Kansas Biometric Privacy Laws: What You Need to Know (2026)

Kansas has no dedicated biometric privacy law and its breach notification statute, K.S.A. 50-7a01, does not cover biometric data. The sole exception is the Student Data Privacy Act, K.S.A. 72-6315, which requires written consent before a Kansas public school district may collect student biometric information.

Kansas is one of the majority of U.S. states that have not enacted a dedicated biometric privacy law. If you work in Kansas, use biometric time clocks at your job, or simply wonder whether your fingerprint or face scan data has legal protection, the short answer is: very little at the state level.

This guide covers every Kansas statute that touches biometric data, the limited protections that do exist, federal laws that fill some of the gaps, and what Kansas residents and businesses should know in 2026.

For broader context on how Kansas handles personal data, see our Kansas Data Privacy Laws overview.

Kansas Does Not Have a Biometric Privacy Law

Kansas has not passed any law comparable to the Illinois Biometric Information Privacy Act (BIPA), the Texas Capture or Use of Biometric Identifier Act, or the Washington Biometric Identifier statute. There is no Kansas statute that requires businesses or employers to:

• Obtain consent before collecting fingerprints, facial geometry, iris scans, voiceprints, or other biometric identifiers
• Provide written notice explaining how biometric data will be used or stored
• Establish retention and destruction schedules for biometric records
• Limit the sale or sharing of biometric information with third parties

This means that a private employer in Kansas can generally implement fingerprint-based time clocks, facial recognition access systems, or other biometric tools without any state-mandated consent or disclosure obligations specific to biometric data.

Kansas Breach Notification Law and Biometric Data

The Kansas Protection of Consumer Information Act (K.S.A. 50-7a01 through 50-7a04) requires businesses to notify Kansas residents when a security breach exposes their personal information. However, the law defines "personal information" narrowly. Under K.S.A. 50-7a01(g), protected data elements include only:

• Social Security numbers
• Driver's license or state identification card numbers
• Financial account numbers, credit card numbers, or debit card numbers in combination with security codes or passwords that would allow account access

Biometric data is not listed. A breach that exposes fingerprint templates, facial recognition data, or other biometric identifiers does not trigger notification obligations under this statute.

This stands in contrast to states like California, New York, and Illinois, which have amended their breach notification laws to explicitly include biometric information.

For details on what Kansas's breach law does cover, see our Kansas Data Breach Notification Laws guide.

Student Data Privacy Act: The One Exception

The only Kansas statute that directly addresses biometric data is the Student Data Privacy Act (K.S.A. 72-6312 through 72-6320). The biometric-data provision, K.S.A. 72-6315, was enacted in 2014, though the broader student-privacy framework dates back to 1976.

What the Law Requires

Under K.S.A. 72-6315, no school district may collect biometric data from a student, or use any device or mechanism to assess a student's physiological or emotional state, unless the student (if an adult) or the parent or legal guardian (if a minor) provides written consent.

How Kansas Defines Biometric Data

K.S.A. 72-6313 defines "biometric data" as "one or more measurable biological or behavioral characteristics that can be used for automated recognition of an individual." The statute lists these examples:

• Fingerprints
• Retina and iris patterns
• Voiceprints
• DNA sequences
• Facial characteristics
• Handwriting

Enforcement

The Kansas Attorney General or a district attorney may bring an action in a court of competent jurisdiction to enforce K.S.A. 72-6312 through 72-6319. The injunctive remedy that K.S.A. 72-6317 spells out is narrower than that enforcement power: it authorizes a court to enjoin an educational agency, its employees or agents, or any other entity in possession of student data, from disclosing student data in violation of the act. A violation of K.S.A. 72-6315 is an unconsented collection rather than a disclosure, so the enumerated injunction does not plainly reach it. Complaints about student data privacy violations can be filed with the Kansas Attorney General's office.

This law applies only to school districts, which K.S.A. 72-6313 defines as unified school districts organized and operated under the laws of Kansas. Private and parochial schools are not covered, and K.S.A. 72-6315 does not name the Kansas State Department of Education. It also does not apply to private employers, businesses, landlords, or any other entity.

Kansas Consumer Protection Act

The Kansas Consumer Protection Act (K.S.A. 50-623 et seq.) prohibits deceptive and unconscionable trade practices. While the statute does not mention biometric data by name, the Kansas Attorney General could potentially use these broad consumer protection powers to take action against a business that collects biometric data through deceptive means.

Additionally, K.S.A. 50-6,139b requires any entity that holds personal information to "implement and maintain reasonable procedures and practices appropriate to the nature of the information" and to take "reasonable steps to destroy" records when they are no longer needed. Violations are treated as unconscionable acts under the Consumer Protection Act, and enforcement authority rests exclusively with the Attorney General.

However, no Kansas court has applied these provisions specifically to biometric data as of March 2026.

Federal Laws That Protect Biometric Data in Kansas

Because Kansas lacks a comprehensive state-level biometric law, federal statutes provide the primary protections for Kansas residents in certain contexts.

HIPAA

The Health Insurance Portability and Accountability Act protects biometric data when it is collected or maintained by covered healthcare entities and their business associates. Fingerprints, voiceprints, and facial images qualify as protected health information when linked to a patient's medical records.

COPPA

The Children's Online Privacy Protection Act requires parental consent before websites and online services collect personal information from children under 13. The FTC's rules define personal information to include photographs, videos, and audio files containing a child's image or voice, which can function as biometric identifiers.

FTC Act Section 5

The Federal Trade Commission Act prohibits unfair and deceptive trade practices. The FTC has used this authority to take enforcement actions against companies that mishandle biometric data or make misleading promises about how they protect it. This applies nationwide, including in Kansas.

ADA

The Americans with Disabilities Act may limit how employers use certain biometric collection methods if those methods disproportionately affect employees with disabilities. For example, fingerprint scanners may not work reliably for individuals with certain skin conditions.

What This Means for Kansas Employers

Kansas employers who use biometric technology for timekeeping, access control, or security face no state-specific biometric consent requirements. However, prudent employers should still consider these practical steps:

• Provide written notice before collecting any biometric data, even though Kansas does not require it. This reduces legal risk if Kansas passes a biometric law with retroactive elements or if an employee relocates from a state with stricter requirements.
• Establish a retention policy that specifies how long biometric data will be stored and when it will be destroyed.
• Limit access to biometric databases to authorized personnel only.
• Monitor federal developments, including proposed biometric provisions in federal privacy legislation.

Employers with operations in multiple states must comply with the strictest applicable law. If a Kansas-based company has employees in Illinois, Texas, or Washington, those employees' biometric data is subject to the laws of their respective states.

Legislative Outlook

As of March 2026, the Kansas Legislature has not introduced a dedicated biometric privacy bill during the 2025-2026 session. Kansas also has not enacted a comprehensive consumer data privacy law comparable to those in effect in California, Virginia, or Colorado.

The national trend, however, continues moving toward broader biometric protections. Multiple states introduced biometric privacy bills during 2025 and 2026 legislative sessions, and more than 20 states now have comprehensive privacy laws that include biometric data provisions. Kansas may eventually follow this trend, but no specific timeline exists.

This article is for informational purposes only and does not constitute legal advice. Biometric privacy law is evolving rapidly at both the state and federal levels. Consult a qualified attorney licensed in Kansas for guidance on your specific situation.

More Kansas Laws

• Kansas Deepfake Laws
• Kansas Employee Monitoring Laws
• Kansas GPS Tracking Laws
• Kansas Recording Laws