Mathew PaquetChecklist · 4 min read
The Face Upload Consent Checklist
Before your business runs anyone's face through AI: find every place a face comes in, then put the notice, the written yes and the deletion date on the upload screen, and get your vendor's answers in writing.
Illinois' Biometric Information Privacy Act (BIPA) dates from 2008. It covers fingerprints, voiceprints and a scan of face geometry, and it says in plain words that photographs don't count. So the question is never "did we take a photo?" It's "did our tool measure the face in it?"
That's the claim in the lawsuit filed against Grok's maker on October 7, 2026: that editing or rating a face means locating and measuring it. These are allegations, and no court has ruled. But the law applies to any private business, not just AI companies. A violation can cost $1,000 if it's negligent and up to $5,000 if it's intentional or reckless. Since 2024, scanning the same person the same way counts as one violation.
The consent can't live in a privacy policy. It has to live at the upload button.This isn't legal advice. It's the setup the law describes, made usable.
Start with an inventory. Faces come in through more doors than you think:
Next to each one, write where the face actually goes: your server, your vendor's server, or the person's own phone. It matters. In 2026 a federal appeals court said that when face templates are made and kept only on the user's own phone, the company that wrote the software didn't collect them.
1. Tell people, in writing. What face data you collect, why, and for how long. On the screen where they upload, not on page nine of your terms.
We use it only for [PURPOSE]. We delete the photo and the measurements [WHEN: e.g. when your result is delivered].
Processed by: [YOUR COMPANY / VENDOR NAME].
2. Get a written yes. A clear, separate yes to that exact notice. Since 2024, Illinois counts an electronic signature, so an unticked box next to the notice works; consent buried in a policy doesn't.
3. Publish when you delete it. Illinois wants a public schedule. The deadline is when the purpose is done, or three years after the person's last interaction with you, whichever comes first. For a headshot, that may be the same day.
Today that means: deleted within [NUMBER] days of upload.
If the face lands on your vendor's server, their answers become your promises. Ask in writing:
Before we keep using [TOOL] on our customers' photos, three questions:
1. Do you keep the photos, and the face data made from them? For how long?
2. Do you train your models on them?
3. Will you put both answers in writing in our contract?
Thanks, [YOUR NAME]
No written answer? Treat it as "yes, we keep it" until you have one.
Most state privacy laws now treat biometric data as sensitive, which usually means asking first. The same three steps cover you almost everywhere.
Sources
Mathew's LibraryLibrary card
Keep reading free with your library card
One email opens this checklist and all 3 resources in Mathew's library. No account, no password.
List every place your business takes in a face, and next to each one write whose server the image lands on: yours, your vendor's, or the person's own phone.
Saving works best in your phone's browser. A copy is also in your inbox.