Several states, including Illinois, Texas, Arkansas, and Washington, have enacted privacy laws governing various types of biometric information, such as fingerprint, retina, and facial scans. The risks associated with the inadvertent disclosure and misuse of this type of information can be significant. Unlike other types of protected information such as user names, credit card numbers, and passwords, biometric information cannot be cancelled or replaced.

In the wrong hands, such information could be misused, creating serious concerns about potential identity theft for affected individuals. In light of these risks and given the absence of a federal statute, more states are likely to enact their own laws to protect biometric information.