Schools have adopted biometric systems for practical reasons: a fingerprint moves a lunch line faster than a PIN, a face scan marks attendance without a roll call, and building access controls are easier to manage without keys. The privacy question is not whether these are convenient — they are — but that biometric identifiers are permanent in a way other credentials are not. A compromised password gets changed; a compromised fingerprint template does not.
State law is doing most of the work here
There is no comprehensive federal law governing biometric data generally. Several states have enacted biometric privacy laws that typically require notice and consent before collecting biometric identifiers, limit how long they may be retained, and restrict selling or disclosing them. A number of states have also passed laws specifically addressing biometrics in schools, in some cases restricting or prohibiting facial recognition in K-12 settings.
Because those laws differ so much, the practical question for a family is which regime applies where they live — and the district itself should be able to answer that, since it had to comply with it in order to install the system.
FERPA may cover the record even where no biometric law does
Biometric information a school maintains about an identifiable student can fall within FERPA's definition of an education record, which brings with it the rights our article on school records describes: to inspect the record, to seek amendment, and limits on disclosure to third parties.
That matters most for the vendor question. These systems are almost always run by an outside company, so the useful things to ask are what the vendor receives, whether raw images or only a mathematical template are stored, where the data is held, how long it is kept after a student leaves, and whether the contract permits the vendor to use the data for anything of its own.
Questions worth asking, and whether opting out is possible
Ask the district, in writing: what specifically is collected and stored; is participation optional and what is the alternative; who is the vendor and what does the contract permit; what is the retention and deletion schedule; has the system been assessed for accuracy across different groups of students; and what happens in the event of a breach.
That accuracy question is not hypothetical. Federal testing of facial recognition algorithms by the National Institute of Standards and Technology has documented differences in error rates across demographic groups, which in a school setting means the burden of a misidentification does not fall evenly. A district should be able to say what it knows about the system it chose — and a non-biometric alternative, like a card or a PIN, is a reasonable thing to ask for.
Remember this
- Biometric identifiers are permanent — a compromised fingerprint template cannot be reset like a password.
- There's no comprehensive federal biometric law; several states regulate this and some restrict facial recognition in K-12 specifically.
- Biometric data a school holds about an identifiable student can fall under FERPA as an education record.
- Ask in writing about the vendor, retention, breach plans, accuracy across groups, and whether a non-biometric alternative exists.
Sources
This article provides general educational information, not individualized legal advice. KidsKnowRights is not a law firm, and reading this article does not create an attorney-client relationship. Laws vary by state, age, and circumstances, and they change over time. For advice about a real situation, talk with a licensed attorney or a legal aid organization.