I believe this is also illegal in some US States. I know of at least a couple that don’t allow biometric data to be stored without concent; I think Facebook even lost a case in one state and had to pay a pretty large sum of money.