Biometrics and the Future: What It Means for Small Businesses

What are biometrics?

Biometrics are any physical or behavioral human characteristics completely unique to an individual. These traits include fingerprints, voices and facial patterns — the basis for the facial recognition technology law enforcement agencies are increasingly adopting. In recent years, biometrics have been used beyond the corporate world.

Biometrics are popping up everywhere; the industry is gaining ground as consumers opt for the convenience of using the most natural authenticator available: Themselves. Nowadays, consumers can use their fingerprints or face scans to verify their identity, make payments, confirm purchases and increase business security. Biometrics can also serve as a way to unlock your passwords for applications and other important information.

Since these traits cannot be shared by other people, biometrics in business can be used to grant access to employees who have clearance to certain facilities or data and keep out employees who do not. Biometrics’ ability to verify a person with near-complete confidence explains why this technology is rapidly becoming a key business security system feature.

However, biometrics in business are useful for more than security. They also have applications for employee time tracking, marketing and wage theft prevention.

What is biometrics authentication?

Biometrics have already been incorporated into the best time and attendance software and security systems to ensure businesses provide their employees and customers with the most secure services. The technology may be relatively new in the United States but, as it ramps up, so will business applications.

“Biometric solutions are in high demand since they are more affordable and enable a higher level of identity authentication,” wrote Amir Shechter, executive director for innovation and technology — solutions at Convergint Technologies, in an email. “We work with several solution providers and are continually evaluating new and emerging biometric technologies to offer to our customers.” 

Right now, biometrics’ main function is in multifactor authentication — the technology is used as one step to identify a person attempting to access a system. As they develop and are increasingly integrated into consumers’ lives, biometrics could play a role in different use cases, like more personalized customer service experiences.

How are biometrics used in business?

Here are some real-life examples of how businesses and other organizations are using biometrics:

• Fingerprint and finger-vein scanning: Fingerprint scanning is one of the most well-known methods of biometric authentication. Finger-vein scanning — also known as finger-vein biometrics, vein matching or vascular technology — is a newer technique that analyzes the pattern of blood vessels visible underneath the surface of your skin. Barclays Bank, for example, has installed finger-vein scanners to confirm their customers’ identities. This technology is more advanced than more commonplace fingerprint-scanning technology, as it uses infrared technology to map the veins in a customer’s finger.
• Iris scanning: Those movie scenes in which someone scans their eye before they enter a top-secret space aren’t fiction anymore — these technologies are here. The United Nations uses iris-scanning technology to verify refugees’ identities before distributing food, money and other forms of assistance.
• Facial recognition technology and biometric marketing: This is the same technology used on newer iPhone models that matches your unique facial structure to a pre-stored data map of your features. You can also find this technology at Detroit Metropolitan Airport, where Delta Air Lines has begun implementing facial recognition software to tailor content to every person looking at the same screen. Delta shared that the beta test will display passengers’ flight and gate information in their language of choice for up to 100 people simultaneously. If the beta test goes well, it could pave the way for a wider use of biometric marketing to deliver personalized ads and campaigns.
• Biometric punch cards: This technology requires employees to clock in and out with their fingerprints. It’s becoming more popular since these systems reduce the risk of time fraud. 

Biometrics may still be a few years away from full adoption in the U.S., but the technology is gaining traction. Doug Aley, the CEO of Paravision, a facial recognition company that partners with businesses to implement practical facial recognition solutions, said that facial recognition could soon enhance security and customizable marketing opportunities by integrating facial recognition software with a business’s point-of-sale (POS) system. [See related article: The Best POS Systems of 2024]

“We look at a future where I can go into a store where I’ve opted in … [and] the point-of-sale machine recognizes me and tells the clerk behind the desk, ‘Hey, this is Doug. He likes a latte.’ Then I can be greeted with, ‘Hi, Doug, would you like your latte today?’” Aley said.

“That kind of level of personalization and then being able to follow through with that transaction with an actual payment mechanism that’s on file for me is a much smoother transaction,” he added. “I don’t have to carry my wallet around; I don’t even have to carry my phone around.”

