all of it triggers the same heightened consent bar.
The complication with loyalty programs is the incentive structure. If enrollment in a rewards tier requires biometric scanning, and the rewards are meaningfully better than the non-biometric tier, you may be creating what GDPR calls a “power imbalance” that undermines the “freely given” requirement. Consent extracted through a financial incentive gap isn’t necessarily invalid, but regulators scrutinize it hard — see the ongoing debate documented across Statista’s privacy research.
Our earlier reporting on loyalty programs and creator code data flows found that many brands don’t even know which third-party processors touch their loyalty biometric data once it leaves the point-of-capture app. That’s a compliance blind spot waiting to become a headline.
A loyalty program that makes biometric enrollment the path of least resistance is a program built for a regulator’s attention, not a customer’s trust.
CCPA’s Opt-Out Model vs GDPR’s Opt-In Default
This is where multi-jurisdiction brands get tripped up. CCPA/CPRA generally lets businesses collect sensitive personal information (including biometrics) and then gives consumers the right to limit its use afterward — an opt-out-adjacent structure for many processing purposes. GDPR, by contrast, requires the affirmative opt-in before processing begins.
Practically, that means a single consent flow rarely satisfies both regimes cleanly. Brands operating across the US and EU need geo-differentiated consent logic: EU and UK traffic gets the full pre-processing opt-in screen with itemized purpose disclosure; California traffic gets upfront notice plus a prominent “Limit the Use of My Sensitive Personal Information” link, per the California Privacy Protection Agency’s rules.
Other US states complicate this further. Texas, Illinois, and Washington all have their own biometric privacy statutes with different consent mechanics, and several more states have sensitive-data provisions layered into their comprehensive privacy laws. If you’re running a national loyalty program, you’re realistically building for the strictest applicable state, then loosening only where it’s actually legal to do so — the same logic our multi-state compliance audit framework applies to voice data.
The Vendor Contract Gap Nobody Reads
Most brands don’t build their own facial recognition or AR rendering stack. They license it — from ModiFace, Perfect Corp, Banuba, or a bespoke agency build. That vendor relationship is precisely where liability gets murky.
Ask your vendor these questions before the next contract renewal:
- Where is biometric data processed and stored, geographically?
- Is data used to train the vendor’s underlying models, and can you opt out of that?
- What’s the data retention window, and is deletion verifiable?
- Does the vendor act as a GDPR “processor” with a signed Data Processing Agreement, or are they ambiguously positioned as a joint controller?
- Can the vendor support geo-differentiated consent flows out of the box?
If your vendor can’t answer these clearly, you’re inheriting their compliance debt. Our GDPR and CCPA compliance guide for loyalty data pipelines walks through the DPA language brands should be pushing back on, and it’s a useful companion to the try-on-specific guidance above.
Building a Consent Flow That Actually Holds Up
A defensible biometric consent flow, whether for try-on or loyalty, generally needs five elements working together:
- Layered disclosure — a short, plain-language notice at the point of camera activation, with a link to full detail, mirroring the two-layer approach outlined in the FTC’s two-layer disclosure standard
- Purpose specificity — naming exactly what the scan does (render product overlay, verify identity, personalize recommendations) rather than generic “improve your experience” language
- Separate consent from acceptance of terms — biometric consent should never be bundled into a general ToS checkbox
- Revocation mechanism — a self-service way to withdraw consent and trigger deletion, not a support ticket queue
- Audit trail — timestamped logs of consent capture, version of the disclosure shown, and method of collection, stored for the retention period your legal team sets
None of this is exotic. HubSpot and similar CDPs have added consent-management modules precisely because this demand is growing across industries, not just retail. Marketing ops teams should treat biometric consent infrastructure as seriously as they treat email opt-in compliance under CAN-SPAM — arguably more so, given the penalty ceilings involved.
What Enforcement Actually Looks Like
BIPA violations in Illinois have produced settlements in the range of $650 per negligent violation and $1,000+ per intentional one, multiplied across a class. GDPR fines for special category data mishandling can reach 4% of global annual revenue. CCPA enforcement, still maturing, has already targeted retailers over sensitive data handling in audits from the California Privacy Protection Agency.
The pattern across enforcement actions is consistent: it’s rarely the technology itself that draws scrutiny. It’s the absence of documented, specific, revocable consent. Regulators aren’t anti-AR. They’re anti-opacity.
Next Step: Audit Before You Launch, Not After
Pull your current try-on and loyalty consent flows this quarter and map them against GDPR’s explicit-consent standard and CCPA’s sensitive-data opt-out requirement, side by side. If either flow relies on a bundled checkbox or vague retention language, fix it before your next feature rollout, not after a regulator asks.
FAQs
Does GDPR treat facial data from virtual try-on tools as biometric data?
Yes, if the processing is used to uniquely identify a person or create a facial template for matching purposes. If the tool only overlays graphics without generating a persistent biometric template, some legal teams argue it falls outside Article 9, but this is a narrow and often contested distinction that shouldn’t be relied on without documented legal review.
Can CCPA opt-out satisfy GDPR consent requirements for the same feature?
No. GDPR requires affirmative opt-in consent before processing begins, while CCPA generally allows collection with a subsequent opt-out right for sensitive data. Brands serving both US and EU users need separate, geo-targeted consent flows rather than a single unified mechanism.
Does a loyalty program’s biometric scan need separate consent from the general privacy policy?
