Designing biometric data collection consent and processing transparency UI in Figma: liveness, templates, and lawful basis

Quick answer

Biometric consent UI must explain what is captured, how long templates are stored, who can access them, and how users withdraw—before the camera or microphone opens. Design a pre-capture disclosure screen with purpose, retention, and third-party subprocessors; a step-by-step capture flow with liveness guidance and accessible fallbacks; and a biometric settings panel where users view, renew, or delete templates. Start from the Figma guides hub and pair with privacy settings, consent admin, launch gates, DSAR portal, and Dev Mode handoff.

---

Who this is for

• Product designers building identity verification, workplace access, health, or payment flows that use face, voice, or fingerprint matching.
• Design system teams standardizing biometric banners, consent modals, and “template on file” badges across mobile and web.
• Privacy and Legal teams implementing GDPR special-category safeguards, Illinois BIPA-style written release, and sector rules (finance, healthcare) with auditable consent—not a generic camera permission dialog.

---

Biometric privacy hub (internal overview)

BiometricPrivacyHub — Acme Identity · 1.4M enrolled · 18k pending renewals · 3 subprocessors
├── Header: Active templates 1.38M · Expired 22k · Deletion queue 410 · Consent rate 94.1%
├── Actions: [ Configure purposes ] [ Retention policies ] [ Export BIPA log ] [ Review subprocessors ]
├── Tabs: Purposes · Enrollments · Consent records · Retention · Subprocessors · Incidents · Reports
├── Alert: Voice auth vendor V-02 SOC report overdue · Blocks new EU enrollments until updated
├── Filters: Biometric type · Region · Lawful basis · Consent status · Product surface · Vendor
└── Link: [Consent admin](/designing-consent-records-and-preference-management-admin-ui-in-figma/) · [ROPA](/designing-records-of-processing-activities-and-data-mapping-ui-in-figma/) · [DPIA](/designing-privacy-impact-assessment-and-dpia-workflow-ui-in-figma/) · Trust center

Section	Purpose
Purposes	Face unlock, liveness KYC, voice auth—each with lawful basis and retention
Enrollments	Per-user template status, version, and last match event
Consent records	Immutable consent tied to notice version and capture device
Retention	Auto-delete schedules and renewal prompts before expiry
Subprocessors	Vendors that process raw biometrics vs derived templates
Incidents	Spoof attempts, template leaks, or unauthorized access flags

Verdict: Biometric UI fails when users only see an OS camera prompt—regulators expect written, purpose-specific consent before any capture starts.

---

Pre-capture consent screen (customer-facing)

BiometricConsent — Verify it's you · Face match for account recovery
├── Purpose: "We'll scan your face to confirm you own this account"
├── What we collect:
│   ├── Face geometry template (not a photo stored for marketing)
│   ├── Liveness check: blink + head turn · No background upload
│   └── Device metadata: camera model, OS version (fraud signal only)
├── What we do NOT do:
│   ├── No emotion inference · No ad targeting · No sale to data brokers
│   └── No sharing with social graph or third-party ads
├── Retention: Template deleted after 90 days of inactivity · [Policy link](/designing-privacy-notice-version-management-and-policy-changelog-ui-in-figma/)
├── Subprocessors: Acme VerifyCo (EU) · [Trust center](/designing-trust-center-and-security-documentation-ui-in-figma/) · DPA on file
├── Lawful basis: Explicit consent (GDPR Art. 9) · BIPA written release (IL users)
├── Alternatives: [ Verify with passkey instead ](/designing-passkeys-and-passwordless-login-ui-in-figma/) · [ Email OTP fallback ](/designing-email-verification-and-otp-ui-in-figma/)
└── [ I agree and continue ] · Decline returns to previous step · No pre-checked box

Element	Requirement
Plain-language purpose	One sentence: why biometrics now, not generic “security”
Template vs image	Clarify derived template storage; show if raw frames are retained
Retention timer	Concrete days/months; link to auto-deletion policy
Withdrawal path	Explain deletion in settings before capture
Non-biometric fallback	Required for accessibility and consent refusal
Jurisdiction variants	BIPA block for IL; EU explicit consent; minors blocked via age gate

Never use pre-checked consent or hide decline behind a low-contrast link.

---

Capture flow with liveness guidance

BiometricCapture — Step 2 of 3 · Position your face
├── Camera preview · Oval guide · Lighting hint if too dark
├── Liveness prompts: "Slowly turn left" → "Blink" → "Hold still"
├── Progress: Liveness ✓ · Template quality ✓ · Encrypting locally…
├── Error states:
│   ├── Face not detected · Retry · [ Troubleshooting ]
│   ├── Spoof suspected · Try again in 30s · [ Contact support ]
│   └── Camera denied · Show OS settings path · Offer OTP fallback
├── Success: Template enrolled · Expires Mar 9, 2027 · [ Manage in privacy settings ]
└── Accessibility: Voice-guided steps · Large text · No color-only status

State	UX note
In progress	Disable back navigation that loses partial capture without warning
Low quality	Explain lighting/angle; do not blame the user vaguely
Spoof block	Neutral copy; log for fraud team; no accusatory tone
Offline	Queue encrypted template upload; show pending badge

Pair capture UI with session re-auth when biometrics unlock sensitive settings.

