You should definitely find out if you are breaking any laws.
100% this is illegal in Illinois. They have specific biometric data protections. Probably also a crime elsewhere.
yes. and there will be more state laws in the future. seems like it would raise some FCRA concerns to me.