Is fingerprint or facial clock-in legal in 2026?

If your company uses fingerprint, facial recognition, or iris scanning for time tracking, you have a problem. And it’s not a small one.

Spain’s Data Protection Agency (AEPD) has made it clear that these systems are illegal for recording working hours. In 2024, it fined dozens of companies with penalties exceeding €2 million in total.

Why is biometric time tracking illegal?

Article 9 of the GDPR classifies biometric data (fingerprint, iris, facial features) as special category data. Its processing is prohibited* except for very specific exceptions.

The AEPD, in its Guide on presence control through biometric systems, establishes that:

1. It’s disproportionate: Less invasive alternatives exist for clocking in
2. Consent is not valid: In an employment relationship, the worker cannot give “free” consent (there’s a power imbalance)
3. It doesn’t pass the necessity test: Time tracking can be done without collecting biometric data

In summary: just because you can do it doesn’t mean you should.

Is facial-recognition clock-in legal?

No. Facial recognition is special-category biometric data (Article 9 of the GDPR), exactly like a fingerprint, so the AEPD treats it under the same restrictions: for ordinary time tracking it fails the proportionality test, and a worker’s consent isn’t considered freely given. The fact that a phone camera or a kiosk makes it convenient doesn’t make it legal.

And this isn’t just theory. In the case of Jordi Cruz’s ABaC restaurant, facial clock-in ended up working against the company. If you need to identify a worker on a shared device, the legal route is a PIN in kiosk mode, not their face.

The fines are real

This isn’t theory. The AEPD is taking action:

• 2024: Fines exceeding €2 million to companies for improper biometric time tracking
• Obligation to cease: Sanctioned companies must delete collected biometric data
• No size exceptions: It doesn’t matter if you’re an SME or a large company

And with the new mandatory digital time tracking regulations in 2026, the Labour Inspectorate is paying more attention than ever to how companies track time, not just whether they do.

Which time tracking systems ARE legal?

The AEPD and labour regulations accept non-biometric systems:

• ✅ Mobile app with username and password
• ✅ Web with credentials
• ✅ Shared tablet/computer with personal PIN (kiosk mode)
• ✅ RFID card
• ✅ QR code

The key is that the system identifies the worker without collecting biometric data.

Kiosk mode: the alternative for shared devices

“Okay, but we had fingerprint because the device is shared. Not every employee has a company phone.”

We understand the problem. That’s why kiosk mode exists.

How does it work?

1. You place a tablet, phone, or computer at an accessible point (entrance, reception, warehouse…)
2. The employee approaches, enters their personal PIN, and clocks in
3. The system records the time, the employee, and which workplace the clock-in was made at

Advantages over fingerprint

Fingerprint	Kiosk mode with PIN
❌ Illegal according to AEPD	✅ 100% legal
❌ Sensitive biometric data	✅ Just a PIN (basic data)
❌ Risk of sanction	✅ GDPR compliant
❌ Problems if the reader fails	✅ Always works
❌ Specific hardware cost	✅ Any device works

Multiple workplaces

If you have multiple locations (stores, warehouses, offices), you can have a kiosk mode device at each one. The system automatically records where each employee clocked in.

This is especially useful for:

• Store chains
• Companies with multiple warehouses
• Businesses with workers rotating between locations

What to do if you still use biometric time tracking?

1. Stop now. Every day that passes is a risk
2. Don’t wait for the fine. The AEPD can act on its own initiative
3. Migrate to a legal system. The change is easier than it seems
4. Delete the biometric data you’ve collected

Cleverfy: legal time tracking without complications

At Cleverfy, we don’t use biometrics. Period.

Our system allows:

• Mobile app for employees with smartphones
• Kiosk mode for shared devices (tablet, computer)
• Personal PIN for quick and secure identification
• Workplace-based tracking if you have multiple locations
• Full compliance with GDPR and 2026 Spanish labour regulations

Try Cleverfy for free →

---

* Update (August 2026): the National Court annulled the AEPD guide on biometric attendance monitoring (SAN 367/2026), but on a procedural defect, not on the merits. Biometric data remain a special category under the GDPR and using it to clock in is still restricted. We explain it in detail in The National Court annuls the AEPD guide on biometric time tracking.