Law / United States / 
Tennessee
Tennessee Information Protection Act, sensitive data and biometric definition
Tenn. Code Ann. §§ 47-18-3201 to 47-18-3214
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since 1 July 2025.
A sensitive categories rule binding private bodies.
As of 27 August 2026.
What it requires
- Obtain a Tennessee consumer's consent before processing sensitive data, including biometric or genetic data processed to uniquely identify the individual.
- Do not assume Tennessee's recording-derived exclusion protects you elsewhere. A faceprint or voiceprint your product extracts from a photograph, video, or audio recording is categorically outside TIPA's biometric-data definition, unlike Maryland, Minnesota, and New Jersey, where the same extraction claws back into a consent duty.
What it reaches
Excludes recording-derived identifiersYes
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
TIPA classifies information revealing racial or ethnic origin, religious beliefs, a mental or physical health diagnosis, sexual orientation, or citizenship or immigration status; the processing of genetic or biometric data to uniquely identify a natural person; a known child's personal information; and precise geolocation data as sensitive data.
"Biometric data" is defined as data generated by automatic measurement of biological characteristics used to identify a specific individual, but categorically and unconditionally excludes a physical or digital photograph, video recording, or audio recording, or data generated from one, with no claw-back for an identification purpose.
This is the single most consequential difference from Maryland, Minnesota, and New Jersey in this same wave: a faceprint or voiceprint a product derives from a recording specifically to identify a person is never "biometric data" in Tennessee, and therefore never triggers TIPA's sensitive-data consent duty on that basis alone. No dedicated Tennessee biometric-privacy statute beyond TIPA's sensitive-data treatment was found.
When LexLint raises it
processes_biometricsprocesses_voicecrawls_webtrains_models
Read the law
official Tennessee session law text, Public Chapter 408 (2023), Tennessee Secretary of State
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.