Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy authorizes ADP to process biometric data including fingerprints for asset protection, site and system access, security, and fraud prevention purposes without requiring prior explicit consent for these listed uses.
This analysis describes what ADP's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision authorizes biometric data processing — a category subject to heightened regulatory requirements under statutes such as the Illinois Biometric Information Privacy Act — for enumerated business purposes under the BCR framework, with prior explicit consent required only for uses beyond those listed categories.
Interpretive note: The extent to which the BCR framework satisfies US state-level biometric consent requirements such as BIPA is not addressed in the document and depends on jurisdiction-specific legal analysis.
ADP deleted the cookie preference management tool that previously allowed users to understand and control which cookies were placed on their devices, including functional, analytics, and advertising cookies. The removal eliminates the transparency mechanism through which users could consent to or opt out of different cookie categories. The practical effect depends on whether ADP has replaced this functionality elsewhere or whether cookies continue to be placed without equivalent granular user control.
View change record →Under this clause, ADP may collect and process biometric identifiers such as fingerprints for site access and security purposes. Individuals whose biometric data is processed for purposes beyond those listed would be entitled to prior explicit consent under the terms of the policy.
Cross-platform context
See how other platforms handle Biometric Data Processing and similar clauses.
Compare across platforms →Monitoring
ADP has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Biometric data (such as fingerprints). ADP may Process biometric data for the protection of ADP and Staff assets, system and site access, security and fraud prevention reasons.Excerpt from ADP's Privacy Statement
REGULATORY LANDSCAPE: This provision engages the Illinois Biometric Information Privacy Act (BIPA), which requires written informed consent before collecting biometric identifiers, a publicly available written retention schedule, and prohibits sale or profit from biometric data. It also engages GDPR Article 9, which classifies biometric data as a special category requiring an explicit legal basis beyond legitimate interests. The relevant enforcement authorities are the Illinois courts (BIPA is privately enforceable), EU/EEA data protection authorities, and potentially the FTC under Section 5 unfair or deceptive practices authority. GOVERNANCE EXPOSURE: High. The authorization to process biometric data for access control purposes without specifying a state-by-state consent mechanism creates potential exposure under BIPA and similar statutes in Texas (CUBI), Washington (My Health MY Data Act adjacent provisions), and other jurisdictions that regulate biometric identifiers. The BCR framework addresses EU transfers but does not substitute for US state-law consent requirements. JURISDICTION FLAGS: Illinois creates the highest exposure due to BIPA's private right of action and per-violation statutory damages. Texas and Washington impose biometric data obligations without private rights of action but with state AG enforcement. California's CPRA classifies biometric data as sensitive personal information requiring opt-out rights. Organizations operating ADP-managed facilities or systems in these states should assess whether ADP's notice and consent procedures satisfy applicable state requirements. CONTRACT AND VENDOR IMPLICATIONS: Procurement and legal teams engaging ADP as a vendor should request documentation of ADP's biometric data consent procedures, retention schedules, and destruction protocols to assess BIPA compliance. Client contracts should specify which party bears responsibility for obtaining employee consent to biometric data collection when ADP systems are deployed at client facilities. COMPLIANCE CONSIDERATIONS: Compliance teams should conduct a data mapping review to identify all ADP touchpoints involving biometric data collection and confirm that applicable state consent, notice, and retention policy requirements are satisfied. Where ADP collects biometric data at client-operated locations, the allocation of BIPA compliance obligations between ADP and the client employer should be addressed in the master services agreement.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision authorizes biometric data processing — a category subject to heightened regulatory requirements under statutes such as the Illinois Biometric Information Privacy Act — for enumerated business purposes under the BCR framework, with prior explicit consent required only for uses beyond those listed categories.
Under this clause, ADP may collect and process biometric identifiers such as fingerprints for site access and security purposes. Individuals whose biometric data is processed for purposes beyond those listed would be entitled to prior explicit consent under the terms of the policy.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by ADP.