Didit can show a biometric consent step before the first face capture for Illinois, Texas and Colorado. Modes, API fields, SDK versions and your duties.
Yes. Didit can show a consent step before the first face capture to the people covered by the Illinois (BIPA), Texas (CUBI) and Colorado biometric laws, and it records the answer on the session. You choose the mode for each application: Auto (the default), Always or Never. Didit shows the step and records the answer, but you remain responsible for deciding whether your own journey meets the laws that apply to you.
#What the consent step is
It is a screen shown before the selfie. It tells the person what is collected (their face geometry), why, who holds it and for how long, and links to the Biometric data policy. It has one button, Agree and continue, which becomes active once the person ticks the agreement box. The step appears only in a session that captures a face, such as Liveness, Face Match or Age Estimation, or the selfie taken during ID capture.
#Choose the mode
In the console, open your application's Settings, then Data and privacy, then Biometric consent. Each change is recorded in the audit log.
| Mode | What happens |
|---|---|
| Auto (default, recommended) | The step is shown where Illinois, Texas or Colorado law may apply. Everyone else sees the standard one-line notice. |
| Always | Everyone whose face is captured sees the step, wherever they are. |
| Never | Didit shows no consent step. You collect biometric consent yourself before the selfie and keep the record. |
In Auto mode the step is shown when any of these applies:
- You declared a covered state when creating the session, or sent a US address in the expected details.
- The person's IP address is in Illinois, Texas or Colorado.
- The person appears to be in the US but their state cannot be told.
- Their ID document was issued by a covered state.
#What you can send by API
Two optional fields on Create Session tell the flow what you already know:
| Field | What it does |
|---|---|
user_state | Where the person lives, as a code such as US-IL or IL. A covered state shows the step. |
biometric_consent | Consent you already collected: given_at (a time that is not in the future) and your text_version. The flow does not ask again, and the session records it as collected by you. |
See Create Session for the exact format.
#Which apps show it
| Where the person verifies | Shows the step |
|---|---|
| The hosted verification flow, the Web SDK or a WebView | Yes |
| Native SDK 4.10.0 or later (iOS, Android, and React Native or Flutter releases that bundle it) | Yes |
| A native SDK below 4.10.0 | No |
A native SDK below 4.10.0 cannot show the step, so those verifications run without it and the session records that consent was required but not collected. If you verify people in Illinois, Texas or Colorado in a native app, upgrade the SDK, or collect the consent yourself before the selfie.
#What Didit records
Didit keeps the answer on the session: when it was given, the version of the text shown, the language, the step, and the IP address, location and user agent of the request.
The decision and the webhooks carry a biometric_consent object with its status, so you can show it to an auditor.
#Related
Still stuck? Talk to a human.
Include your organization ID and the session ID you are asking about.
