Sources
Texas Capture or Use of Biometric Identifier Act (Business and Commerce Code 503.001)
Law. Placed at Texas. Read 30 Sep 2026; 4 provisions cited by the planner.
Texas CUBI 503.001(b)(1)Inform the individual before capturing a biometric identifier
A person may not capture an individual's biometric identifier for a commercial purpose unless the person informs the individual before the capture.
What a reviewer asks to see: Inventory of systems that capture fingerprints, face geometry, hand geometry, iris or retina scans or voiceprints (time clocks, access control, call analytics); Notice text shown or given to employees and others before enrolment, with the enrolment date for each individual
Where monitoring plans usually fall short: Biometric time clock enrolled on day one without prior notice; Voiceprint features in a call platform switched on without anyone being told
Texas CUBI 503.001(b)(2)Obtain the individual's consent before capture
The person must also receive the individual's consent to capture the biometric identifier before capturing it for a commercial purpose. Under (b-1), added in 2025, the fact that an image or other media containing the individual's biometric identifiers is on the internet or another public source does not mean the individual was informed or consented, unless the individual personally made it public.
What a reviewer asks to see: Consent record per individual (signed form or logged electronic consent) dated before enrolment; Process for individuals who decline, such as a badge or PIN alternative for the time clock; Review note confirming no identifiers are derived from images scraped from public sources without consent
Where monitoring plans usually fall short: Consent inferred from continued employment; Face templates built from social media or public photos
Texas CUBI 503.001(c)(3)Destroy within a reasonable time, at the latest one year after the purpose expires
The holder must destroy the biometric identifier within a reasonable time, and no later than the first anniversary of the date the purpose for collecting it expires, except where (c-1) applies.
What a reviewer asks to see: Retention schedule entry for biometric identifiers keyed to the expiry of the collection purpose; Destruction records (date, individual, system) including backups
Where monitoring plans usually fall short: Templates kept indefinitely after the purpose ended; Deletion in the application but copies left in backups or the vendor cloud
Texas CUBI 503.001(c-2)Employer security identifiers: purpose ends with the employment
Where an employer collected a biometric identifier for security purposes, the purpose for (c)(3) is presumed to expire when the employment relationship ends, so the one-year destruction period runs from termination.
What a reviewer asks to see: Offboarding checklist step triggering deletion of the leaver's biometric template; Report matching leavers to template destruction dates within one year of termination
Where monitoring plans usually fall short: Leavers' fingerprints kept in the access-control system for years; Deletion depends on a manual request that offboarding never sends
Open the full text on compliance.theartofservice.com
See the specimen plan run Plan your own list