---

Biometric settings and transparency panel

BiometricSettings — Privacy · Biometric data
├── Enrolled methods:
│   ├── Face template · Enrolled Aug 1, 2026 · Last used today · Expires Aug 1, 2027
│   │   └── [ Renew ] [ Download my data ] [ Delete template ]
│   └── Voice print · Not enrolled · [ Set up ] (shows consent flow first)
├── Processing log (last 30 days):
│   ├── Aug 9 · Account recovery · Match success · Template v3
│   ├── Aug 4 · Login unlock · Match success · Device: iPhone 15
│   └── Jul 28 · Failed liveness · No template change
├── Third parties: VerifyCo · Processing only · [ View DPA summary ]
├── Your rights: [ Export ](/designing-data-subject-access-request-and-gdpr-portal-ui-in-figma/) · [ Delete all biometric data ] · [ Object to processing ]
└── Notice version: Biometric addendum v2.1 · Consented Aug 1, 2026

Deletion should show confirmation with consequences (“You’ll need OTP or passkey for login”) and a processing timeline (“Removed within 72 hours from active systems”).

---

Admin consent ledger (Privacy team view)

BiometricConsentLedger — 1.38M records · Filter: Face · Region EU
├── Record B-882910 · user_id hashed · Purpose: Account recovery
├── Consent: Explicit · Notice v2.1 · Captured Aug 1, 2026 09:14 UTC
├── Device: Web · Chrome 128 · IP country DE · Liveness score 0.97
├── Template: v3 · Stored EU-West · Retention policy RP-BIO-90
├── Events: Renewed Jul 2026 · Match x14 · No deletion requests
└── [ Export for DSAR ] [ Revoke (support) ] [ Link ROPA PA-044 ]

Link every enrollment to ROPA activities and trigger DPIA review when adding new biometric types or vendors.

---

Comparison: biometric types and UI requirements

Type	Typical use	Consent emphasis	Retention default
Face geometry	Login, KYC	Template vs photo; liveness	12 months, renew annually
Voice print	Call center auth	Call recording overlap; noise env	6 months inactive delete
Fingerprint	Device unlock, POS	Local vs server template	Device-bound; server 90 days
Gait/behavioral	Fraud scoring	Often profiling—link automated decisions	Short; purpose-limited

High-risk combinations (face + emotion + ads) should hard-block at launch gates until Legal signs off.

---

Handoff checklist (Dev Mode)

• BiometricPurpose — id, type, lawful_basis, notice_version, retention_days, regions_allowed.
• ConsentCapture — purpose_id, user_id, consented_at, notice_version, device_fingerprint, fallback_offered.
• BiometricTemplate — user_id, type, version, enrolled_at, expires_at, vendor_id, storage_region.
• ProcessingEvent — template_id, event_type, timestamp, outcome, ip_country, no_raw_image_stored flag.
• DeletionRequest — user_id, scope, requested_at, completed_at, systems_cleared[].
• Accessibility — camera preview has text alternative path; liveness steps announced to screen readers.

---

Common mistakes

Mistake	Why it hurts	Fix
OS permission = consent	Regulators reject implied consent	Dedicated pre-capture disclosure
Storing selfie photos silently	BIPA/GDPR complaints	Template-only with explicit raw-frame policy
No fallback auth	Accessibility and refusal traps	OTP, passkey, or in-person path
Hidden subprocessors	Trust center out of date	Block enrollment if vendor DPA missing
Infinite retention	Right-to-erasure failures	Expiry + renewal prompts
Biometrics for minors	COPPA/GDPR-K violations	Route to parental consent or block
Match logs without purpose	Transparency complaints	Show purpose per event in settings
Dark pattern decline	Enforcement risk	Equal-weight Decline and Continue buttons

---

Recommended workflow

1. Define purposes and retention per biometric type with Legal and Security.
2. Design pre-capture consent with jurisdiction variants and fallback paths.
3. Build liveness capture with accessible errors and spoof handling copy.
4. Add settings transparency with processing log and one-click deletion.
5. Wire consent ledger to consent admin and ROPA.
6. Gate new vendors at launch review with DPIA and trust center updates.
7. Export enrollment reports for compliance audit evidence.

---

FAQ

Is a checkbox enough for BIPA?

Illinois users typically need written release with specific retention and purpose language—design a dedicated screen, not a Terms checkbox buried on page 40.

Raw images vs templates?

If raw frames exist even briefly, disclose capture, encryption, and deletion SLA—do not claim “we only store a template” unless true.

Link to DSAR portal?

Biometric export packs should include consent record, template metadata, and processing log—not necessarily re-playable biometrics.

Voice auth and call recording?

If calls are recorded, separate call recording consent from voiceprint enrollment—two purposes, two toggles.

Re-consent on policy change?

When biometric addendum version changes materially, block new matches until user re-consents or deletes template.

---

Next steps

• Design privacy settings and data management UI in Figma — central place for biometric deletion
• Design consent records and preference management admin UI in Figma — immutable consent ledger
• Design privacy by design launch gates and feature privacy review UI in Figma — block new biometric vendors without review
• Design passkeys and passwordless login UI in Figma — preferred fallback where biometrics are refused
• Design trust center and security documentation UI in Figma — publish subprocessors and retention policies