Clock-In Photo Consent: What to Have the Crew Sign, With a Template
A clock-in photo is a plain picture, and under the Illinois definition a plain picture is not a biometric identifier. Written consent is still the safe default, because state laws differ and software can change. This post explains the difference, names the three states to check with counsel, and gives you the full consent notice to have the crew sign.
SEPTEMBER 17, 2026 · BY THE CLOX TEAM
01
What a clock-in photo is
A clock-in photo is a front-camera picture the worker takes at the moment they clock in. It is stored with that shift, and a manager looks at it when reviewing the timesheet to confirm that the person who punched is the person on the schedule. It is a deterrent against buddy punching, where one worker punches in for another who is not on site yet. We covered what a photo proves and what it does not in clock-in photo verification and the wider fixes in how to stop buddy punching.
The important part for consent is what does not happen. In Clox, the photo is a photo. No software measures the face, compares it to a stored template, or extracts anything from it. A manager looks at it with their own eyes. That distinction is what the Illinois definition turns on.
02
A photo and a biometric identifier are different things
Start with the Illinois definitions, because they draw the line clearly. The Illinois definition of a biometric identifier, read September 8, 2026, covers a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry. The same definition states that biometric identifiers do not include photographs. "Biometric information" is information based on a biometric identifier that is used to identify an individual.
So a plain photograph that nobody runs face recognition on is generally outside the Illinois definition. The line moves the moment software measures a face: a face geometry scan is a biometric identifier, and the numbers derived from it are biometric information. A time clock that says it "recognizes" or "matches" the worker's face is on the other side of that line.
Texas (Business and Commerce Code 503.001) and Washington have their own biometric statutes with consent requirements. Washington's RCW 19.375.020, read September 8, 2026, says: "A person may not enroll a biometric identifier in a database for a commercial purpose, without first providing notice, obtaining consent, or providing a mechanism to prevent the subsequent use of a biometric identifier for a commercial purpose." The practical advice is the same in all three states: if you turn on clock-in photos there, confirm with counsel before the first photo. Outside those three states, a signed notice is still the safe default, for the reasons in the next section.
03
Why written consent is still the safe default
A plain photo is generally outside the Illinois definition, and a signed notice is still the safe default. Four reasons, and none of them is about Clox in particular.
- State laws differ and change. The Illinois definition excludes photographs today, and Texas and Washington wrote their own statutes. A signed notice costs you ten minutes and removes the argument about which definition applies to your crew.
- A vendor could change what it does with photos. A photo that is only looked at today could be run through recognition tomorrow if the software changes. Clox states in its docs that it does not run face recognition and does not extract face data. Your notice should say what your vendor does, and if the vendor changes, the notice changes.
- Workers deserve to know. A camera opening at clock-in surprises people. Telling them in advance what the photo is for, who sees it, and how long it is kept turns a surprise into a policy.
- It pairs with your other notices. If you also use worksite geofencing, we recommend a location notice for that too; the wording is at /gps-consent, and the legal background is in is GPS tracking of employees legal.
Clox's own docs recommend giving the consent notice before turning on clock-in photos, and the notice Clox publishes lives at /selfie-consent. The template below covers the same ground in a form the crew can sign.
04
What the notice has to say
A consent notice for a clock-in photo needs six things, in plain words. It says what is collected, why it is collected, who sees it, how long it is kept, that no biometric measurement is taken, and how the worker can ask questions. Add a signature and a date, and keep it to one page so people read it. For the retention line, federal rules require payroll records to be kept for at least three years, per DOL Fact Sheet 21, so three years is the simple number to write.
05
The template
Copy the text below as written. "The Company" means your business; replace it with your business name. The notice assumes you use Clox; if you use different software, replace the software name and confirm that the statements about recognition and storage are true for that product.
Clock-in photo notice and consent.
The Company uses a time clock app, Clox, to record when employees start and end work. When you clock in, the app opens the front camera on your phone or on the shared tablet and takes one photo of you. This notice explains what that photo is, what it is used for, and what happens to it.
What is collected. One photo is taken at each clock-in, and it is saved with that shift's time record.
Why it is collected. The photo lets a manager confirm that the person who clocked in is the person the shift belongs to. Its only purpose is to prevent one employee from clocking in for another.
Who sees it. Managers who review and approve timesheets can view the photo alongside the shift. The photo is stored by Clox with the shift record. The Company does not share the photo with anyone outside the Company and its time clock provider unless required by law.
How long it is kept. The photo is kept with the shift record for as long as the Company keeps that time record, which is at least three years.
No biometric measurement. The photo is a plain photograph. No software measures your face, creates a face template, or compares your photo to any database. A person looks at the photo. The Company does not collect fingerprints, face geometry, or any other biometric identifier through the time clock.
Your questions. You can ask the office how the photo is stored and who can view it. Asking questions, or raising a concern about this notice, does not affect your job.
Consent. By signing below, you confirm that you have read this notice and understand that a photo is taken each time you clock in. You agree to the collection and use of the photo as described.
Employee name (printed): ________________________________
Employee signature: ________________________________
Date: ________________________________
06
How to roll it out
- Read the template once against your own practice and confirm every statement is true for your business and your software.
- If you have employees in Illinois, Texas, or Washington, have counsel review the notice before you use it there.
- Hand the notice to every current employee, read it aloud at a crew meeting, and answer questions before anyone signs.
- Collect a signed copy from each employee and keep it with their personnel file for as long as you keep their time records.
- Turn on clock-in photos in the web app only after the last signature is in, so nobody's first photo happens before they signed.
- Give the notice to every new hire on their first day, before their first punch, and keep the signed copy.
07
What this looks like in Clox
Clock-in photos in Clox are off by default. A manager turns them on in the web app, and once on, the setting applies to everyone in the workspace, which is why the rollout steps above collect every signature first. At clock-in, the front camera opens and the worker takes one photo. The photo is saved with that shift. It is not face recognition, and Clox does not extract face data; a manager looks at the photo and decides.
The manager sees the photo where they already look at time: on the weekly approval screen, next to the shift it belongs to. If the face is not the worker's, that is the signal that someone punched for them, and the manager can reject the shift with a reason the worker sees. Crews that share one tablet, or that ban phones on site, get the same optional photo in PIN kiosk mode. The clock-in selfies doc covers the setting and what the worker sees at clock-in.
08
FAQ
Is a clock-in photo biometric data?
Do I need consent for clock-in photos in Illinois?
Can an employee refuse to sign the photo consent?
Does Clox run facial recognition on clock-in photos?
How long should I keep clock-in photos?
This is general information, not legal advice.
Clox is free for 14 days with no credit card, and the 30-day money-back guarantee covers the first paid subscription. Start a free trial, collect the signed notices, then turn on clock-in photos and review one week of punches.