A Video Editor's Guide to BIPA, GDPR, and Facial Recognition Compliance

Face recognition and speaker identification in video tools bring biometric privacy law into a video team's workflow. This post covers the laws that apply and what they require. It is not legal advice. We build a tool that runs face and voice recognition, so we have had to learn the rules.

What counts as biometric data?

Biometric data is any measurement of a physical or behavioural characteristic that can identify a person. In video production the relevant types are:

Faceprints. The mathematical representation a face recognition system creates from someone's face. It is the computed template, not the photo.
Voiceprints. Similar to faceprints but derived from someone's voice. Speaker diarization and voice matching systems generate these.
Gait patterns, iris scans, fingerprints. Less common in video editing tools but covered by the same laws.

A photo of a face is generally not biometric data. Running it through a face recognition model to make a faceprint creates biometric data under most of these laws. A video tool that clusters faces or identifies speakers is creating biometric data.

BIPA: Illinois' Biometric Information Privacy Act

BIPA is the strictest biometric privacy law in the United States.

Key requirements:

Written consent before collection. You must inform someone in writing that their biometric data is being collected, explain the purpose, and get their written consent before indexing.
No sale or profit from biometric data. You cannot sell, lease, trade, or otherwise profit from someone's biometric data.
Retention and destruction policy. You must have a publicly available written policy for how long you retain biometric data and when you destroy it.
Reasonable security. You must protect biometric data at least as carefully as you protect other confidential information.

BIPA has a private right of action. Individuals can sue directly, and damages are $1,000 per negligent violation and $5,000 per intentional or reckless violation. Facebook settled a BIPA class action for $650 million and Google for $100 million. Clearview AI and BNSF Railway have also lost BIPA cases.

BIPA applies if any person in the footage is an Illinois resident, regardless of where your company is based or where the indexing happens.

GDPR: General Data Protection Regulation

The EU's GDPR classifies biometric data as a special category of personal data, with the strictest protections.

Key requirements:

Explicit consent or limited exceptions. Processing biometric data requires explicit consent or must fall under a narrow list of exceptions (employment law, vital interests, etc.). Legitimate interest is generally not enough for biometrics.
Data minimisation. Process only what you need. If detecting faces is enough, do not store faceprints.
Right to erasure. Individuals can request deletion of their biometric data.
Data protection impact assessment. Systematic biometric processing usually requires a formal assessment.

GDPR applies to anyone processing data of EU residents. If your footage includes people from the EU, or if your team is in the EU, GDPR governs how you handle face and voice recognition. Fines can reach 4% of global annual revenue.

Other laws to know about

Other jurisdictions:

Texas CUBI (Capture or Use of Biometric Identifier Act). Similar to BIPA but enforced by the state attorney general rather than private lawsuits. Texas recently secured a $1.4 billion settlement against Meta over biometric data practices.
Washington state biometric identifier law. Requires consent for commercial use of biometric data.
Colorado, Connecticut, Virginia, and other state privacy laws. Several US states have privacy laws that cover biometric data.
Canada's PIPEDA and provincial laws. Canada treats biometric data as sensitive personal information requiring meaningful consent.

More jurisdictions add biometric rules each year.

What it means for a video team

Consent

Before processing footage through face or voice recognition, you need consent from the people in the footage. For corporate videos where talent signs releases, add biometric data collection to the release. For documentary or event footage, where consent from everyone on screen is impractical, decide whether face recognition is needed on that footage at all.

Storage and security

Every major regulation asks where biometric data is stored and who can access it. Cloud processing adds the questions of which jurisdiction the servers are in and how long the data is retained.

Retention policies

Do not keep biometric data longer than you need it. Set a retention period, write it down and delete face clusters when a project wraps.

Vendor responsibility

Using a third-party tool does not move the whole burden to the vendor. As the data controller, the party deciding to process the footage, you share responsibility.

How FrameQuery handles biometric data

Processing is ephemeral. When FrameQuery processes your footage, it extracts frames and audio on your device and sends only those to our servers for AI analysis (transcription, scene detection, scene captions, and object detection). Originals stay on your machine and the extracted data is discarded when analysis completes. Face and voice recognition run on your device, and the embeddings are stored only in your local index.

Your data stays on your machine. The search index, including any face clusters and voice data, lives on your local disk. We do not have a copy.

Deletion. Delete the local index file or remove entries from it.

Sharing never includes biometrics. When you share or export an index, face embeddings, voice embeddings and person labels are stripped. Descriptions, transcripts, tags and timestamps travel with it. If a recipient has access to the underlying footage, they can run their own recognition locally and label people themselves.

You still need consent, a retention policy and a view on which laws apply. On-device processing removes the case where your biometric data sits on a vendor's servers.

Steps

Talk to a lawyer. This post is an overview. Commercial biometric processing needs counsel.
Update your talent releases. Add language about biometric data processing if you use face or voice recognition in your workflow.
Document your practices. Write down what biometric data you collect, why, how you store it, and when you delete it. BIPA specifically requires a publicly available written policy.
Choose tools carefully. Understand where your tools send data and what they retain. A cloud platform that stores faceprints carries a different risk from a tool that keeps them on your disk.
Minimise what you collect. If a project does not need face recognition, do not run it.

Download FrameQuery to run face and voice recognition on your own machine.