Business establishments in Erie County, N.Y., are no longer allowed to have customer biometric information.

The Biometrics Transparency and Privacy Act, Local Law No. 1-2026 (2026), prohibits commercial establishments in Erie County from collecting, storing, procuring, using, selling, or otherwise monetizing customer biometric data. Any businesses in possession of customer biometric as of June 5, 2026, has 30 days to provide a written disclosure notice to the Director of Consumer Protection detailing the amount and type of biometric data it has, and a detailed destruction policy stating the method and timing of the permanent deletion/destruction of that biometric data. The notice must also be prominently displayed in the business establishment. The deletion/destruction must occur within 30 days of the notice, certified by a sworn affidavit. Forms for required notice, certification of destruction, and request for exception, are available from the county. 

Civil penalties range from $1,000 - $5,000 per day for each violation. 

Under the new law, biometrics include data that depicts or describes “physical, biological, or behavioral traits, characteristics, or measurements of or relating to a person's bodily identity regardless of how it is captured, converted, stored, or shared.” It can include photographs or video, facial features, iris or retina, fingerprint or handprint, voice, genetics, or characteristic movements or gestures, including gait or keyboard typing patterns.

The director of the county's Department of Public Advocacy Division of Consumer Protection will enforce the new law and may refer matters to the county attorney's office and/or the New York State Attorney General.

Exceptions to the new law are narrow, only as may be required of the business establishment to comply with federal, state, or local law. A person's own personal or employer-issued devices, such as face recognition to open a smart phone or social media application, are not affected by this law. Government operations and financial institutions are also not within the definition of business establishment under this new law. A business with photo or video recording devices that do not analyze biometric data, such as a basic security camera, and do not share the images with others, will also be outside the purview of this law.