compliance-check

collection, a written retention policy, and deletion obligations. | | **CCPA/CPRA and other state comprehensive privacy laws** (CA, VA, CT, and others) | Biometric data used for identification is "sensitive" personal information. Applicability depends on revenue and consumer-count thresholds. | Notice at collection. Opt-in consent in many states. California's right to limit use of sensitive PI. Data protection assessments in several states. Deletion rights. | | **FTC Act §5** and the FTC's 2023 biometric policy statement | Applies nationwide. The FTC has pursued deceptive or unfair biometric practices, including ordering deletion of data and derived models. | Accurate disclosures, no burying material terms, reasonable security, and no unexpected secondary use. | | **GLBA / FTC Safeguards Rule** (possibly) | A budgeting app may or may not be a "financial institution." | If it is, security program obligations apply, and BIPA has a GLBA-related exemption. **Do not rely on that exemption without counsel's analysis**, because its reach is uncertain. | | **State breach notification laws** | Some states include biometric data in the definition of personal information. | Breach response planning for this data set. | | **Apple App Store / Google Play policies** | Distribution channel. | Check the biometric and sensitive-data disclosure rules and the privacy label and data safety updates. | ### Requirements | # | Requirement | Status | Action Needed | |---|---|---|---| | 1 | Written, publicly available retention and destruction policy (BIPA §15(a)) | **Not Met** | Draft and publish one. "Indefinitely in case of reinstall" is not a compliant retention period. | | 2 | Retention within BIPA/CUBI limits | **Not Met** | Delete on account closure, on opt-out, or after at most 3 years of inactivity (BIPA), and sooner where possible. | | 3 | Written notice of collection, the specific purpose, and the retention term (BIPA §15(b)) | **Not Met** | Give a standalone notice at enrollment that states these items. | | 4 | Informed written release (electronic signature is acceptable) | **Not Met** | A line in the ToS is high-risk. Use a separate, unbundled, affirmative opt-in at enrollment (not pre-checked), and keep records. | | 5 | Consent from **existing** Illinois users | **Not Met** | A ToS update is not a release for biometric collection. Obtain fresh consent before any enrollment. | | 6 | No sale, lease, or profit from the data (BIPA §15(c)) | Unknown | Confirm no use for analytics, advertising, model training, or vendor benefit. | | 7 | Disclosure limits and vendor controls | Unknown | Identify any third-party face-matching or cloud vendor. BIPA applies to vendors too. Get contractual limits on retention, use, and training. | | 8 | Reasonable security for templates (BIPA §15(e), CUBI) | Unknown | Encryption at rest and in transit, key management, access controls, and templates stored separately from account data. | | 9 | Non-biometric alternative | Unknown | Keep passcode or password login so consent is voluntary and users aren't locked out. | | 10 | CCPA and state-law notices and assessments | Unknown | Confirm thresholds. If they apply, update privacy notices and run a data protection assessment. | | 11 | Raw image handling | Unknown | Clarify whether raw face images are retained. They should be discarded immediately after template generation. | | 12 | Minors | Unknown | Confirm age gating. Biometrics from minors raise the risk level. | ### Risk Areas | Risk | Severity | Mitigation | |---|---|---| | **BIPA class action.** Plaintiffs need no actual harm, per *Rosenbach*, and the limitations period is 5 years (*Tims*). Statutory damages are $1,000 per negligent violation and $5,000 per reckless or intentional one. The 2024 amendment limits recovery to one per person per collection method, but 18,000 users is still roughly $18M at the negligent rate and up to $90M at the reckless rate, before defense costs. | **High** | Redesign as below, get a compliant written release, and implement a retention schedule. Check whether the ToS has an arbitration clause and class waiver. That helps but doesn't replace compliance. | | Indefinite retention violates BIPA §15(a) and Texas and Washington limits. It is also hard to defend as necessary, since users can simply re-enroll. | **High** | Remove it. Re-enrollment after reinstall is a minor inconvenience. | | Consent in the ToS is likely invalid for BIPA, the FTC's standard, and opt-in state laws. | **High** | Use a separate enrollment-time consent with specific disclosures. | | Texas AG enforcement carries penalties of up to $25,000 per violation. | **High** | Comply with CUBI's notice, consent, and destruction rules, or avoid collecting the data. | | Security breach. A leaked face template cannot be reset like a password, and the app holds financial data. | **High** | Prefer on-device storage. Otherwise use strong encryption, segregation, and breach response planning. | | Vendor and secondary-use exposure, including model training or analytics on templates. | **Medium** | Contractual prohibitions, audits, and a no-training commitment. | | Misrepresentation. If the privacy policy or app store labels don't match actual practice, the FTC and state AGs can act. | **Medium** | Align the privacy policy, in-app notices, and store disclosures with the final design. | | GLBA exemption assumption. | **Medium** | Treat it as unproven. Have counsel evaluate it separately. | ### Recommended Actions 1. **Redesign to on-device biometrics** using the OS facilities (Apple Face ID or Android BiometricPrompt) so the face template never reaches your servers. If Ferncliff never collects or possesses the biometric data, the BIPA, CUBI, and related exposure largely falls away. Have counsel confirm this analysis for your specific implementation. This is the single most effective mitigation. 2. **If server-side storage is truly necessary**, do all of the following before launch: - Publish a retention and destruction policy, with deletion on account closure or opt-out and a hard outer limit of at most 3 years of inactivity. - Add a standalone, unbundled enrollment consent. It should state what is collected, the purpose (authentication only), and the retention period, and it should be recorded with a timestamp and version. - Delete raw images immediately after template creation. - Put the vendor and security controls above in place. 3. **Drop the "keep indefinitely in case of reinstall" rationale.** Offer re-enrollment or the fallback login instead. 4. **Obtain fresh consent from existing users** and don't rely on the ToS update. Keep a non-biometric login option available. 5. **Confirm the facts** that affect scope: the user count by state (especially CA, TX, WA, CO), whether there are minors, your GLBA status, whether the ToS has an arbitration clause, and which vendors and cloud services would touch the data. 6. **Update the privacy policy, in-app notices, and app store disclosures** to match the final design, and complete any required data protection assessments. 7. **Add biometric data to the incident response plan** and check cyber insurance coverage for biometric claims. ### Approvals Needed | Approver | Why | Status | |---|---|---| | Legal / privacy counsel | Design review, BIPA and multi-state analysis, consent language | Pending | | Security / CISO | Architecture, encryption, key management, vendor security review | Pending | | Product and engineering leads | Redesign to on-device, enrollment flow, deletion mechanics | Pending | | Executive sponsor / CEO | Risk acceptance if server-side storage is chosen | Pending | | Procurement / vendor management | Vendor contracts and restrictions on retention and training | Pending (if vendors are used) | | Finance / risk (insurance) | Coverage for biometric claims | Pending | ### Further Review Recommended - **Outside counsel with BIPA litigation experience** should review the design before launch, especially if server-side templates remain in scope. The law is shaped by case law, and the 2024 damages amendment is still being tested. - **GLBA / "financial institution" status** needs a separate analysis to decide whether any BIPA exemption could apply. It shouldn't be assumed. - **Multi-state analysis** is needed for the state comprehensive privacy laws, including thresholds, opt-in requirements, and data protection assessments, plus any biometric laws enacted since this review. - **A security assessment** of any server-side template storage is advised. - **Arbitration clause and class waiver** enforceability should be assessed. They could change litigation exposure but not regulatory exposure.