Biometric time clock consent form: what it must say

Yes, you can put a fingerprint time clock in the break room. Illinois requires two documents before the first scan: a signed consent form from each employee and a public retention policy.

This page gives you both, ready to adapt, plus what to do when an employee says no and the record that proves the order of events.

Most of what ranks for this search is published by someone selling a time clock, a form builder, or a payroll platform. We sell none of those. This is an explainer, so have employment counsel adapt the forms to your states before anyone signs.

Are biometric time clocks legal?

Yes, in every state. What changes from state to state is the paperwork, and in New York, whether you can make the scanner mandatory.

If you run clocks in several states, build the consent form to Illinois, which asks for the most in writing, then check retention and mandatory use state by state. The biometric law tracker in the resources below keeps the current list.

What a biometric time clock consent form must say

Start with the text the form has to satisfy. This is Illinois Section 15(b), in full:

Read closely, that gives the form four jobs:

1. Name the identifier. "Fingerprint" or "hand geometry scan." Naming the real one ends any argument about what the employee agreed to.
2. State the specific purpose. The statute says "specific." For a time clock: recording hours worked and running payroll.
3. State the length of term. How long you keep it, as a rule someone can apply, matching your retention policy.
4. Get the signed release, dated. The statute says "first." The date on the signature is how you show the order.

Since August 2, 2024, the definition of "written release" in Section 10 includes an "electronic signature," so the release can be signed on a screen.

Copy-and-paste consent form for a biometric time clock

Fill in the blanks, then have counsel adapt it before anyone signs.

Notice and Consent: Biometric Time Clock

• Employer: ______________________
• What we collect. The Employer's time clock collects a biometric identifier: a scan of your fingerprint. The clock converts the scan into a template it uses to match you each time you punch in or out.
• Why. The Employer uses this identifier only to record your hours worked and to run payroll.
• How long. The Employer keeps the identifier until that purpose is satisfied or three years after your last interaction with the Employer, whichever comes first. When your employment ends, the Employer will permanently destroy it within ____ days. Our retention and destruction policy is published at: ______________________
• Who else handles it. The Employer will not sell, lease, trade, or otherwise profit from your identifier. Our timekeeping vendor, ______________________, processes it under a written contract. It is disclosed to no one else unless the law requires it.
• If you would rather not use it. You may ask for a non-biometric way to record your time, such as a PIN or a badge. Contact: ______________________
• Your consent. I have read this notice. I agree that the Employer and its timekeeping vendor may collect, store, and use my fingerprint template as described above.
• Name: ____________ Signature: ____________ Date: ____________

Four notes before you print it:

• Describe your actual system. Ask the vendor what the clock stores and where, and edit the first paragraph to match.
• The vendor line does real work. Section 15(d) bars disclosure without consent, and the vendor that processes templates is a recipient. Colorado also requires you to say whether a processor gets the identifier and why (6-1-1314(4)(a)(IV)).
• Keep the destruction window short. Texas sets a ceiling of one year after the purpose expires (503.001(c)(3)). Colorado's deletion guidelines run from the date the purpose is satisfied (6-1-1314(2)(a)(III)).
• The alternative paragraph goes beyond 15(b). Keep it. New York law and any religious or disability objection can require an alternative, and a dated form that offered one is evidence you did.

The second document: a public retention policy

The consent form satisfies 15(b). Section 15(a) is a separate duty with its own document:

Two things catch employers. The policy must be "made available to the public," so post it where anyone can read it. And the second sentence binds you to your own schedule: a policy promising 30 days, next to a clock still holding a former employee's template two years later, is a problem written in your own words.

This duty gets pleaded. The complaint in Tims v. Black Horse Carriers, Inc., 2023 IL 127801, involved "a fingerprint authentication time clock." It led with the claim that the company "failed to institute, maintain, and adhere to a publicly available biometric information retention and destruction policy required under section 15(a)" (¶ 7).

A starting policy, short enough to post:

Biometric Data Retention and Destruction Policy

• Employer: ______________________ Effective date: ____________
• We use fingerprint time clocks to record hours worked and run payroll. We keep each employee's fingerprint template only while it serves that purpose. We permanently destroy it within ____ days after employment ends, and in every case within three years of the employee's last interaction with us. We do not sell, lease, trade, or otherwise profit from biometric data. Questions: ______________________

Can an employee refuse to use a fingerprint time clock?

They can always decline to sign. Whether you can make signing a condition of the job depends on the state.

