BIPA Consent form — check biometric consent and retention

Six statute gaps sat in a 45-line Python file that a US app team had already fixed once: the consent gate was there, the written release was checked before the first capture, and the audit still returned six findings.

The file is the enrolment path of a face login: face_encodings() on a frame, keep the template, store it, send it to a matching vendor. Nothing exotic. All six findings are lines a statute reaches directly.

RETENTION_DAYS = 1460. BIPA 15(a) requires a written destruction schedule, and its outer limit is three years after the last interaction - 1095 days. The declared value is 365 days over it. Texas CUBI, Tex. Bus. & Com. Code 503.001(c-2), requires destruction within one year, 365 days. One constant, two ceilings, and the code obeys neither.

The template is written to SQLite with no encryption on the value. BIPA 15(e) requires storage using the reasonable standard of care in the industry, and at least as protectively as other confidential and sensitive information. A raw face encoding in a table column is not that.

The template is then posted to a vendor endpoint. BIPA 15(d) bars disclosure or dissemination of a biometric identifier without consent that is specific to the disclosure. The release the user signed at sign-up covered collection, not onward transfer.

The last three findings are not American. The EU AI Act's Article 5 prohibitions have applied since 2 February 2025. Art. 5(1)(f) prohibits inferring emotions from biometric data at work or in education - the file's detect_emotion() call sits in an applicant-scoring function. Art. 5(1)(g) prohibits biometric categorisation inferring race, political opinions, religion or sexual orientation; predict_ethnicity() is that. Art. 5(1)(e) prohibits building face databases by untargeted scraping, which scrape_face_urls() does. These are prohibitions, not risk tiers.

None of this is a style question, so a formatter has no opinion on it: it has no concept of a written release and cannot tell a hashed template from a raw one. A chatbot will summarise BIPA fluently without reading your file, without line numbers, and drifts on which subsection and which effective date apply. The dates are the part that moves: Colorado's HB24-1130 duties took effect 1 July 2025, the EU prohibitions on 2 February 2025.

What the numbers are worth: BIPA sets liquidated damages of $1,000 for each negligent violation and $5,000 for each intentional or reckless one, plus attorney's fees, and Illinois courts read a violation per person. Texas CUBI is enforced by the Attorney General at up to $25,000 per violation. EU AI Act penalties for a prohibited practice reach EUR 35 million or 7% of worldwide annual turnover.

The audit is 14 rules, offline, on the file. Two are arithmetic rather than pattern matching: the retention rule reports how many days a constant is over each ceiling, and the destruction-window rule compares a hardcoded enrolment date with the audit date. The same file, audited as of 22 September 2026, returns six findings; as of 1 June 2027 it returns seven, because the enrolment date in the file has by then passed the three-year window.

On the fixed version of the same service the audit returns zero findings: retention at 365 days, the template encrypted before the insert, the vendor call removed, the prohibited calls gone. One file, six lines, each with its subsection, in the editor, before the review.

A pre-launch review of biometric code by US privacy counsel bills at roughly $400 to $600 an hour.