Illinois has collected more than $1.5 billion in biometric privacy settlements since 2015. Texas and Washington just passed their own versions of the law. So when your brand’s AR filter scans a creator’s face to apply a virtual lipstick shade or cartoon ears, who’s liable if that scan violates state biometric privacy laws? Increasingly, the answer is: you are.
AR filters feel like harmless fun. Face geometry, retina scans, and voiceprints used to render them are, in several states, legally treated the same as a fingerprint or a DNA sample. That distinction is reshaping how brands brief creators, select filter vendors, and store campaign assets.
Why AR Filters Are a Biometric Privacy Problem, Not Just a Creative One
Most marketers think of AR filters as a visual effects layer. Legally, they’re a data collection mechanism. To map a filter onto a face in real time, the underlying software captures facial geometry: the distance between eyes, the contour of a jawline, the shape of cheekbones. That data gets processed, sometimes stored, and occasionally shared with third-party SDK providers who built the filter engine.
Illinois’ Biometric Information Privacy Act (BIPA) was the first to treat this kind of scan as a regulated biometric identifier requiring informed consent, a retention schedule, and a destruction policy. Texas’ Capture or Use of Biometric Identifier Act (CUBI) and Washington’s My Health My Data Act followed with their own teeth. California, under the CCPA framework, treats biometric data as a sensitive personal information category with its own opt-out rights.
A face scan used for a 15-second Instagram filter can legally carry the same compliance weight as a fingerprint collected at a workplace time clock. Brands that skip consent documentation are exposed the same way employers who skipped it were.
None of this matters if your creator is just holding up a product and talking. It matters enormously the moment a filter, lens, or effect touches someone’s face, voice, or gait. And with branded AR experiences becoming a standard ask in influencer briefs (Snapchat, TikTok, and Instagram all offer creator-facing AR tools), the legal surface area is growing fast.
The Patchwork Problem
Here’s the part that makes compliance genuinely hard: there is no federal biometric privacy law. Each state builds its own definition of biometric identifier, its own consent standard, and its own penalty structure. Illinois allows a private right of action, meaning individual creators or their followers can sue directly, no regulator required. Texas and Washington route enforcement through the attorney general instead, which changes the risk calculus but doesn’t eliminate it.
This state-by-state variation is the same structural headache brands are already wrestling with on other fronts. Our breakdown of state privacy law audits covers how the broader patchwork affects creator contracts generally. AR filters are simply the sharpest edge of that patchwork because they involve biometric data specifically, not just general personal information.
Where the Legal Risk Actually Sits
Brands tend to assume the AR platform (Snap, TikTok, Meta) absorbs the liability because it built the filter technology. That’s a dangerous assumption. Platform terms of service typically push data handling responsibility downstream to whoever commissions and distributes the filter, meaning the brand and its agency.
Three parties typically share exposure in a branded AR filter campaign:
- The brand, as the commissioning party that benefits commercially from the content and often dictates filter specs.
- The creator, whose face or likeness is scanned and who publishes the resulting content to their own audience.
- The AR technology vendor or platform, which processes and sometimes retains the underlying biometric data.
Courts have been willing to find brands liable even when they didn’t directly operate the scanning technology, on the theory that they directed and profited from its use. That’s the same vicarious liability logic we’ve seen play out in disclosure litigation, discussed in detail in our piece on agency vicarious liability. Biometric claims simply add another cause of action to an already crowded compliance docket.
What Counts as “Biometric Data” in an AR Context?
Definitions vary, but most state statutes capture:
- Facial geometry scans used to anchor filters, masks, or virtual try-on effects
- Voiceprints captured for voice-modulation filters or dubbing effects
- Retina or iris scans (rare in consumer AR, but relevant for some AR glasses integrations)
- Gait or movement data used in full-body AR effects
Notably, a simple photo or video of someone’s face is usually not covered. It’s the underlying mathematical representation of facial geometry, the template the software generates and potentially stores, that triggers these laws. That distinction matters when you’re vetting an AR vendor’s data practices: ask specifically whether facial templates are stored, for how long, and whether they’re used to train future models.
