Biometrics in UX.

What we are talking about

Biometrics in UX means two different things, and they are constantly confused. The first is biometric authentication: logging in with a fingerprint or face instead of a password. The second is research that records a person’s physiological reactions to an interface: where the eyes look, how the facial expression changes, where tension builds.

The first is about convenient login; the second is about understanding where the interface gets in the way. For a business these are different projects with different budgets and different legal consequences.

Alongside them stands a third, most accessible option - behavioural analytics. Formally it is not biometrics, but it solves the task of “understanding where a person stumbles” almost as well and costs incomparably less.

Fingerprint and face login

The most widespread application. Instead of a password, a person touches a sensor with a finger or shows their face - login takes a second, there is nothing to remember, and forgotten passwords stop being a reason to contact support.

The gain is twofold: the user’s journey gets shorter, and the load on the support team gets lighter. It is especially noticeable where people sign in often: personal accounts, subscription apps, internal systems.

A technical detail that removes most of the risk: on mobile platforms, fingerprint and face verification is performed on the device itself, and the biometric sample is never transmitted anywhere. The app only receives the answer “this is the device owner” - so it stores no biometric data of its own.

Biometrics in interface research

Here biometrics answers a question that neither surveys nor statistics can: what a person does involuntarily.

The best-known tool is eye tracking, which follows the movement of the gaze. It shows what a person actually saw, not what they remember. A typical result of such a test is discovering that nobody notices an important block, because the gaze passes it by along a habitual path.

Alongside it come facial-expression and skin-response recording: where confusion arises, where irritation sets in. These are all expensive methods, and small businesses usually do not need them. But it is useful to know about them: it is exactly on such research that the general rules designers rely on are built.

What is available without special equipment

Most of the benefit can be obtained with ordinary web analytics tools.

• Click maps - show where people click. Clicks on non-clickable elements say outright that the person expected a button there.
• Scroll maps - how far down people actually get. A block seen by fifteen percent of visitors can be considered non-existent.
• Session recordings - the closest substitute for watching a user: you can see the cursor darting about, repeated clicks, returns to the same spot.
• Think-aloud tests with people - ask a few people to complete a task and comment as they go. Cheap, and it finds the most problems.

These four tools cover most of the tasks for which biometrics usually comes to mind.

The legal side

Caution is needed here. In Russia, biometric personal data is a separate category, and the requirements for processing it are stricter than for ordinary data: written consent from the person, a defined purpose of processing and protection in storage.

The practical conclusion for a business: collecting and storing biometrics yourself is almost never worth it. If the task is convenient login, use the built-in device mechanisms, where verification stays on the phone. If the task is research, work with a contractor who takes consent and anonymisation upon themselves.

The same applies to any behavioural analytics: visitors must be notified that data is being collected, and the privacy policy must be a real one, not a copied one.

When it is justified

Biometric login is justified where people sign in regularly and where a password is a real obstacle. For a site a person lands on once a year, it is unnecessary complexity.

Expensive research is justified when the cost of error is high: a large online store, a medical service, an industrial interface where a wrong action is costly. In all other cases it is cheaper and faster to run an ordinary test with five people.

The universal rule: start with the cheapest method that can give an answer. If the question remains after click maps and session recordings - then it makes sense to go further.

Frequently asked questions

Does a small company need biometrics?

As a rule, no. Behavioural analytics and tests with real people provide enough information to keep improving an interface for years.

Does the app store my fingerprint?

Not when the phone’s built-in mechanisms are used. The comparison happens on the device, and the app only receives the result of the check.

How is eye tracking better than a click map?

It shows what a person saw, not only where they clicked. This matters when you need to understand why an important block is being ignored.

Is consent needed for session recordings?

Visitors must be notified that data is being collected, and recording of fields containing personal information must be switched off in the analytics system. This is a requirement for any analytics, not just biometrics.

What to do next

Switch on click maps and session recordings on a key page and watch a dozen sessions in a row. Most likely you will find two or three places where people are clearly confused - and fix them faster than the discussion of a research budget ends.

We design interfaces and analyse visitor behaviour - that is design and branding. Next, you may find useful our breakdowns of how to check a website’s usability and why a business needs UX/UI design.