Do biometric privacy laws apply to training data, or only to deployment?

Both, because the operative verbs are broader than most teams assume. Illinois BIPA regulates collecting, capturing, obtaining, storing, disclosing and profiting from biometric identifiers and information, not merely using them to identify someone in production. Building a face-embedding corpus is obtaining and storing; a vendor selling access to a model built from it has a profit question to answer. Deployment is where the harm is visible, but the statutory hook attaches much earlier, which is why training-set provenance is a compliance artefact rather than a research detail.

Are publicly available photos exempt from biometric laws?

Public availability is not consent, and that is the whole reason scraped face datasets are contentious. A photograph posted publicly remains a photograph; the biometric identifier is the template your system derives from it, and the statutes regulate the derivation. Some state privacy laws carve out publicly available information from their general definitions of personal data, but biometric-specific regimes typically do not extend that carve-out to identifiers generated from public media, and several treat biometric data as sensitive with a consent requirement that public posting does not satisfy.

What is algorithmic disgorgement and why does it matter to a buyer?

It is the remedy of ordering a party to delete not only unlawfully obtained data but the models and algorithms derived from it. Regulators have pursued it in enforcement actions, and settlements in biometric matters have included commitments to destroy datasets and derived models. For a buyer, it converts an upstream data problem into a continuity problem: the risk is not only a damages award against your vendor but the possibility that the model your product depends on has to be destroyed. That is why the diligence question is about provenance rather than about whether the vendor has been sued yet.

We only license the model, we never touch the training data. Are we exposed?

Your direct statutory exposure depends on what your deployment does — if your product generates templates from your users' or customers' faces, you are collecting biometric identifiers in your own right and owe consent, notice, policy and retention duties regardless of where the model came from. The upstream provenance problem reaches you commercially rather than statutorily: through the indemnity you do or do not have, through the possibility that the model is withdrawn or ordered destroyed, and through a customer's diligence asking a question your vendor will not answer in writing.

How can a buyer verify a face dataset was lawfully collected?

You cannot verify it by inspecting the model, so verification has to be documentary and contractual. Ask for the collection method for each corpus, the consent or licence basis relied on, the jurisdictions the subjects were in, whether any component dataset has been withdrawn by its publisher, and whether the vendor will warrant lawful collection and indemnify you for third-party biometric claims. A vendor that has done this work answers in a page. Refusal to warrant is itself the finding — it means the vendor has priced the risk and declined to carry it, and the question is whether you will.

Scraped Face Datasets and Biometric Training Data 2026: The Liability You Buy With the Model

Why Training Sits Inside the Statute

Read the verbs. Illinois BIPA speaks about collecting, capturing, obtaining, storing, transmitting, disclosing and profiting from biometric identifiers and biometric information. Texas prohibits capturing a biometric identifier for a commercial purpose without informed consent. Washington's regime turns on enrolling a biometric identifier in a database for a commercial purpose. None of these are drafted around the moment a product recognises a customer; they are drafted around the handling of the identifier itself.

A training corpus of face embeddings is handled biometric data. So is a corpus of raw images destined for template generation, once the generation occurs. The reason this feels novel is that the teams building corpora and the teams reading privacy statutes have historically been different people working from different documents — the research side treats a dataset as a technical input and the legal side reviews the deployment.

Where a Product Team Actually Picks This Up

HIGH RISK

Licensing a face-recognition or face-matching model from a vendor that will not describe its training corpora, or that describes them as 'publicly available images'.

HIGH RISK

Fine-tuning an identity model on images collected from your own users for one purpose and repurposed for another, without consent covering the training use.

HIGH RISK

Buying a dataset from a broker where the chain of consent is asserted in a sentence and cannot be traced to a collection event.

MODERATE

Using a research-released academic face dataset in a commercial product. Several widely cited sets carry research-only terms, and some have been withdrawn by their publishers while copies circulate.

MODERATE

Voice models trained on scraped speech. Voiceprints are biometric identifiers in the same statutes, and speech corpora receive a fraction of the provenance scrutiny image corpora now get.

LOWER

Vision models that detect faces without generating identifying templates, and synthetic face datasets generated without conditioning on identified real individuals — though the second requires the generator's own provenance to hold up.

Synthetic is not automatically clean. A synthetic face dataset inherits the provenance of the generator that produced it. If that generator was trained on scraped identified faces, the synthetic set is downstream of the same collection, and a defence resting on the images being fictional has to survive the question of what the model learned identities from. Ask the same provenance questions one layer up; synthetic data moves the question, it does not answer it.

