Georgia Biometric Privacy Laws: Collection, Consent & Penalties (2026)

Georgia has no biometric-specific privacy law and no comprehensive consumer privacy statute. A bill from the 2025-2026 session, SB 111 (the Georgia Consumer Privacy Protection Act), would have classified biometric data processed to uniquely identify a person as sensitive data and required covered businesses to obtain consent before processing it, but a House committee stripped the privacy provisions and replaced the bill with an unrelated rural hospital tax-credit measure before final passage. Governor Kemp signed that substitute into law as Act 462 on May 11, 2026; the privacy requirements never took effect. The Personal Identity Protection Act (O.C.G.A. 10-1-910 et seq.) separately requires breach notification but excludes biometric data from its definition of personal information, leaving biometric-only breaches without a state-level notification requirement.

Georgia is one of the majority of U.S. states that has not enacted a dedicated biometric privacy law. Residents who use fingerprint scanners at work, submit to facial recognition at public venues, or provide biometric data to apps and devices have limited state-level legal protections governing how that data is collected, stored, shared, or destroyed.

This guide explains what Georgia law currently does and does not cover when it comes to biometric information, what happened to the Georgia Consumer Privacy Protection Act (SB 111) and why it never took effect, and what federal protections fill the remaining gaps.

For broader context on Georgia's overall privacy framework, see the parent guide to Georgia Data Privacy Laws.

What Counts as Biometric Data

Biometric data includes unique physical or behavioral characteristics used to identify an individual. Common examples include fingerprints, facial geometry (used in facial recognition), iris and retina scans, voiceprints, palm prints, and gait analysis.

States with dedicated biometric privacy laws, such as Illinois (BIPA) and Texas (CUBI), define these identifiers in statute and regulate how entities handle them. Georgia has not taken this step.

Georgia's Current Legal Framework

Personal Identity Protection Act (O.C.G.A. 10-1-910 et seq.)

Georgia's primary data protection law is the Personal Identity Protection Act, enacted in 2005 and amended in 2007. This law requires "information brokers" (businesses that sell personal data to third parties) and government data collectors to notify Georgia residents when a breach compromises personal information.

However, the statute defines "personal information" under O.C.G.A. 10-1-911 as an individual's name combined with one or more of the following:

• Social Security number
• Driver's license or state ID number
• Financial account, credit card, or debit card numbers (with access codes)
• Account passwords or PINs

Biometric data such as fingerprints, facial scans, and voiceprints are not included in this definition. A breach involving only biometric records would not trigger notification obligations under current Georgia law.

Fair Business Practices Act (O.C.G.A. 10-1-390 et seq.)

Georgia's Fair Business Practices Act prohibits unfair and deceptive trade practices. While the statute does not mention biometric data specifically, a business that made false promises about how it handles biometric information could theoretically face enforcement action under this law.

The Georgia Attorney General enforces the FBPA. There is no private right of action that would allow individual consumers to sue for biometric data misuse under this statute alone.

Record Disposal Law (O.C.G.A. 10-15-1 et seq.)

One Georgia statute does name biometric identifiers directly. The state's business record disposal law defines "personally identifiable" in O.C.G.A. 10-15-1(10)(A) as data capable of being associated with a particular customer through identifiers "including, but not limited to, a customer's fingerprint, photograph, or computerized image," listed alongside Social Security numbers, passport numbers, and dates of birth.

O.C.G.A. 10-15-2 then bars a business from discarding a customer record that contains personal information unless it shreds the record, erases the information, makes it unreadable, or takes other steps it reasonably believes will keep unauthorized people from reaching the data before the record is destroyed.

Three limits keep this from operating as a biometric privacy law:

• It is a destruction duty only. Nothing in the chapter requires consent, notice, a retention schedule, or any limit on collecting, using, or sharing biometric data.
• It reaches customer records. O.C.G.A. 10-15-1(4) defines a customer as an individual who provides personal information to buy or lease a product or obtain a service, so employee fingerprints and facial scans fall outside it entirely.
• The record's content must fit one of four categories listed in O.C.G.A. 10-15-1(9): a customer's medical condition; account or identification numbers and balances; data provided when opening an account or applying for a loan or credit; and income tax return data. A biometric identifier captured outside those contexts, such as a facial scan at a venue entrance, is not covered.

The Attorney General enforces the chapter and may impose a penalty of up to $500 for each customer record wrongfully discarded under O.C.G.A. 10-15-6(a), capped at $10,000.00 in total, subject to an affirmative defense for a business that used due diligence. There is no private right of action, and the chapter does not apply to banks covered by the Gramm-Leach-Bliley Act or to hospitals covered by HIPAA.

