Is a selfie used for KYC identity verification a biometric identifier?

Yes. When an AI system extracts face geometry from a selfie to match it against a government ID or an enrolled template, that extracted face geometry meets the statutory definition of a biometric identifier under Illinois BIPA and similar laws in Texas and Washington, regardless of whether the underlying photo itself is separately regulated.

Why did the IRS drop its facial-recognition identity verification requirement?

In February 2022, the IRS announced it would stop requiring taxpayers to submit a selfie for facial-recognition verification to access online accounts, following bipartisan public and congressional backlash over privacy, accessibility for people who could not complete the liveness check, and concerns about a single private vendor holding a large biometric database of taxpayers.

Do KYC vendors need separate consent for facial-recognition verification if the customer already agreed to a general terms-of-service or privacy policy?

Generally no, a general terms-of-service acceptance is not sufficient. Biometric privacy statutes like BIPA require a specific written notice describing the biometric purpose and retention period, plus a written release, before collection — bundling that into a broad clickwrap agreement that never specifically mentions biometric data collection has been a recurring basis for BIPA claims against fintech and identity-verification vendors.

Does using a third-party AI identity verification vendor shift BIPA liability away from the fintech using it?

No. Both the deploying business and the identity-verification vendor can be named as defendants, and vendor contracts are increasingly scrutinized for who bears responsibility if the onboarding flow's consent and notice steps are non-compliant — outsourcing the technology does not outsource the legal obligation.

AI KYC Identity Verification and Biometric Law 2026: Compliance Guide

Why "Take a Selfie" Is a Biometric Compliance Event

AI-driven Know Your Customer verification has become the standard onboarding flow for banks, fintech apps, exchanges, and marketplaces: a new user photographs a government ID, then takes a live selfie that the system matches against the ID photo and screens for signs of spoofing. It reads as a security convenience. Legally, the moment the system extracts and processes face geometry from that selfie to perform the match, it has collected a biometric identifier.

That triggers the same category of obligation that applies to fingerprint time clocks and voice authentication systems. Illinois BIPA, Texas's Capture or Use of Biometric Identifier Act, and Washington's biometric privacy law all define biometric identifiers broadly enough to cover face geometry derived from a photo, and none of them carve out an exception for KYC or fraud-prevention use cases.

The IRS Reversal Is the Cautionary Tale, Not an Outlier

In 2022, the IRS attempted to require facial-recognition verification through a private vendor for taxpayers accessing their online accounts. Within weeks of the announcement, bipartisan pressure over privacy, the accessibility barrier for people who could not complete a liveness check, and discomfort with a single vendor amassing a biometric database of taxpayers forced the agency to drop the mandate and pursue alternatives.

Private-sector KYC deployments face a version of the same exposure without the benefit of a federal reversal to make it go away — instead, non-compliant biometric collection in states with a private right of action produces the class-action pattern already well established against banks and identity-verification vendors: statutory damages calculated per violation, not per lawsuit, and both the fintech and its vendor named as defendants.

What a Compliant AI KYC Flow Requires

Missing: Biometric-specific written notice

COMMON GAP

A general terms-of-service or privacy policy that never specifically names facial geometry or biometric data collection does not satisfy the written-notice requirement most biometric privacy statutes impose before collection begins.

Missing: Standalone written release for the liveness step

COMMON GAP

Bundling biometric consent into a broad account-opening clickwrap, rather than presenting a discrete written release specific to the selfie-match step, has been a recurring basis for BIPA claims against fintech onboarding flows.

Present: Published retention and destruction schedule

CAN SATISFY

A public biometric data policy naming the specific retention period for face geometry templates and the destruction trigger — typically tied to account closure or a fixed period after verification — addresses the retention-schedule requirement directly.

Present: Documented vendor liability allocation

CAN SATISFY

A vendor contract that explicitly assigns responsibility for biometric notice and consent compliance, and requires the vendor to support the fintech's own compliance documentation, reduces exposure when the two parties' roles are otherwise ambiguous.

Pre-Deployment Checklist for AI Identity Verification

Map every jurisdiction where enrolled users reside

Biometric privacy obligations attach based on the individual's residency, not the fintech's headquarters — an onboarding flow serving customers nationally is likely collecting biometric data from Illinois, Texas, and Washington residents regardless of where the company is based.

Separate the liveness-check consent from general onboarding consent

Build a discrete written notice and release specific to facial-geometry collection into the KYC flow, rather than relying on a broad account-opening agreement that never names biometric data.

Confirm the vendor's retention practices match your published policy

If the identity-verification vendor stores face geometry templates longer than your public biometric policy states, the mismatch itself becomes a compliance gap — audit vendor data retention against your own published commitments.

Build an accessible non-biometric fallback path

Offer an alternative verification method for users who cannot or will not complete a facial liveness check — the accessibility gap was a central complaint in the IRS backlash and remains a practical and legal risk for facial-recognition-only onboarding.

Frequently Asked Questions

Does deleting the selfie photo after verification eliminate BIPA exposure?

Not by itself. The regulated biometric identifier is the face geometry template extracted from the photo, not necessarily the photo file itself — a system that deletes the image but retains the derived biometric template for future matching still needs to satisfy the notice, consent, and retention-schedule requirements for that template.

Are federal KYC requirements under the Bank Secrecy Act in conflict with state biometric privacy laws?

No — federal KYC and anti-money-laundering rules require verifying customer identity, but they do not mandate facial-recognition biometric verification specifically. A fintech can satisfy federal KYC obligations through non-biometric methods (document review, knowledge-based verification, database checks), which is why a biometric-optional fallback path resolves the tension rather than creating a new one.

Does anonymizing or hashing the face geometry data avoid biometric privacy law?

Generally no. Courts examining similar arguments in biometric privacy cases have found that a mathematical representation of a biometric identifier still functions to identify the person and remains within scope, as long as it can still be used to match against that person.

Is a liveness check (blinking, head turn) treated differently from a static selfie match?

Not for biometric privacy purposes. Both extract face geometry data used to verify identity; the liveness-detection component is an anti-spoofing feature layered on top of the same underlying biometric collection, and does not change the analysis of whether a regulated biometric identifier was captured.

Find AI Compliance and Identity Verification Tools on RatedWithAI

RatedWithAI reviews AI compliance and identity-verification platforms — including tools built to manage biometric consent capture, retention-schedule tracking, and non-biometric fallback verification for KYC onboarding flows.

Explore AI Legal & Compliance Guides