Biometric Data: Definition and Security Concerns

Topics

Security

TL;DR

Biometric data uses unique physical traits — like fingerprints, facial structure, and iris patterns — or behavioral signals — like typing speed and mouse movement — to verify identity. While biometric systems offer stronger security than passwords (since physical traits can't be guessed), they also carry irreversible risks: stolen biometric data cannot be changed. Until comprehensive legal protections exist, individuals should limit what they share, keep devices updated, and monitor accounts for suspicious activity.

Understanding biometric data and how it works

What is biometric data? Information about who you are (not what you know) is part of your biometric data backdrop.

Chances are, you've used a system like this before. More than 60 percent of companies use some kind of biometric data to protect their assets. If you've ever used your fingerprint to open your phone or you've looked into a camera to unlock a door, you've tapped into biometrics.

What types of biometric data exist?

When companies agree to use biometric information, they tend to collect one of two different types of data.

Physical Biometric Data	Behavior-Based Biometric Data
Facial structure. Cameras capture the pattern of your face, including eye and lip size and shape.	Typing. Keyboards measure your speed, accuracy, or strength.
Eye appearance. Cameras capture the size and pattern of the iris.	Physical movements. Cameras can capture how you walk or gesture.
Fingerprints. Computers assess the patterns on one or several fingers. Scanners can be large enough to accept a palm or small enough to fit on a smartphone.	Digital movements. How quickly you move your mouse or how hard you touch a screen is measured by the devices.
Voices. Microphones measure your voice's sound waves.	Digital patterns. Computers can measure when you're typically online, the websites you open first, or the things you say online.
DNA. Samples of your hair, blood, or saliva move through computers for analysis.

Notice that biometric data doesn't necessarily have to do with the way you look, your culture, or your gender. Instead, think of these measurements as unique data identifiers computers can use to distinguish between people.

What is a biometrics system?

Companies must do more than simply gather biometric data. Companies must also somehow analyze the information and make decisions. Enter biometrics systems.

Typically, these systems consist of:

Collection devices. Scanners, microphones, or cameras gather biometric data.
Storage. You sit for a master recording (so the computer knows how to identify you), and that information is saved.
Software. A computer interface connects the device to the storage.

In a typical deployment, you'll offer some kind of biometrics data. The collection device will send that information to the storage and compare the two. If there's a match, your access is granted.

How are biometrics systems used in practice?

Systems like this are used in some law enforcement agencies. They might take fingerprints at a crime scene, and they might ask suspects to offer comparison prints for a match.

But plenty of private companies, such as Apple, also take this data. Apple's developers say using biometrics data makes information secure. While hackers can guess a password, no one can guess a fingerprint or iris scan.

Who will protect your biometric data?

If a hacker steals your password, you can replace it. But what happens when someone steals your fingerprint or your DNA? Your exposure is permanent and irreparable.

What happens when biometric data is stolen?

Unfortunately, biometric data can be stolen. In fact, researchers proved that when they hacked into a database of more than 27 billion fingerprints and face scans.

Some states, including Illinois, offer legal protections. If your data is stolen, you can go after the company that exposed it and ask for reparations. Other states, including Texas and Washington, have similar laws on the books, and other states are looking into the idea.

But until we have sweeping laws, consumers must be careful. That's not always easy. If you use your fingerprint to unlock your phone hundreds of times per day, it's easy to forget the real risks and challenges of sharing your biometric data.

But unless you are sure your data is protected, it's wise to be cautious. You can:

Limit. Think carefully before you allow companies like Apple or Facebook to store your biometric data. Opt out if you're unsure.
Update. Keep your operating systems and security scanners up-to-date on any device that stores biometrics.
Monitor. Watch bank accounts and other secure data sources carefully. If you spot unusual activity, act as quickly as you can.

If you're looking for more information on biometrics and security, check out this blog post.

Frequently asked questions

What makes biometric data different from a password?

Unlike passwords, which are something you know and can be changed if compromised, biometric data is tied to your physical traits or behavioral patterns — things that are permanent and unique to you. This makes biometrics harder to guess but also impossible to replace if stolen.

What are the two main categories of biometric data?

Biometric data falls into two categories: physical data (such as fingerprints, facial structure, iris patterns, voice, and DNA) and behavior-based data (such as typing speed, physical movements, digital navigation patterns, and how you interact with a touchscreen).

How does a biometrics system actually work?

A biometrics system has three core components: a collection device (like a camera, scanner, or microphone), a storage system that holds your reference recording, and software that connects the two. When you present your biometric data, the system compares it to the stored record and grants access if there's a match.

Can biometric data be stolen?

Yes. Researchers have demonstrated this by successfully accessing a database containing over 27 billion fingerprints and face scans. Because biometric traits cannot be changed the way a password can, a breach creates a permanent and irreparable vulnerability.

Are there laws that protect my biometric data?

Some U.S. states, including Illinois, Texas, and Washington, have enacted laws that give individuals legal recourse if their biometric data is exposed by a company. However, there is currently no sweeping federal law in the U.S. that universally protects biometric data.

What steps can I take to protect my own biometric data?

You can reduce your risk by limiting which companies you allow to store your biometric data and opting out when uncertain, keeping your device operating systems and security software up to date, and actively monitoring your financial accounts and other sensitive data sources for any unusual activity.