Biometric Privacy Enforcement in Texas and what the Meta Settlement Means for Businesses

The Texas Attorney General’s recent $1.4 billion settlement with Meta Platforms over alleged violations of the Texas Capture or Use of Biometric Identifier Act (“CUBI”) has sent shockwaves through the business community. This historic agreement, the largest-ever biometrics settlement to date, underscores the state’s commitment to aggressively enforcing its data privacy laws. As Texas ramps up oversight with its newly established data privacy unit, businesses must reassess their compliance with biometric and data privacy laws to mitigate potential liabilities. The Capture or Use of Biometric Identifier Act (“CUBI”), enacted in 2001, is one of the earliest biometric privacy laws in the United States. CUBI governs how businesses collect, use, and store biometric identifiers, which include fingerprints, voiceprints, facial recognition data, and records of hand or face geometry. While CUBI shares similarities with Illinois’s Biometric Information Privacy Act (“BIPA”), such as requiring notice and consent before collecting biometric data and mandating security measures, it is enforceable exclusively by the Texas Attorney General, rather than private citizens.