You may not be able to integrate biometrics into your business’s workflow yet, but it’s worth being mindful of new developments and integration opportunities that emerge.

How do biometrics impact data security?

One concern with the development of biometrics is user security and privacy. Collecting and implementing data tied to specific physical features is a big step for any employee or consumer. However, Aley said the cybersecurity risks associated with biometric technology could be mitigated with multifactor authentication. 

“With every factor that you add, you boost the cryptographic strength of that transaction — and you’re using factors that are either difficult to guess or difficult to replicate — then you’re going to be in much better shape,” he said. “I think that as biometrics become a part of … those authentication systems, you’re going to see the prevalence of the ability of data breaches go way down.”

Another aspect regarding biometric security relates to how small businesses handle that sensitive information. While biometric info can verify a user through multifactor authentication, it’s important for small businesses to store this information safely and securely.

Do regulations exist around biometrics and data security?

To address growing concerns about biometrics and data security, Congress drafted the National Biometric Information Privacy Act of 2020. The Act details the legal requirements and policy specifications for companies and other private entities seeking biometric information, including retention schedules and guidelines for destroying the biometric data either once the data has served its original purpose or one year after a customer’s last interaction with the company, whichever comes first. 

The Act defines biometric information — or biometric identifiers — as any of the following:

• Retina or iris scan
• Fingerprints or palm prints
• Voiceprints
• Faceprints, including ones procured from a photograph
• Any other unique identifiers based on someone’s physical characteristics

The Act does not include the following in its definition of biometric identifiers:

• Physical descriptors, such as height, weight, eye color and hair color, plus handwriting samples, written signatures or other biological samples
• Information collected in a health care setting for medical purposes, including diagnostic scans and test results, such as X-rays, PET and MRI scans and mammograms

The Act also outlines the acceptable reasons for collecting and retaining someone’s biometric data:

• If a company needs biometric data to provide a legitimate business service
• If the company informs its customers in writing that they’re collecting biometric data and the reason why. The customers must opt-in to provide their information before the company can collect and store their data

Furthermore, according to the Act, companies that obtain and store their customers’ biometric data may not sell or profit from the data in their possession. They must also protect the data as carefully as other sensitive and confidential information.  

Biometric technology is a new field, so additional state-specific requirements and updated federal regulations may come into existence regarding business entities retaining and handling biometric data. Some state-level regulations already exist: In Illinois, businesses must comply with the Illinois Biometric Information Privacy Act (BIPA) of 2008, which was amended in August 2024. You might want to hire an attorney to review local, state and federal guidelines to ensure your business’s biometric authentication data policies comply with the law.

What are the costs of using biometrics? 

Below are some common types of business biometrics devices and their ballpark costs:

• Fingerprint scanners: $50 to $1,500 per scanner, with some options around $500
• Iris scanners: $1,500 to $3,000 per scanner
• Facial recognition technology: $1,000 to $2,500 per scanner
• Hand scanners: $1,000 to $2,000 per scanner
• Devices that combine facial recognition technology and fingerprint scanners: $2,000 to $4,000 per scanner, with some options around $1,200

Shechter said biometric technology could be affordable for some small businesses but would depend largely on how it is used and what the business needs. 

“Biometric devices are much more affordable and should be incorporated into most businesses,” he said in an email. “Some forms of biometrics are more secure than others — fingerprint versus iris scans, as an example. But these systems are still often superior to basic card access systems, which can be easily hacked or simply transferred from one person to the other.”

Still, you should establish a necessary use case before implementing this technology — especially if you want to build it into your customers’ experience. This technology is still developing, so if you’re interested but aren’t ready to partner with another company, wait and see how other businesses employ biometrics in their day-to-day operations.

“Make sure the use case is really solid and your customers are going to be comfortable with it,” Aley said. “Introducing something and spending a lot of time on something that your customers aren’t going to be comfortable with is not going to be a great recipe for success.”

Max Freedman and Matt D’Angelo contributed to this article. Some source interviews were conducted for a previous version of this article.