LexLint.ioBeta

Know the law your code answers to.

Activities / What code does

Processes biometric data

processes_biometrics

Your app collects or analyzes a physical or behavioral trait, such as a fingerprint, a face, or a voiceprint, to identify or verify a person.

  • scope code
  • in the registry since 1.0
  • 798 laws in 215 jurisdictions name it

What triggers it

The lint's definition. It handles body or behavior measurements that identify a person: face geometry, fingerprint, voiceprint, iris. A photo is not this; recognizing someone from one is, as is your notice saying you may.

This covers a face-unlock feature, a fingerprint login, and a voiceprint used to confirm a caller's identity.

What does not

Storing an ordinary photo a user uploads for their profile does not count unless your app extracts a biometric template from it.

Often confused with Processes voice recordings.

The law it brings into scope

The kinds of law that name this activity in the LexLint law library, with the number of laws and jurisdictions in each, as of . The examples are chosen by rule, laws in force first and the widest jurisdiction first; each section's page lists every law.

Area of lawLawsJurisdictions
Privacy law

Have a legal basis for personal data, honor people's rights over it, and report a breach.

 611 204
Cybersecurity law

Build software securely, handle reported flaws, and report incidents on a deadline.

 91 67
AI law

Tell people when they are dealing with an AI system or its output, and control the uses the law calls high-risk.

 47 24
Scraping law

Stay within computer-access law, a site's terms, and the copyright in what is copied.

 33 33
Product and AI liability law

Answer in damages when defective software or an AI system causes harm.

 24 22

Counterparties that usually come with it

  • a face- or voice-matching vendor
  • an identity-verification provider

A component that cannot run as documented without one of these names it in its ACTIVITIES.md under talks_to, with required: true. That party's jurisdiction then joins the run of every product that uses the component, and the finding says why it is there. A default the deployer can change is asked about, never added. Talking to a party never makes a product that party.

In a declaration

A library or framework that makes this possible enables it; an application whose shipped code does it performs it.

For a library

activities: - id: processes_biometrics mentioned: enables enabled: requires_configuration where: [<the module that carries it>] note: <one sentence>

For an application

activities: - id: processes_biometrics mentioned: performs enabled: by_default where: [<the module that carries it>] note: <one sentence: what it does, and the kind of law it attracts>

History

In the registry since version 1.0, .

In the glossary: Processes biometric data.

The activity registry is LexLint's open list; this page's text is licensed under Creative Commons Attribution 4.0.