No Employer-Specific Biometric Rules

Georgia does not restrict employers from collecting fingerprints, facial scans, or other biometric data from employees. Businesses that use biometric time clocks, fingerprint-based access controls, or facial recognition for security purposes are not required by state law to:

• Obtain written consent before collecting biometric data
• Disclose how biometric data will be stored or used
• Establish retention schedules or destruction timelines
• Limit sharing of biometric data with third parties

This stands in sharp contrast to states like Illinois, where the Biometric Information Privacy Act requires informed written consent and imposes statutory damages of $1,000 to $5,000 per violation.

SB 111: Georgia's Failed Consumer Privacy Protection Act (2026)

The most significant recent development for biometric privacy in Georgia is SB 111, the Georgia Consumer Privacy Protection Act, which would have covered biometric data as sensitive data but never became law. Governor Kemp signed a substitute bill as Act 462 on May 11, 2026, and that substitute is an unrelated rural hospital tax-credit measure, not a privacy law.

What SB 111 Would Have Done for Biometric Data

As passed by the Senate, SB 111 would have classified biometric data processed for the purpose of uniquely identifying an individual as "sensitive data." The Senate-passed version would have:

• Required covered businesses to obtain explicit consumer consent before processing biometric data
• Mandated clear notices when a business sells or shares sensitive data, including biometric information
• Required data protection assessments for activities involving sensitive data processing
• Authorized the Georgia Attorney General to seek civil penalties of up to $7,500 per violation, with treble damages for knowing or willful violations

None of these provisions are in effect, because they were removed before the bill passed.

What Actually Happened

SB 111 passed the Georgia Senate on March 3, 2025, by a vote of 53-2, as a comprehensive privacy bill. The House withdrew and recommitted the bill in March 2025 and did not act on it before the 2025 session adjourned. When the House took the bill back up in 2026, a House committee replaced the entire bill with a substitute unrelated to privacy, amending the state's rural hospital tax credit statute instead. The House passed that substitute 162-1 on March 31, 2026, the Senate agreed to it on April 2, 2026, and Governor Kemp signed it into law as Act 462 on May 11, 2026. The Governor's own press release describes Act 462 solely as expanding tax-credit eligibility for rural hospitals, with no mention of consumer privacy.

The ACLU of Georgia had criticized the Senate-passed privacy version for high applicability thresholds before it was stripped out: it would have applied only to entities that exceed $25 million in annual revenue and process personal information of at least 175,000 Georgia residents, or 25,000 residents if the entity derives more than 50% of revenue from selling personal data.

Georgia has no comprehensive consumer privacy law and no biometric-specific statute today.

Federal Protections That Apply in Georgia

Because SB 111's privacy provisions never became law, and Georgia's record disposal law reaches only the narrow slice of customer records described above, federal statutes are the primary legal guardrails for biometric data in Georgia.

Section 5 of the FTC Act allows the Federal Trade Commission to bring enforcement actions against companies engaged in unfair or deceptive practices involving biometric data. The FTC has taken action against companies for deceptive facial recognition practices and inadequate data security.

HIPAA protects biometric data when it is collected or used by covered healthcare entities and their business associates. Fingerprint or facial recognition data used in a healthcare setting falls under HIPAA's Privacy Rule.

FERPA restricts how educational institutions handle student biometric data. Schools that use fingerprint-based lunch payment systems or facial recognition must comply with FERPA's privacy requirements.

COPPA imposes strict requirements on the collection of biometric data from children under 13, including parental consent requirements enforced by the FTC.

How Georgia Compares to Other States

Georgia falls into the least protective tier of states for biometric privacy. For comparison:

• Illinois has the strongest biometric law in the country (BIPA), with a private right of action and statutory damages of $1,000 to $5,000 per violation
• Texas and Washington have biometric-specific statutes enforced by their attorneys general
• States with comprehensive privacy laws (like Colorado, Connecticut, and Virginia) classify biometric data as sensitive and require consent for processing
• Georgia has no biometric-specific statute and no comprehensive privacy law. SB 111 would have classified biometric data as sensitive and required consent from covered businesses, but the House stripped those provisions before passage, so none of it became law

This article provides general legal information about Georgia biometric privacy laws. It is not legal advice. Laws and regulations change frequently, and this content may not reflect the most recent developments. Consult a qualified attorney licensed in Georgia for advice about your specific situation.

More Georgia Laws

• Georgia Deepfake Laws
• Georgia Employee Monitoring Laws
• Georgia GPS Tracking Laws
• Georgia Recording Laws