On September 8, 2026, the Monroe County Legislature unanimously voted to approve a new Local Law (Intro. No. 277 of 2026), entitled “Requiring Disclosure of Biometric Identification Technology and Protection of Biometric Identification Data at Commercial Establishments” (the “Local Law”), which requires certain businesses to provide notice to consumers when they collect biometric information, like facial recognition data. The Local Law limits its scope to “commercial establishments,” defined as a “place of entertainment, a retail store, or a food and drink establishment.” Monroe County is the fourth Upstate New York jurisdiction this year to pass a local law governing how businesses use biometric technology. Monroe and Onondaga Counties have both passed signage requirements where biometric collection occurs in commercial establishments, whereas Erie County and the City of Syracuse have adopted outright bans on such collection, depending on the circumstances. Monroe County and the City of Syracuse have built a private right of action into their local laws, however, creating potential litigation risk for affected businesses that do not comply.
Monroe County – A Signage Law with Teeth
The Local Law applies to commercial establishments that collect, retain, store, convert, or share biometric information. The law imposes four core obligations in relation to customer biometric information:
- Notice. Commercial establishments must post a clear notice near customer entrances informing individuals when biometric information is collected. The notice will be in a form and manner prescribed by the County. Although the law will become effective once signed by the County Executive and filed with the New York State Secretary of State, no County guidance has yet issued about size or content of the required sign. New York City, by contrast, has a similar signage requirement in place and a model sign for businesses to use.
- Prohibition on Sale. As with the other Upstate jurisdictions that have acted to regulate the collection and use of biometric information, commercial establishments in Monroe County are prohibited from selling or otherwise profiting from transactions that involve biometric information. This can be an outright sale of biometric information or the sharing, leasing, or trading of such information for something of value.
- Anonymization. Any biometric information collected by a commercial establishment must be stored securely and in anonymized form, so that it cannot be reasonably used, by itself, to identify a specific person. This restriction appears to conflict with the purpose behind biometric information collection, i.e., to identify an individual, and the County has not yet issued guidance on how to balance this restriction with the underlying purpose of such collection. That being said, the Local Law provides a carve out for loss prevention and safety purposes, such that storing biometric information in identifiable form may be allowable for limited exempted purposes.
- Retention Limit. Customer biometric information must generally be destroyed within two years of collection unless another law requires longer retention.
Importantly, enforcement of the law lies with both affected individuals, e.g., consumers whose biometric information was collected by a commercial establishment without appropriate signage, and the Monroe County Attorney. A consumer who wishes to bring a claim must generally provide advance written notice to the commercial establishment, which will then have thirty days to cure the alleged violation. No action may be brought if the establishment cures and confirms in writing that the violation will not recur. No advance notice is required for a claim alleging the unlawful sale or exchange of customer biometric information.
Although the local law was unanimously passed by the County Legislature, it must now await approval by the County Executive and then filing with the New York State Secretary of State to become effective.
What to Do Next?
The patchwork of local laws across Upstate New York regulating the collection, use, retention, and sale of biometric information creates varying and sometimes conflicting challenges for public-facing businesses. Any organization collecting consumer biometric information in any of these jurisdictions should immediately inventory such collection and assess whether a ban or signage requirement applies. Such organizations should then work with experienced privacy counsel to determine, not only whether they are meeting the requirements of these new local laws, but also whether their data processing practices comply with potentially applicable state privacy regimes.