Biometric Timeclocks in Texas

Fingerprint and face-geometry timeclocks bring an employer under the Texas Capture or Use of Biometric Identifier Act (CUBI): notice and consent before enrollment, reasonable care, limits on disclosure, and destruction within a year after the purpose ends. The Attorney General can seek up to $25,000 per violation.

What the law requires

A fingerprint clock, face-geometry reader, voiceprint system, or iris scanner captures a biometric identifier, which CUBI defines as a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry (Bus. & Com. Code §503.001(a)(2)). CUBI applies when an identifier is captured for a commercial purpose, a term the statute does not define; an employer should assume a timeclock qualifies.

Notice and consent. Before capturing an identifier, the employer must inform the worker and receive the worker's consent (§503.001(b)). The statute does not require a separate signed form, but written consent is the best proof.

Disclosure. The employer may not sell, lease, or otherwise disclose the identifier unless the worker consents to disclosure for identification after disappearance or death, the disclosure completes a financial transaction the worker requested, a federal or state statute requires or permits it, or it is made to law enforcement under a warrant (§503.001(c)(1)).

Care. The employer must store, transmit, and protect the identifier with reasonable care and at least as protectively as its other confidential information (§503.001(c)(2)).

Destruction. The employer must destroy the identifier within a reasonable time and no later than one year after the purpose for collecting it expires (§503.001(c)(3)). If the identifier is tied to a record another law requires the employer to keep, the deadline runs from the end of that retention period (§503.001(c-1)). For identifiers collected for security purposes, the statute presumes the purpose expires when employment ends (§503.001(c-2)); a timekeeping template's purpose ordinarily ends then as well.

The Attorney General enforces CUBI and may recover civil penalties of up to $25,000 per violation (§503.001(d)). The statute gives workers no private right of action. The 2026 amendments by HB 149 concern online images and artificial intelligence and do not change these timeclock duties.

The TDPSA does not apply. The Texas Data Privacy and Security Act exempts data processed or maintained in the course of a person's applying for, holding, or performing a job (§541.003(15)), so CUBI is the Texas statute that governs employee timeclocks.

Related topics

• Sensitive Data and Biometric Privacy in Texas
• Employee Information and Workplace Monitoring
• AI Training Data, Texas Privacy, and Trade Secrets
• What Is CUBI

Sources and legal update

• Texas Business & Commerce Code §503.001
• Texas Business & Commerce Code §541.003(15)

Current through October 12, 2026.

This material is for general information and is not legal advice. Law and enforcement practice change. Consult counsel about specific facts.