Something about you gets measured every time you unlock your phone with your face. That measurement is biometric data.
Most of us use it daily without a second thought. Yet few people could say what it actually looks like once it’s stored. Fewer still know which of their details the law treats as biometric.
This guide walks through real biometric data examples in plain language. You’ll see what gets captured, what gets kept and where the legal lines fall.
What is biometric data, in plain words?
Biometric data is information about your body or behavior that a machine can use to recognize you. Think of your fingerprint, your face, your voice or even the rhythm of your typing.
The key word is recognize. A blurry holiday photo shows your face. It only becomes biometric data when software measures that face to tell you apart from everyone else.
Our guide to the types of biometrics covers eleven traits in detail. Here we focus on the data those traits turn into.
Biometric data examples: from raw sample to template
Here’s the part most explanations skip. A well-built system doesn’t keep a photo of your finger or your face.
It starts with a raw sample such as a fingerprint image. Then it pulls out only the features it needs and saves them as a template. A template is a compact set of numbers that describes you well enough to match.
Apple puts it neatly. It says Touch ID stores a mathematical representation of your fingerprint and “never images of your finger itself.”
So what does biometric data look like in practice? Here are examples of biometric data for the most common traits.
| Trait | Raw sample | What usually gets stored |
|---|---|---|
| Fingerprint | An image of your ridges | A minutiae template: where ridges end or split and which way they point |
| Face | A photo or a 3D depth map | A faceprint: a list of numbers that describes your face |
| Iris | A close-up of the eye in near-infrared light | An iris code of just 2,048 bits in John Daugman’s classic design |
| Voice | An audio recording | A voiceprint: numbers that describe how you sound |
| Palm vein | A near-infrared image of your hand | A map of the vein pattern under your skin |
| Typing | A log of key presses | A typing profile: how long you hold each key and the gaps between them |
| Signature | Pen movement on a signing pad | Speed and pressure as you sign, not just the shape |
| Gait | Video of you walking | A model of your stride and body movement |
That iris code is tiny. At 2,048 bits it takes up just 256 bytes. That’s about the size of two short text messages.
Why does the template matter to you? A stolen template is harder to misuse than a stolen photo.
But it’s still part of you. You can’t reset a fingerprint the way you reset a password.
Biometric identifiers examples vs biometric information
You’ll often see two terms. A biometric identifier is the trait or scan itself (a fingerprint or a face scan). Biometric information is the data a company builds from it (such as the template).
The difference sounds technical. In court it can decide whether a company broke the law.
The gray areas: is this biometric data?
Some everyday data sits right on the line. These are the cases people ask about most.
Your photos
A plain photo usually isn’t biometric data on its own. It becomes biometric data once software turns your face into a faceprint to identify you.
That’s why a photo on social media and a photo in a face search engine are treated so differently. The picture is the same. What’s done with it isn’t.
Your signature
A scanned signature is just an image. Most laws leave it out.
The way you sign is different. A signing pad that logs your speed and pressure is capturing a behavioral biometric.
Your DNA
DNA identifies people better than almost anything. Yet the law often files it somewhere else.
California lists it as biometric information. The EU treats it as genetic data in a category of its own. Illinois covers it under a separate genetic privacy law.
Your smartwatch
This one surprises people. California’s definition of biometric information includes sleep, health and exercise data when it contains identifying information.
So the data on your wrist may count too. It depends on where you live and how that data is used.
What the law counts as biometric data
Lawmakers keep their own lists of biometric identifiers. They don’t agree with each other. The same scan can be tightly protected in one place and lightly regulated in another.
Illinois: the strict pioneer
Illinois passed its Biometric Information Privacy Act (BIPA) in 2008. It names retina or iris scans, fingerprints, voiceprints and scans of hand or face geometry. It leaves out photographs, writing samples and written signatures.
BIPA lets people sue companies directly. That’s why it has produced so many large lawsuits. In 2024 the state changed the law so that scanning the same person the same way counts as one violation and not one per scan.
California: the widest net
California’s privacy law casts a wider net. It also covers DNA, keystroke patterns and gait patterns. It even includes sleep, health or exercise data that can identify you.
Colorado: the newer model
Colorado added biometric rules to its privacy law from July 1, 2025. They apply to any company of any size that collects biometric identifiers from Colorado residents.
Companies need consent first. They must also delete the data once its purpose is met or within 24 months of your last contact with them.
The European Union: purpose over lists
The EU’s GDPR looks at purpose instead of a list. Facial images and fingerprint data count as biometric data when they result from specific technical processing that identifies someone.
So a holiday photo on its own isn’t biometric data in Europe. A faceprint made from it is.
