A Biometric Consent Screen Can Cover Three Different Things

What Are You Actually Agreeing To?

Up to three separate permissions, bundled into one checkbox. The first is a recording: a video and audio file the employer keeps. The second is a biometric template, meaning a voiceprint or a scan of face geometry derived from that file. The third is automated analysis, which can mean a model reading a transcript of the words you said and scoring them.

A single screen can cover one of them, or all three.

The second is the one with a biometric consent statute behind it, and the one worth reading the screen for.

Facial recognition sometimes means identifying you from the file, and HireVue's candidate FAQ says the company never uses the video recording of an interview to identify a candidate ³.

Only skills and competencies are measured, the same FAQ says, and assessments never look at age, race, gender, GPA or the college attended ³.

That is candidate-facing copy on the vendor's own site, describing an intended design rather than any individual employer's configuration. Statements about what a system does not use are hard to check from outside without an audit.

Employers get a version of the same question from the other chair. What an employer has to tell a candidate before recording their screen sets out six things to disclose before anything starts. That article also says adding a camera or a voiceprint puts Illinois biometric law in play.

Which Word Makes It Biometric?

Identifier, template, voiceprint, or face geometry. Illinois defines a biometric identifier as a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry, and its list of exclusions opens with writing samples, written signatures and photographs ¹. A video recording as such is not on the identifier list. Whether a given product builds one is a question of fact about that product.

Courts have split on where that line falls for particular technologies, so the text settles less than it looks like it settles. The definition is Illinois law, and it reaches private entities operating there.

Europe draws the line in a similar place with different words.

GDPR Article 4(14) defines biometric data as personal data resulting from specific technical processing that allows or confirms unique identification, such as facial images ². Recital 51 adds that a photograph becomes biometric data only when it is processed through a technical means allowing unique identification ².

Article 9(1) then prohibits processing biometric data to uniquely identify a person unless a condition applies, and the first listed is explicit consent for specified purposes ².

A stored interview video is personal data either way. It becomes biometric data at the point a system processes it to work out who you are.

Scoring what you said is a different act from working out who said it.

So a screen can carry a recording clause and an analysis clause with no template anywhere in the product. The consent is then not a biometric consent, whatever the heading on it says.

What Does a Lawful Biometric Consent Have to Say?

In Illinois, three specific things, all of them before the identifier is collected. Section 15(b) requires the entity to tell you in writing that a biometric identifier is being collected or stored. It must also state, in writing, the specific purpose and the length of term for which it will be collected, stored and used. And it must receive a written release from you ⁴.

A pop-up saying the interview uses AI and may be recorded is not that.

The section asks for the specific purpose and the length of term, and a screen naming neither has not done what it asks. Section 15(a) separately requires a publicly available written retention policy with a destruction schedule no later than three years after your last interaction ⁴.

Section 15(b) only bites where a biometric identifier is actually collected, so it does nothing for a candidate whose interview was scored from a transcript ⁴. The duty binds the private entity doing the collecting, which in an AI interview may be the vendor, the employer, or both, and the statute does not say which ⁴.

Illinois has a second law aimed at the analysis rather than the template.

Since 2020, the Artificial Intelligence Video Interview Act has required an employer using AI to analyse recorded video interviews for an Illinois-based position to notify the applicant beforehand and obtain consent ⁵. The employer must also explain how the AI works and what general types of characteristics it evaluates, and it may not evaluate anyone who has not consented ⁵.

That Act names no penalty and creates no private right of action, so an applicant dropped after declining has no remedy under it ⁵. It does carry a deletion right: on request the employer destroys the video within 30 days and instructs everyone who received a copy to delete their backups ⁵.

Maryland is narrower and more specific.

Since October 1, 2020, an employer there may not use a facial recognition service to create a facial template during an applicant's interview unless the applicant signs a waiver ⁶. The waiver has four required items: your name, the interview date, your consent to facial recognition during the interview, and whether you read it ⁶.

That statute reaches templates created during an interview, and not video recording, voice analysis, or AI scoring of what you said ⁶. It names no penalty, and it does not stop an employer from declining to interview someone who will not sign ⁶.

Three statutes in two states, and none of them alone covers the whole screen.

Ask What the Screen Does Not Say

Ask in writing, before the interview, and keep the reply. The question that decides everything downstream is whether any component builds a voiceprint or a scan of your face geometry, at any stage, including identity checks and fraud checks. A recruiter can put that question to the vendor. The second question is how long anything is kept, and who deletes it.

• Is a voiceprint or a scan of face geometry created anywhere in this product, including for identity verification?
• What is the retention period for the video, the transcript, and anything derived from either?
• Do I send a deletion request to the employer or to the platform?
• If I decline the AI portion, what happens to my application?

On HireVue the retention clock belongs to the employer.

Its candidate FAQ says personal data is stored for the period chosen by the company you interviewed with, and purged automatically when that period expires ⁷. A candidate can request deletion at any point in the process, and HireVue says it does not decide whether or when to delete, the company applied to does ⁷.

How long a company keeps your AI interview video, and how to get it deleted covers the deletion routes that exist. If the same invitation also wants your screen, what to settle before an assessment records your screen or your face is the narrower version of the same question.

What declining costs depends on the platform, and the two published answers differ.

Take HireVue's 2025 explainability statement first. It says a candidate who opts out of AI evaluation completes the same assessment, with recruiters manually reviewing and rating the responses against the same behaviorally anchored scales ⁸. The statement says the consent screen itself has to tell the candidate that opting out will not exclude them from the hiring process ⁸.

HackerRank publishes a different flow.

Its knowledge base says a candidate who does not consent will not be able to participate in the feature using that automated tool ⁹. Both pages describe a vendor's own product, and both flows are configurable by the employer deploying them, so what you are offered may differ from either page.

If the screen in front of you names none of this, the absence is the thing to write down. Note the platform, the date, and the wording you were shown, before you close the tab.

Read the evidence >