“BIPA, Biometric Risk & State Privacy Enforcement: What U.S. CPOs and Privacy Officers Must Fix”
Participants Profile
- Chief Privacy Officers, Heads of Privacy, Privacy Officers, General Counsel, Compliance VPs
- Operating in companies that collect or process biometric data (e.g., fingerprints, facial geometry, voiceprints) for employees, customers, or users.
- Based in or serving customers in Illinois, Texas, or Washington or national companies with multi-state operations.
Advantages
- Immediate Regulatory Clarity: Participants gain a precise understanding of Illinois BIPA, Texas CUBI, and Washington Biometric laws, including real enforcement cases and penalties. Eliminates uncertainty around what constitutes a violation and where the organization is most exposed.
- Actionable Risk Mitigation: Provides a step-by-step roadmap to fix consent, retention, and vendor practices.Participants leave with checklists and frameworks they can implement immediately to reduce legal exposure.
- Board & Executive Communication Readiness: Equips CPOs and Privacy Officers to report biometric risks clearly and defensibly to boards, executives, and legal teams.Strengthens the organization’s risk governance and reputation protection strategy.
Goals
- Understand the real enforcement landscape under Illinois BIPA, Texas CUBI Act, and Washington Biometric Identifiers Law, what is enforceable, by whom, and how.
- Recognize core compliance failures leading to high-value settlements and lawsuits (Meta, BNSF, White Castle, etc.).
- Identify organizational processes and vendor practices that expose companies to biometric liability.
- Develop a remediation checklist for biometric collection, consent, retention, and data destruction.
- Gain the tools to communicate risk and corrective action to boards and executive teams.
Course Contents
| Module | Focus / Topics |
|---|---|
| Module 1: Understanding U.S. Biometric Laws | Federal landscape vs state patchwork. Detailed mapping of Illinois BIPA, Texas CUBI, Washington Biometric Law. Clarifying what “biometric identifiers” legally mean. |
| Module 2: Anatomy of Enforcement | Deep dive into real enforcement cases: • Rogers v. BNSF Railway (2024 settlement $75 M) • Meta Texas Settlement ($1.4 B) • White Castle v. Cothron (per-scan liability) Case dissection: violations, evidence, penalties. |
| Module 3: Compliance Gaps & Risk Triggers | Common failure points in consent collection, third-party processors, employee time-tracking systems, and retention policies. How vendor platforms create hidden biometric exposure. |
| Module 4: Litigation Lessons for CPOs | Why BIPA allows private right of action. The litigation pipeline from claim to settlement. Calculating exposure. Comparing AG-enforced vs class-action-driven models. |
| Module 5: Building a Biometric Compliance Program | Drafting compliant notices & consent forms; retention and destruction schedules; privacy-impact assessments for biometric systems; AI and facial-recognition overlays. |
| Module 6: Action Planning & Q&A | Live discussion: “What to fix first?” participants outline next-day actions for their organizations. Instructor provides model checklist and sample compliance templates. |
Instructor
Name: John P. Fortwise
U.S.-based privacy compliance expert with over 15 years of experience advising corporations on biometric data, employee privacy, and state-level privacy regulations. He has led BIPA and CUBI compliance programs for Fortune 500 companies, conducted internal audits, and represented clients in state enforcement matters. He frequently speaks at privacy conferences, publishes thought leadership on biometric risk management, and has developed corporate training programs that translate complex regulatory requirements into actionable executive strategies.
Format, Cost, Date & Inclusions
Format: Live. Online via Zoom
Price: $95
Duration and date: 2 and 1/2 hours from 2:00 to 4:30 pm ET, November 12, 2025
Includes:
- Certificate of Completion
- Course PDF Materials
- Access to recordings / supplementary resources
- Q&A session