The Compliance Checklist
Here’s the practical framework brands and agencies should run before greenlighting any creator campaign involving AR filters, lenses, or face-tracking effects.
- Map the filter’s data flow. Get written confirmation from the AR vendor (Spark AR successor tools, Lens Studio, TikTok Effect House) on whether facial geometry is processed locally on-device or transmitted to a server. On-device processing substantially reduces exposure under most state statutes.
- Confirm retention policy. Does the vendor delete biometric templates immediately after rendering, or retain them? Illinois’ BIPA requires a written retention schedule and destruction guideline; if your vendor can’t produce one, that’s a red flag.
- Document informed consent. Creators (and anyone appearing on camera with them) need a clear, written disclosure of what’s being scanned and why, separate from the general influencer agreement. A checkbox buried in platform terms of service won’t satisfy most state standards.
- Add biometric-specific language to creator contracts. Standard influencer agreements rarely address biometric data at all. Add a clause specifying what biometric data the filter collects, how long it’s retained, and who bears responsibility for statutory violations.
- Geofence or flag high-risk states. Illinois, Texas, and Washington carry the highest exposure right now. If a campaign targets creators or audiences in those states, apply the strictest version of your compliance process uniformly rather than trying to vary it state by state.
- Vet the AR vendor’s subprocessors. Many filter-building tools rely on third-party machine learning APIs for face tracking. Ask whether any vendor shares biometric templates with outside model trainers. If yes, that’s an additional disclosure obligation.
- Loop in legal before the brief goes out, not after content ships. Retrofitting consent after a filter has already been used and shared defeats the purpose of informed consent requirements in the first place.
If your AR vendor can’t tell you, in writing, whether facial templates are retained or deleted, you don’t have a compliance gap. You have a compliance void.
How This Intersects With Minors and Teen Audiences
AR filters are disproportionately popular with teen audiences, and several platforms have already restructured teen-facing features in response to regulatory pressure. That overlap raises the stakes considerably. Biometric data collected from a minor triggers additional consent requirements in most states, often requiring parental authorization rather than the teen’s own consent.
Brands running campaigns that touch teen audiences should read this alongside the broader shifts covered in our analysis of Instagram’s PG-13 teen filters and the operational changes detailed in TikTok teen time limits. Platforms are already tightening what filters can do with teen biometric data. Brand compliance processes need to move at the same pace, not lag behind it.
Insurance and Contractual Risk Transfer
Given the private right of action available under Illinois law, biometric claims can move fast and cost significant money in statutory damages, which run per violation rather than per lawsuit. That math adds up quickly across a campaign with thousands of impressions.
Brands should confirm whether their errors and omissions coverage extends to biometric privacy claims specifically, since many standard media liability policies exclude them. Our guide to AI generated content E and O insurance walks through how these policy gaps typically show up and what to ask your broker before a campaign goes live, not after a claim lands.
Contractually, indemnification language should explicitly name biometric privacy statutes rather than relying on generic “applicable law” catch-alls. Generic language has already failed to hold up in several recent disputes because courts found it too vague to put either party on notice of biometric-specific obligations.
A Quick Gut Check Before You Brief Creators
Ask these three questions before any AR filter goes into a creator brief:
- Does this filter scan or track facial, voice, or body geometry in any way?
- Can our vendor produce a written data retention and deletion policy right now?
- Does our creator contract specifically address biometric data, separate from general image rights?
If you answer “no” or “not sure” to any of these, pause the campaign until legal has reviewed it. For additional context on how state-level patchwork regulation is reshaping contract templates across the industry, see our coverage of consumer privacy trends and the FTC’s ongoing guidance on consumer data protection, both of which inform how aggressively state regulators are likely to enforce these statutes going forward.
FAQs
Frequently Asked Questions
Do AR filters on Instagram or TikTok count as biometric data collection under state law?
