Law note · Tennessee
Tennessee Information Protection Act, sensitive data and biometric definition
TIPA classifies information revealing racial or ethnic origin, religious beliefs, a mental or physical health diagnosis, sexual orientation, or citizenship or immigration status; the processing of genetic or biometric data to uniquely identify a natural person; a known child's personal information; and precise geolocation data as sensitive data.
"Biometric data" is defined as data generated by automatic measurement of biological characteristics used to identify a specific individual, but categorically and unconditionally excludes a physical or digital photograph, video recording, or audio recording, or data generated from one, with no claw-back for an identification purpose.
This is the single most consequential difference from Maryland, Minnesota, and New Jersey in this same wave: a faceprint or voiceprint a product derives from a recording specifically to identify a person is never "biometric data" in Tennessee, and therefore never triggers TIPA's sensitive-data consent duty on that basis alone. No dedicated Tennessee biometric-privacy statute beyond TIPA's sensitive-data treatment was found in this pass.
What it asks of an app
- Obtain a Tennessee consumer's consent before processing sensitive data, including biometric or genetic data processed to uniquely identify the individual.
- Do not assume Tennessee's recording-derived exclusion protects you elsewhere. A faceprint or voiceprint your product extracts from a photograph, video, or audio recording is categorically outside TIPA's biometric-data definition, unlike Maryland, Minnesota, and New Jersey, where the same extraction claws back into a consent duty.
When LexLint raises it
Declared activities: processes_biometrics, processes_voice, crawls_web, trains_models
Primary source: official Tennessee session law text, Public Chapter 408 (2023), Tennessee Secretary of State