At the Federal Trade Commission (FTC) Open Meeting on May 18, 2023, a new Biometric Policy Statement was unanimously adopted. It outlines how the FTC plans to pursue violators of FTC Act Section 5, deceptive or unfair business practices, involving biometric data. 

The FTC defines biometric information broadly to include, "data that depict or describe physical, biological, or behavioral traits, characteristics, or measurements of or relating to an identified or identifiable person’s body... depictions, images, descriptions, or recordings of an individual’s facial features, iris or retina, finger or handprints, voice, genetics, or characteristic movements or gestures (e.g., gait or typing pattern)...and data derived from such depictions, images, descriptions, or recordings, to the extent that it would be reasonably possible to identify the person... a photograph of a person’s face and a facial recognition template, embedding, faceprint, or other data."

The FTC warns it intends to pursue deceptive biometric business practices including (1) making false or unsubstantiated "marketing claims relating to the validity, reliability, accuracy, performance, fairness, or efficacy of technologies using biometric information," and (2) "deceptive statements about the collection and use of biometric information...the extent to which they collect or use biometric information or whether or how they implement technologies using biometric information... [and] telling half-truths, make an affirmative statement about some purposes for which it will use biometric information but fail to disclose other material uses of the information."

The FTC also warns it will pursue unfair biometric business practices including  "failing to assess foreseeable harms to consumers before collecting biometric information... failing to promptly address known or foreseeable risks... engaging in surreptitious and unexpected collection or use of biometric information...failing to evaluate the practices and capabilities of third parties... failing to provide appropriate training for employees and contractors... [and] failing to conduct ongoing monitoring of technologies that the business develops, offers for sale or uses in connection with biometric information." 

Finally, the FTC noted a business practice "need not be equally likely to harm all consumers in order to be considered unfair... the Commission will—and businesses should—consider the practices from the perspective of any population of consumers that is particularly at risk."