• Illinois: yes. Section 10 defines a written release to include "a release executed by an employee as a condition of employment." The duty is the order of events: release first, scan second.
• Colorado: yes, for the workday. An employer "may require as a condition of employment" consent to "record the commencement and conclusion of the employee's full work day, including meal breaks and rest breaks in excess of thirty minutes" (6-1-1314(6)(a)(II)). For other uses, you cannot require consent or retaliate against someone who declines (6)(b).
• New York: no. Labor Law 201-a says "no person, as a condition of securing employment or of continuing employment, shall be required to be fingerprinted," subject to its exceptions.
• Everywhere: accommodation law. A sincere religious objection or a disability that affects the scan can require an alternative under Title VII or the ADA, whatever the biometric statute says.

The public record on that last point is EEOC v. Consol Energy, Inc., 860 F.3d 131 (4th Cir. 2017). In 2012 a West Virginia coal mine installed a hand scanner to monitor attendance and work hours. A miner of 37 years objected on religious grounds.

The company already let two employees with hand injuries type a personnel number into a keypad, and its own trial witness said the keypad cost nothing. One email dated July 25, 2012 approved the keypad for them and denied it to him: "make our religious objector use his left hand." He retired under protest. A jury awarded $150,000 in compensatory damages, the district court added $436,860.74 in front pay, back pay, and lost benefits, and the Fourth Circuit affirmed.

What you owe the employee who says no

Offer the alternative you already use somewhere: a PIN, a badge, a sheet a supervisor signs. Consol's loss turned on a keypad that already existed. Send the objection to HR, since the manager who wants the clock running is the wrong person to decide it.

Then write down three things, each dated: that you offered the alternative, what the employee chose, and who approved it. That leaves a short, boring file, which is what you want.

What Cothron v. White Castle means for a time clock

Two Illinois Supreme Court decisions from February 2023 came out of employee fingerprint systems. Tims was the time clock case, and it held that the five-year limitations period "controls claims under the Act" (2023 IL 127801, ¶ 42). Cothron v. White Castle System, Inc., 2023 IL 128004, involved employees scanning fingerprints "to access their pay stubs and computers" (¶ 4). The plaintiff alleged White Castle did not seek her consent "until 2018, more than a decade after the Act took effect" (¶ 6).

The court held that a separate claim accrued with every unconsented scan (¶ 1). White Castle estimated that with as many as 9,500 current and former employees in the class, damages "may exceed $17 billion" (¶ 40). The court said concerns about excessive awards "are best addressed by the legislature" (¶ 43). The legislature capped recovery in 2024, and the Seventh Circuit applied the cap to pending cases in Clay.

A time clock has the same shape as White Castle's system: the same finger, scanned at every punch.

What changed in 2024, and what did not

Public Act 103-769 took effect August 2, 2024. It added this to Section 20:

In Clay v. Union Pacific Railroad Co., No. 25-2185 (7th Cir. Apr. 1, 2026), the court held "that this amendment to BIPA Section 20 applies retroactively to cases pending at the time it was enacted." Two of the three consolidated cases involved time clocks: "John Gregg and Brandon Willis each allege their employers collected their fingerprints or hand geometry through a 'biometric time clock,'" the opinion says.

Clay himself alleged about 1,500 fingerprint scans. At the $5,000 reckless rate, 1,500 scans counted one by one would have come to $7.5 million for one man. Under Section 20(b), he is entitled to at most one recovery.

Read the opinion before relying on any summary, including mine. What stayed the same:

• The duties. Section 15 still carries its 2008 text.
• The rates. $1,000 per negligent violation and $5,000 per intentional or reckless one, plus attorneys' fees (740 ILCS 14/20(a)).
• The right to sue. Employees still bring these cases themselves.
• The window. Five years, under Tims.

Four hundred employees enrolled without a release are 400 Section 15(b) claims. At up to $1,000 each that is $400,000, or $2 million at the reckless rate, before fees. The multiplier shrank. The obligation stayed.

The enrollment record that decides the case

Pick an employee enrolled on your clock in 2022. Could you produce their signed release, dated before their first scan? If they have left, could you show their template was destroyed on your schedule? With a five-year window, that enrollment can still anchor a claim filed today.

Answering takes two dates from two systems. The signed form sits in a personnel file or an HR platform. The first scan sits in the clock's database, often on the vendor's side. Nothing joins them unless you join them, and 15(b) turns on their order.

What holds up is a record that ties four dated events to one employee: the release, the enrollment, the alternative offered, and the destruction after separation.

That is the record Clavira produces: a tamper-evident receipt for each event, from consent captured to template destroyed. We record metadata about the event and never see, store, or process the fingerprint itself. Each receipt follows BES-1, our published evidence standard. The result is a court-defensible record of what your organization did, built so it can be handed to the person it concerns.

The BIPA readiness checklist and the biometric audit trail checklist in the resources below cover the consent file and the record structure. None of this is legal advice. Have counsel review both documents before anyone signs. Then ask counsel a second question: three years from now, what will prove this employee signed before we scanned them?

That answer is the one that matters.