Side by side
| Example | Illinois (BIPA) | California (CCPA) | European Union (GDPR) |
|---|---|---|---|
| Fingerprint | Covered | Covered | Covered when used to identify you |
| Face scan | Covered | Covered | Covered when used to identify you |
| Ordinary photo | Excluded | Covered if a faceprint can be taken from it | Only when processed to identify you |
| Voice | Covered as a voiceprint | Covered | Covered when used to identify you |
| Written signature | Excluded | Not listed | Not listed |
| Typing rhythm | Not listed | Covered | Can count when used to identify you |
| Gait | Not listed | Covered | Can count when used to identify you |
| DNA | Left to a separate genetic privacy law | Covered | Its own category: genetic data |
It’s fair to ask any company that wants your biometric data which of these rules it follows.
How your biometric data is kept safe (or not)
Where the data lives matters as much as how good the scanner is. The safest designs keep it on your own device.
Your phone is the best example. Face and fingerprint templates stay in a secure chip and never reach the maker’s servers.
Passkeys build on the same idea. Your face or finger unlocks a key on your device and only a cryptographic proof leaves it.
Central databases carry more risk. In 2015 the US Office of Personnel Management said hackers had stolen the fingerprints of about 5.6 million people. Those people could change their passwords but never their prints.
Biometric databases: where the biggest collections live
A biometric database is a large store of templates used to search for people. Governments run most of the biggest ones.
India’s Aadhaar holds fingerprints, iris scans and photos for about 1.34 billion people. The FBI’s Next Generation Identification system launched in 2014 with more than 100 million records. Europe’s Entry/Exit System now logs the faces and fingerprints of visitors from outside the EU.
These systems make identification possible at huge scale. They also make tempting targets. That’s why biometric data security matters so much.
Biometric data security: what good practice looks like
There’s no perfect lock. But well-run systems share a few habits.
- Templates, not raw images. The original scan is thrown away once the template exists.
- Encryption. Data is scrambled both in storage and while it travels.
- Matching on the device wherever possible, so nothing leaves your phone.
- Liveness checks that spot a photo, a mask or a recording.
- Clear deletion dates so data isn’t kept forever.
Our roundup of the uses of biometrics shows how 15 real projects handle this data.
Questions worth asking before you hand it over
- Is my biometric data stored on my device or on your servers?
- Do you keep a raw image or only a template?
- How long do you keep it, and how do I get it deleted?
- Will you share it with anyone else?
- Can I use another option if I say no?
Where people disagree
Supporters say biometric data is safer than passwords in daily use. You can’t forget your face. A stolen phone is useless without it.
Critics focus on what can’t be undone. A leaked fingerprint stays leaked for life. Behavioral data can also be collected without you ever noticing.
Even lawmakers split. Illinois counts a voiceprint but not your typing while California counts both. Europe asks what the data is used for.
You can weigh both sides in our guide to biometrics pros and cons.
Quick answers about biometric data
What is an example of biometric data?
A fingerprint template is a classic example. It records where your ridge endings and splits sit. Your phone stores something like it and not a picture of your finger.
Is a photo biometric data?
Not always. A plain photo usually isn’t. It becomes biometric data once software turns it into a faceprint to identify someone.
Is a voice recording biometric data?
A recording alone often isn’t. A voiceprint built from it to recognize you is. Banks use voiceprints to check callers.
Is a signature biometric data?
A scanned signature usually isn’t. The speed and pressure of your pen on a signing pad is a behavioral biometric.
Can I ask a company to delete my biometric data?
In many places, yes. The EU, California and Colorado all give people rights over their data. Illinois requires companies to publish when they’ll destroy it.
What is a biometric database?
It’s a large collection of biometric templates used to identify or check people. National ID systems, police records and border systems are the biggest examples.
How is biometric data collected?
Most biometric data collection happens through a sensor you touch or look at. Think of a fingerprint pad, a camera or a microphone. Under laws like the GDPR a company usually needs a clear legal reason or your consent first.
How much of you is already stored?
Count them up. A face unlock, a fingerprint at the office and maybe a voice check when you call your bank.
Now the harder questions. Which of these would you happily share with a company?
Which should never leave your own device? And who should decide where the line falls?
Sources
- Apple: About Touch ID advanced security technology
- John Daugman, University of Cambridge: How Iris Recognition Works
- Illinois General Assembly: Biometric Information Privacy Act, 740 ILCS 14
- Illinois General Assembly: Public Act 103-0769 (August 2024)
- California Consumer Privacy Act definitions: Civil Code section 1798.140
- Colorado General Assembly: HB24-1130, Privacy of Biometric Identifiers and Data
- Davis Wright Tremaine: Colorado Privacy Act biometrics updates take effect July 2025
- Regulation (EU) 2016/679: GDPR Article 4, Definitions
- FIDO Alliance: Passkeys
- US Office of Personnel Management: Statement on cyber incident affecting fingerprints (September 2015)
[…] rules differ by place too. Some laws treat a faceprint as sensitive biometric data, as our guide to biometric data explains. Others barely mention […]