Often yes, if the filter tracks facial geometry, voiceprints, or body movement to render its effect. A simple color overlay or static sticker typically doesn’t qualify, but face-tracking lenses, virtual try-on tools, and voice-modulation filters usually do under statutes like Illinois’ BIPA.
Who is liable if a branded AR filter violates a state biometric privacy law?
Liability can extend to the brand, the creator, and the AR technology vendor simultaneously. Courts have shown willingness to hold commissioning brands liable even when they didn’t build the underlying technology, particularly when the brand directed the filter’s use and profited from the resulting content.
Which states currently have the strictest biometric privacy laws affecting AR content?
Illinois (BIPA) carries the highest risk due to its private right of action and per-violation statutory damages. Texas (CUBI) and Washington also have active biometric statutes, though enforcement runs through the attorney general rather than individual lawsuits.
Does standard influencer contract language cover biometric privacy risk?
Usually not. Most influencer agreements address image rights, usage terms, and disclosure obligations but rarely mention biometric data specifically. Brands should add dedicated clauses addressing what biometric data is collected, retention timelines, and indemnification for statutory violations.
Does E&O insurance cover biometric privacy claims from AR filter campaigns?
Not automatically. Many standard media liability and errors and omissions policies exclude biometric privacy claims unless specifically endorsed. Brands running AR-heavy campaigns should confirm coverage with their broker before launch rather than assuming existing policies apply.
Next Step
Before your next AR filter brief goes out, pull your current creator contract template and check whether it mentions biometric data at all. If it doesn’t, that’s the gap to close this quarter, not after a creator or follower in Illinois files the first claim.
Top Influencer Marketing Agencies
The leading agencies shaping influencer marketing in 2026
Agencies ranked by campaign performance, client diversity, platform expertise, proven ROI, industry recognition, and client satisfaction. Assessed through verified case studies, reviews, and industry consultations.
Moburst
-
2
The Shelf
Boutique Beauty & Lifestyle Influencer AgencyA data-driven boutique agency specializing exclusively in beauty, wellness, and lifestyle influencer campaigns on Instagram and TikTok. Best for brands already focused on the beauty/personal care space that need curated, aesthetic-driven content.Clients: Pepsi, The Honest Company, Hims, Elf Cosmetics, Pure LeafVisit The Shelf → -
3
Audiencly
Niche Gaming & Esports Influencer AgencyA specialized agency focused exclusively on gaming and esports creators on YouTube, Twitch, and TikTok. Ideal if your campaign is 100% gaming-focused — from game launches to hardware and esports events.Clients: Epic Games, NordVPN, Ubisoft, Wargaming, Tencent GamesVisit Audiencly → -
4
Viral Nation
Global Influencer Marketing & Talent AgencyA dual talent management and marketing agency with proprietary brand safety tools and a global creator network spanning nano-influencers to celebrities across all major platforms.Clients: Meta, Activision Blizzard, Energizer, Aston Martin, WalmartVisit Viral Nation → -
5
The Influencer Marketing Factory
TikTok, Instagram & YouTube CampaignsA full-service agency with strong TikTok expertise, offering end-to-end campaign management from influencer discovery through performance reporting with a focus on platform-native content.Clients: Google, Snapchat, Universal Music, Bumble, YelpVisit TIMF → -
6
NeoReach
Enterprise Analytics & Influencer CampaignsAn enterprise-focused agency combining managed campaigns with a powerful self-service data platform for influencer search, audience analytics, and attribution modeling.Clients: Amazon, Airbnb, Netflix, Honda, The New York TimesVisit NeoReach → -
7
Ubiquitous
Creator-First Marketing PlatformA tech-driven platform combining self-service tools with managed campaign options, emphasizing speed and scalability for brands managing multiple influencer relationships.Clients: Lyft, Disney, Target, American Eagle, NetflixVisit Ubiquitous → -
8
Obviously
Scalable Enterprise Influencer CampaignsA tech-enabled agency built for high-volume campaigns, coordinating hundreds of creators simultaneously with end-to-end logistics, content rights management, and product seeding.Clients: Google, Ulta Beauty, Converse, AmazonVisit Obviously →