compliance-check

privacy laws** | California, Colorado, Virginia, Connecticut, and other states regulate biometric identifiers or biometric data used for identification as sensitive information. Colorado also has specific biometric requirements to assess. | Determine applicability state by state; assess sensitive-data consent or limitation rights, notices, assessments, consumer rights, and processor contracts. **210,000 nationwide users alone does not establish each law’s threshold.** | | **FTC Act §5; state consumer-protection laws** | Misleading privacy statements, inadequate security, or unfair biometric practices can create exposure. | Substantiate security and accuracy claims; disclose actual practices; assess foreseeable consumer harms. | | **GLBA / FTC Safeguards Rule, if applicable** | A budgeting app’s actual financial activities—not its label—determine whether financial-institution requirements apply. | Determine coverage and any exemptions; assess privacy notices, safeguards, vendor oversight, and incident obligations. Do not assume a GLBA exemption removes BIPA obligations. | | **State breach-notification laws** | Biometric identifiers may be covered personal information, depending on the state and circumstances. | Map notification triggers, deadlines, affected data, and contractual incident reporting. | ### Requirements **Statuses below reflect your description, not an audit.** | # | Requirement | Status | Action needed | |---|---|---|---| | 1 | Appropriate biometric notice and consent | **Not met as described** | Replace the TOS line with a conspicuous, specific biometric notice and affirmative enrollment consent. For Illinois, obtain a compliant written release, which may be electronic. Retain the notice version and consent evidence. | | 2 | Defined purpose and retention period | **Not met** | Remove indefinite retention. “In case users reinstall” is not a substitute for a defensible, limited retention schedule. | | 3 | Illinois public retention/destruction policy | **Unknown** | Publish and implement a policy requiring destruction when the initial collection purpose is satisfied **or within three years of the user’s last interaction with the company, whichever occurs first**. Three years is an outside limit, not automatic permission to retain. | | 4 | Necessity and safer architecture review | **Unknown** | Document why Pennywise needs biometric custody rather than device-native authentication/passkeys. | | 5 | Withdrawal, disablement, and account deletion | **Unknown** | Define when enrollment ends and implement deletion across production, vendors, replicas, and backups on a documented schedule consistent with applicable law. | | 6 | Vendor and disclosure compliance | **Unknown** | Map every recipient and processing location. Check whether separate disclosure authorization is needed; prohibit vendor reuse, model training, sale, and unauthorized onward disclosure. | | 7 | Security and incident readiness | **Unknown** | Complete threat modeling, access controls, encryption/key separation, deletion testing, and a biometric incident-response plan. Templates remain sensitive even if source images are deleted. | | 8 | State applicability and risk assessments | **Unknown** | Inventory users by state, relevant revenue/data thresholds, exemptions, and legally required assessments. | **Important Illinois distinction:** ordinary photographs are excluded from BIPA’s biometric-identifier definition, but that does **not** make extracting face geometry from photographs exempt. ### Risk Areas | Risk | Severity | Mitigation | |---|---|---| | Illinois private litigation over collection, consent, retention, or disclosure | **High** | Do not collect before counsel approves the workflow. BIPA permits private actions and statutory damages; do not estimate exposure simply by multiplying scans. | | Breach of centrally stored, hard-to-replace biometric identifiers | **High** | Prefer no server-side biometric storage. Encryption alone does not eliminate the risk. | | Indefinite retention and ineffective deletion | **High** | Establish purpose-specific deadlines, automated deletion, vendor obligations, and verification. | | Spoofing, false matches, demographic performance differences, and account takeover | **High** | Independently test performance and attack resistance; provide secure fallback and recovery. | | Expansion into profiling, training, or other secondary uses | **High** | Technically and contractually restrict processing to approved authentication purposes. | ### Recommended Actions 1. **Pause the proposed collection and upload design.** Confirm whether any pilot has already collected biometric data; if so, involve counsel promptly and stop additional unapproved collection. 2. **Evaluate passkeys with device-native biometrics first.** Reinstallation can generally be addressed through credential synchronization or secure recovery without retaining faces centrally. 3. If central recognition remains necessary, complete a **documented biometric/privacy impact assessment**, state-law analysis, and security review before enrollment. 4. Build the notice, affirmative consent, retention/destruction policy, vendor controls, deletion workflow, and non-biometric login alternative before release. 5. Separate biometric authentication from access to financial accounts: assess financial-data provider terms and avoid assuming biometric login alone satisfies their security requirements. ### Approvals Needed | Approver | Why | Status | |----------|-----|--------| | Privacy counsel, including Illinois BIPA experience | Applicability, consent, retention, disclosures, litigation exposure | Pending | | Security leadership | Architecture, spoof resistance, recovery, breach response | Pending | | Privacy / data governance | State-law mapping, assessments, rights and deletion workflows | Pending | | Product and engineering leadership | Safer-design decision and verified implementation | Pending | ### Further Review Recommended Obtain specialist advice on **BIPA’s application to your exact enrollment flow, current damages rules, state biometric-law developments, and possible GLBA coverage**. The immediate blockers are clear even before that review: **indefinite server retention and a line in the terms are not a defensible launch plan.**