The Remedy That Makes This a Continuity Problem

Ordinary data-privacy exposure is financial: damages, penalties, remediation cost. What distinguishes unlawfully collected training data is that regulators have sought — and settlements have included — destruction of the derived models, not only the underlying records. The logic is straightforward: leaving the model intact would let the party keep the benefit of the collection it was not entitled to make.

For a company that licensed the model rather than built it, this reframes the diligence question. You are not primarily asking whether your vendor can pay a judgment. You are asking whether the capability your product depends on can be ordered out of existence, and what your agreement says happens to you if it is. Very few AI vendor agreements contain a meaningful answer, because the template they were drafted from contemplated a software outage rather than the permanent unavailability of a trained artefact.

The Diligence Set, in Questions You Can Send Today

Name every training corpus. For each: source, collection method, approximate date range, and whether it contains identified individuals. "Publicly available web data" is not an answer to this question.
State the lawful basis per corpus. Consent obtained at collection, a licence from a party who obtained consent, or a claim that the data is not biometric. Each of the three is a different argument and should be identified as such.
Ask about withdrawals. Whether any component dataset has been retracted, restricted to research use, or made subject to a deletion order — and what the vendor did about it.
Ask what deletion means. If a subject exercises a deletion right, what happens to the template, the derived embeddings and the model. A vendor with no answer beyond deleting a row has not thought about the artefact that matters.
Seek a warranty and an indemnity. Lawful collection warranted, biometric and privacy claims indemnified, and no cap so low that the indemnity is decorative.
Plan for withdrawal. An exit or substitution path if the model becomes unavailable. This is a product decision, not a legal one, and it is the one most worth having before you need it.

Your Own Deployment Duties Do Not Go Away

Upstream provenance is the part teams miss; downstream collection is the part they owe regardless. If your product generates a template from a face, voice, iris or behavioural signal belonging to a real person, you are collecting a biometric identifier and the full apparatus applies — written notice before collection, informed consent, a published retention and destruction schedule, and limits on disclosure and on profiting from the identifier. Buying a well-documented model satisfies none of that. The two workstreams are independent, and each is regularly used as an excuse for not doing the other.

Frequently Asked Questions

Our model was trained abroad on data from non-US subjects. Does a US biometric statute still reach us?

The training may sit outside a given statute's reach if no covered individuals' data was involved, but that is a fact question you need evidence for rather than an assumption — large scraped corpora are rarely geographically clean, and a vendor that cannot describe collection cannot support the claim that no residents of a particular state were included. Separately, your deployment reaches whoever your users are: a model trained entirely abroad and used to scan customers in Illinois or Texas triggers the local duties in full.

Does a photograph become biometric data the moment it lands in our storage?

Generally no. Most biometric statutes expressly exclude photographs from the definition of a biometric identifier while covering the scan of face geometry derived from one, and the practical line is whether your system generates an identifying template. This distinction is where features cross without a ticket: a photo library is out of scope until someone enables face grouping, at which point the same bucket of images is producing identifiers and the notice, consent and retention duties attach retroactively to nothing and prospectively to everything.

We use a third-party API for face matching and never store templates ourselves. Are we in scope?

Yes, in most framings. Determining that faces will be matched and directing the processing is what makes you the responsible party; the vendor performing the computation is acting on your instruction. Several statutes also reach disclosure of biometric identifiers to a third party, which is precisely what sending an image to an external API for template generation is — and disclosure typically requires its own consent. The contractual controls that matter are that the vendor processes only on your instruction, does not use your data to train, and deletes on instruction with written confirmation.

How is this different from the copyright fight over training data?

Different right-holder and a different remedy. Copyright claims are brought by rights owners over expressive works and turn substantially on fair use. Biometric claims are brought by or on behalf of the individuals depicted, do not depend on anyone owning the image, and in Illinois carry a private right of action with statutory damages per violation — which is what makes the class arithmetic significant. A licence from a photographer resolves the copyright question and does nothing at all for the biometric one, because the person in the frame was never the licensor.

What single artefact best demonstrates we did the work?

A dataset register: every corpus used to train or fine-tune any model that touches faces, voices or other biometric signals, with source, collection basis, date acquired, licence terms, and a named owner. It is the biometric analogue of a software bill of materials, it answers most of what a customer's security review asks, and it is the only version of this record that survives the departure of the people who built the model. Start it before you need it — reconstructing corpus provenance after the fact is the part that cannot be done.

Build the Dataset Register First

You cannot inspect a model for provenance. Everything you will ever be able to say about where your biometric capability came from has to be written down at acquisition time by the person who acquired it.

List the corpora, record the collection basis, get the warranty and indemnity in the vendor agreement, and keep your own deployment consent and retention duties on a separate track. Those two tracks, run independently, are the whole of a defensible biometric posture.