On May 18, 2023, the Federal Trade Commission (“FTC”) issued a policy statement warning companies of the ways that collecting and using biometric information, or using biometric information technologies, might amount to an unfair or deceptive practice in violation of Section 5 of the FTC Act.
The policy statement identified several potentially deceptive practices: false or unsubstantiated marketing claims relating to the validity, reliability, accuracy, performance, fairness, or efficacy of technologies using biometric information; and deceptive statements about the collection and use of biometric information. The policy statement also identified several unfair practices that, while not deceptive, might nonetheless violate Section 5, including failing to assess foreseeable harms prior to collection; not addressing known or foreseeable risks; surreptitious collection or use; diligence failures on third party partners; and failing to provide appropriate training.
Although the policy statement purports to represent merely the FTC’s views under existing law, companies that collect or use biometric information should take this enforcement statement—alongside its other privacy-related endeavors—as a sign that the FTC is laser-focused in this area.