When "Optional" Wellness Wearables Aren't: The Legal Backlash Against Biometric Data in Reviews

A "voluntary" wellness wearable program is not voluntary if declining it costs an employee money or standing. That is the plain reading federal regulators and Illinois courts have converged on since 2024.

Employers who mandate a step-count or HRV-tracking device, then feed the readouts into HR files, are now sitting on real legal exposure. Three separate bodies of law now touch this practice: the ADA's voluntariness requirement, Illinois's Biometric Information Privacy Act, and newer state biometric statutes in Texas and Washington.

What Counts as "Voluntary" Under Federal Law

The ADA restricts disability-related inquiries and medical examinations to a narrow set of exceptions. One of those exceptions covers voluntary employee health programs reasonably designed to promote health or prevent disease, under 42 U.S.C. 12112(d)(4)(B).

The EEOC's December 2024 fact sheet on workplace wearables applied that standard directly to fitness trackers for the first time. Its own worked example: an employer tells an employee he must wear a company-issued tracking watch that collects vital signs and gait data, and, per the agency, "this mandatory use of the watch does not satisfy the ADA's requirements for employee health programs that are voluntary."

That single sentence reframes a decade of ambiguous wellness-program design. Mandatory participation, even framed as a friendly nudge toward better sleep, can itself be the violation.

The BIPA Exposure Employers Underestimate

Illinois's Biometric Information Privacy Act defines a biometric identifier as "a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry," per 740 ILCS 14/10. Biometric information is defined even more broadly, covering any data "based on an individual's biometric identifier used to identify an individual."

Most consumer HRV rings and fitness bands track heart rate and movement, which sit outside that narrow identifier list on their own. The exposure appears when an employer layers biometric login, fingerprint kiosks, or face-scan check-ins onto a wellness program alongside the wearable data.

That combination is exactly what BIPA was written to police, and Illinois plaintiffs' firms have noticed the wellness-adjacent angle. Over 100 new BIPA class actions were filed in 2025 alone, with settlements including a $12.1 million payout from Speedway.

Texas and Washington Add State-Level Risk

Illinois is not alone anymore. Texas enacted the Capture or Use of Biometric Identifier Act, and Washington passed its own biometric privacy statute in 2017.

Neither state allows an individual employee to sue directly; enforcement runs through each state's attorney general. That has not made the exposure small.

Texas Attorney General Ken Paxton used CUBI to reach a $1.4 billion settlement with Meta over facial recognition practices, a number that signals how aggressively the statute can be enforced once a regulator takes interest. A wellness vendor's face-scan check-in kiosk or voice-based coaching assistant could draw the same scrutiny.

When Wearable Data Bleeds Into Performance Reviews

The EEOC's fact sheet does not stop at collection. It separately addresses what happens once an employer uses the data collected.

Its listed examples read like a checklist of what not to do: inferring pregnancy from heart rate and temperature patterns and then forcing unpaid leave, or firing an employee over an elevated heart rate caused by an underlying heart condition. Each example ties wearable output directly to an adverse employment decision.

A performance review that references "low recovery scores" or "inconsistent sleep compliance" sits uncomfortably close to those examples. The moment a wellness metric shapes a rating, a raise, or a termination, it stops being wellness data and becomes evidence in an EEO claim.

Is Your Program Actually Voluntary? A Decision Tree

The distinction between a defensible program and an exposed one usually comes down to a small number of yes-or-no questions. Below is a simplified version of the analysis employment counsel typically runs.

What Westchester Employers Should Audit Now

Start with the incentive structure, not the device. If declining the wearable changes an employee's premium, bonus, or standing with a manager, the "voluntary" label will not survive a challenge.

Next, check where the data physically lives. The ADA requires medical information collected through a wellness program to sit in files separate from personnel records, per 42 U.S.C. 12112(d)(4)(C).

Finally, map every biometric touchpoint in the vendor stack. A wellness app's face-scan login or fingerprint-based device pairing can trigger BIPA, CUBI, or Washington's statute independently of the fitness data itself.

Next Move

Watch for the first reported case where wearable HRV or sleep data appears as an exhibit in a wrongful-termination or discrimination suit. None has been publicly confirmed yet, but the EEOC's fact sheet reads like a roadmap for plaintiffs' counsel building exactly that record.

Executives implementing these programs should ask their own HR teams the same four questions in the tree above, before a regulator or a former employee asks them first.

See our related coverage on how boards are requesting CEO HRV data. Also read how life insurers are pricing wearable data.

Last updated September 2026. Not medical, legal, or financial advice. This article is editorial commentary on employment law and wearable data practice.

It is not a substitute for review by employment counsel of any specific wellness program. Statutes, regulations, and case outcomes change; verify current requirements before acting.