Yes. Both GDPR and most US biometric statutes require consent that is specific to the biometric purpose, not bundled into acceptance of general terms of service or privacy policies.
Who is liable if a third-party vendor mishandles biometric data collected through a brand’s app?
Liability typically extends to both parties, but brands as the data controller usually bear primary regulatory exposure. A signed Data Processing Agreement with clear vendor obligations helps allocate responsibility, but it doesn’t eliminate the brand’s own compliance duty.
Are there US federal biometric privacy laws, or is it all state-by-state?
There is no comprehensive federal biometric privacy law currently in force. Illinois (BIPA), Texas, and Washington have dedicated biometric statutes, while California, Colorado, and other states address biometrics within broader comprehensive privacy laws. Brands operating nationally must comply with the strictest applicable state requirement.
How long can brands retain biometric data from try-on or loyalty features?
There’s no universal fixed period; GDPR requires retention limited to what’s necessary for the stated purpose, and BIPA generally caps retention at three years or when the purpose is satisfied, whichever comes first. Best practice is deleting biometric data immediately after the session unless there’s a documented, disclosed reason to retain it.
FAQs
Does GDPR treat facial data from virtual try-on tools as biometric data?
Yes, if the processing is used to uniquely identify a person or create a facial template for matching purposes. If the tool only overlays graphics without generating a persistent biometric template, some legal teams argue it falls outside Article 9, but this is a narrow and often contested distinction that shouldn’t be relied on without documented legal review.
Can CCPA opt-out satisfy GDPR consent requirements for the same feature?
No. GDPR requires affirmative opt-in consent before processing begins, while CCPA generally allows collection with a subsequent opt-out right for sensitive data. Brands serving both US and EU users need separate, geo-targeted consent flows rather than a single unified mechanism.
Does a loyalty program’s biometric scan need separate consent from the general privacy policy?
Yes. Both GDPR and most US biometric statutes require consent that is specific to the biometric purpose, not bundled into acceptance of general terms of service or privacy policies.
Who is liable if a third-party vendor mishandles biometric data collected through a brand’s app?
Liability typically extends to both parties, but brands as the data controller usually bear primary regulatory exposure. A signed Data Processing Agreement with clear vendor obligations helps allocate responsibility, but it doesn’t eliminate the brand’s own compliance duty.
Are there US federal biometric privacy laws, or is it all state-by-state?
There is no comprehensive federal biometric privacy law currently in force. Illinois (BIPA), Texas, and Washington have dedicated biometric statutes, while California, Colorado, and other states address biometrics within broader comprehensive privacy laws. Brands operating nationally must comply with the strictest applicable state requirement.
How long can brands retain biometric data from try-on or loyalty features?
There’s no universal fixed period; GDPR requires retention limited to what’s necessary for the stated purpose, and BIPA generally caps retention at three years or when the purpose is satisfied, whichever comes first. Best practice is deleting biometric data immediately after the session unless there’s a documented, disclosed reason to retain it.
Top Influencer Marketing Agencies
The leading agencies shaping influencer marketing in 2026
Agencies ranked by campaign performance, client diversity, platform expertise, proven ROI, industry recognition, and client satisfaction. Assessed through verified case studies, reviews, and industry consultations.
Moburst
-
2
The Shelf
Boutique Beauty & Lifestyle Influencer AgencyA data-driven boutique agency specializing exclusively in beauty, wellness, and lifestyle influencer campaigns on Instagram and TikTok. Best for brands already focused on the beauty/personal care space that need curated, aesthetic-driven content.Clients: Pepsi, The Honest Company, Hims, Elf Cosmetics, Pure LeafVisit The Shelf → -
3
Audiencly
Niche Gaming & Esports Influencer AgencyA specialized agency focused exclusively on gaming and esports creators on YouTube, Twitch, and TikTok. Ideal if your campaign is 100% gaming-focused — from game launches to hardware and esports events.Clients: Epic Games, NordVPN, Ubisoft, Wargaming, Tencent GamesVisit Audiencly → -
4
Viral Nation
Global Influencer Marketing & Talent AgencyA dual talent management and marketing agency with proprietary brand safety tools and a global creator network spanning nano-influencers to celebrities across all major platforms.Clients: Meta, Activision Blizzard, Energizer, Aston Martin, WalmartVisit Viral Nation → -
5
The Influencer Marketing Factory
TikTok, Instagram & YouTube CampaignsA full-service agency with strong TikTok expertise, offering end-to-end campaign management from influencer discovery through performance reporting with a focus on platform-native content.Clients: Google, Snapchat, Universal Music, Bumble, YelpVisit TIMF → -
6
NeoReach
Enterprise Analytics & Influencer CampaignsAn enterprise-focused agency combining managed campaigns with a powerful self-service data platform for influencer search, audience analytics, and attribution modeling.Clients: Amazon, Airbnb, Netflix, Honda, The New York TimesVisit NeoReach → -
7
Ubiquitous
Creator-First Marketing PlatformA tech-driven platform combining self-service tools with managed campaign options, emphasizing speed and scalability for brands managing multiple influencer relationships.Clients: Lyft, Disney, Target, American Eagle, NetflixVisit Ubiquitous → -
8
Obviously
Scalable Enterprise Influencer CampaignsA tech-enabled agency built for high-volume campaigns, coordinating hundreds of creators simultaneously with end-to-end logistics, content rights management, and product seeding.Clients: Google, Ulta Beauty, Converse, AmazonVisit Obviously →