Any person must obtain an individual's consent before collecting biometric data from that individual. There is no exception for publicly available data or implied consent — consent must be affirmative and obtained prior to collection. Biometric data includes facial features, retina, iris, fingerprint, voiceprint, and hand or face geometry when capable of identifying an individual. The statute does not specify the form of consent (written vs. oral) but requires it occur before collection. Voiceprint data retained by financial institutions or their affiliates (as defined in 15 U.S.C. § 6809) is exempt from this entire section.

Any person who has obtained biometric data is prohibited from selling, leasing, or otherwise disclosing it to third parties except in four narrow circumstances: (1) the individual consents to disclosure for identification purposes in disappearance or death; (2) the disclosure completes a financial transaction the individual requested or authorized; (3) the disclosure is required or permitted by federal or state law; or (4) the disclosure is made to or by law enforcement pursuant to a warrant. Outside these four exceptions, all transfers of biometric data to third parties are prohibited — there is no general consent-based disclosure exception for commercial purposes.

Any person who possesses biometric data must store, transmit, and protect it from disclosure using reasonable care. The protection standard is benchmarked: biometric data must receive at least the same level of protection as other confidential information the person possesses. This means the entity's existing confidential data security posture sets the floor — biometric data cannot receive lesser protection. The standard is 'reasonable care,' not a prescriptive technical requirement.

Any person who possesses biometric data must delete and destroy it within a reasonable time, and in no event later than one year after the original purpose for collection expires. If federal or state law requires a longer retention period, the data must be destroyed within one year after that legally mandated retention period ends. The statute specifically addresses the employer context: when an employer collects an employee's biometric data for security purposes, the collection purpose is deemed to expire upon termination of employment, starting the one-year deletion clock. For all other contexts, the entity must determine when the stated collection purpose has been fulfilled and track the one-year deadline from that point.