This branch of privacy litigation targets what a business collects, uses, and sells or shares, independent of any hack. Consumer privacy statutes modeled on the California Consumer Privacy Act give consumers rights to know what personal information is collected, to delete it, and to opt out of its sale or sharing, and they impose disclosure obligations on covered businesses. Biometric-specific statutes, most prominently Illinois's Biometric Information Privacy Act and its state-law cousins, go further: they generally require informed written consent, a publicly available retention and destruction schedule, and a prohibition on profiting from biometric identifiers such as fingerprints, voiceprints, and facial geometry scans, before collection ever begins. Because these are consent-and-disclosure regimes rather than security regimes, a bare statutory violation, collecting data without the required notice, can itself be actionable in some states even absent any downstream misuse.

The private right of action landscape varies sharply by statute. CCPA-style private rights of action are generally narrow, largely tied to specific security-incident violations, so many collection and sale claims proceed instead through regulator enforcement or overlapping unfair-competition and consumer-protection statutes. Biometric statutes, by contrast, often carry a comparatively broad private right of action, and because damages can accrue per violation or per scan, even a technical compliance gap can generate substantial class exposure. Defenses commonly include statutory exemptions, whether the defendant meets the relevant revenue or data-volume threshold to qualify as a covered business, arbitration clauses in consumer terms of service, and constitutional standing challenges arguing a bare procedural violation is not a concrete injury.

Statutory and per-violation damages structures give these cases class-wide settlement leverage that can be disproportionate to any actual, provable harm, which is precisely what makes the threshold standing fight, whether a bare statutory violation is a concrete Article III injury, so consequential: it decides whether the case is ever resolved on the merits at all. Consent timing is the pivotal fact in biometric cases, since consent obtained after first collection generally does not cure the violation, and per-scan damages exposure scales directly with the size of the affected workforce or customer base, turning even a narrow compliance gap into significant aggregate exposure.