Biometric technology—which uses unique characteristics like a user’s face, fingerprint, voice, etc. to verify an individual’s identity—has become commonplace in modern life. People the world over are accustomed to unlocking their phones with their faces; logging into their laptops with fingerprints; or even punching a time clock with an iris scan.

As these technologies have proliferated, however, so has litigation over how companies collect, store, and use this data. Nine-figure settlements by tech giants have grabbed the most headlines. But companies of all shapes and sizes face legal risks if they collect or use biometric data in their businesses.