This would be a violation of the state's biometric privacy act (aka the Capture or Use of Biometric Identifier Act) which requires companies to get request the users' consent when collecting their ...