Behavioral Biometrics: Admissibility in Courts — Detailed Explanation with Case Laws

1. Meaning of behavioral biometrics

Behavioral biometrics identifies or authenticates a person from patterns in the way they behave rather than from a physical characteristic alone.

Examples include:

• typing/keystroke dynamics;
• mouse movements;
• touchscreen interaction;
• signature dynamics;
• voice characteristics;
• walking/gait patterns;
• device-handling patterns;
• navigation behaviour;
• transaction behaviour;
• interaction with banking applications; and
• combinations of device and behavioural signals.

For example, a bank may determine that a person normally:

types at a particular rhythm + moves the mouse in a characteristic pattern + uses a familiar device + follows a characteristic transaction sequence.

A sudden deviation can trigger additional authentication.

The legal question is different from the technical question.

Technical question: Can the system identify the person reliably?

Legal question: Can the resulting evidence lawfully be collected, authenticated, disclosed and relied upon before a court?

There is no universal rule that behavioral biometric evidence is automatically admissible or inadmissible. Its treatment depends upon the jurisdiction, purpose, reliability, method of collection, chain of custody and applicable privacy/data-protection rules.

2. Why behavioral biometric evidence is legally significant

Behavioral biometric evidence can potentially be used to prove:

• who accessed an account;
• who operated a computer;
• whether a particular person performed an online transaction;
• whether a disputed electronic signature was genuinely created by a particular user;
• whether a defendant was using a particular device;
• whether fraudulent activity was likely conducted by the account holder or another person;
• whether an employee accessed confidential information; or
• whether an automated fraud-detection system correctly associated activity with a particular user.

But behavioral evidence normally provides a probabilistic inference, not an absolute identification.

That distinction is extremely important in litigation.

3. Evidence is different from authentication

A court normally has to distinguish between:

Authentication

Does the evidence genuinely represent what the party claims it represents?

Reliability

Is the technology sufficiently reliable to justify the inference?

Weight

Even if admitted, how much should the judge or jury rely upon it?

A behavioral-biometric system might therefore be admitted while ultimately being given limited evidentiary weight.

For example:

“The defendant's typing pattern was 97% similar to the enrolled profile”

does not automatically establish:

“The defendant personally performed the transaction.”

The court must consider alternative explanations such as:

• another person using the device;
• compromised credentials;
• remote access;
• malware;
• shared devices;
• changed behaviour;
• insufficient sample size;
• algorithmic error; or
• defective data collection.

4. The basic admissibility framework

A useful legal framework is:

Relevance

↓

Authenticity

↓

Reliability

↓

Lawful acquisition

↓

Integrity/chain of custody

↓

Expert foundation

↓

Disclosure and procedural fairness

↓

Probative value versus prejudicial effect

↓

Weight given by the court

This is particularly important because behavioral biometrics is generally more technically complex than ordinary documentary evidence.

5. Behavioral biometrics and electronic evidence

Behavioral biometric evidence will often exist as electronic evidence.

For example:

• server logs;
• authentication logs;
• keystroke datasets;
• application telemetry;
• device fingerprints;
• transaction records;
• IP information;
• timestamp records;
• algorithmic scores;
• model outputs.

The party relying upon the evidence therefore normally needs to establish that the electronic record is authentic and has not been materially altered.

A court will be much more comfortable with:

raw system records + methodology + audit logs + expert explanation

than with:

“Our AI system says this was the defendant.”

6. Expert evidence

Expert evidence becomes particularly important where the court cannot independently evaluate the underlying biometric methodology.

An expert may need to explain:

• how the behavioural profile was created;
• how many observations were used;
• what variables were measured;
• how the algorithm operates;
• error rates;
• false-positive rates;
• false-negative rates;
• population testing;
• validation methodology;
• confidence intervals;
• whether the model was independently validated;
• whether the system was changed after the relevant event; and
• limitations of the identification.

The expert should distinguish between:

“The evidence is consistent with this person.”

and

“This evidence proves beyond reasonable doubt that this person performed the action.”

Those are very different propositions.

7. Spain: general evidentiary framework

For Spanish litigation, behavioral biometric evidence can potentially be introduced through the ordinary rules governing documentary, electronic and expert evidence.

Relevant provisions include the Spanish Civil Procedure Act (Ley 1/2000, de Enjuiciamiento Civil) and, for criminal proceedings, the Ley de Enjuiciamiento Criminal.

Electronic evidence may be presented through documentary or other evidentiary mechanisms depending upon the circumstances.

The court will ultimately assess:

• authenticity;
• integrity;
• reliability;
• provenance;
• expert evidence; and
• the evidentiary value of the material.

There is not a special Spanish evidentiary category called “behavioral biometric evidence” that automatically determines admissibility.

8. Spanish electronic-signature framework

Behavioral biometrics can be particularly important where it forms part of an electronic-signature system.

EU eIDAS Regulation (Regulation (EU) No 910/2014) establishes the European framework for electronic identification and electronic signatures.

A crucial principle is that an electronic signature cannot be denied legal effect merely because it is electronic or because it does not qualify as a qualified electronic signature.

This is important for litigation.

A behavioral biometric component may therefore contribute to evidence establishing that an electronic transaction was authenticated by a particular person.

However:

authentication evidence is not necessarily the same thing as a qualified electronic signature.

The legal status of the transaction must be analysed separately.

9. GDPR and biometric data

A major issue arises before admissibility is even considered:

Was the biometric information lawfully processed?

Under the GDPR, biometric data processed for the purpose of uniquely identifying a natural person generally falls within Article 9's special categories of personal data.

Behavioral biometric information can therefore create substantial data-protection obligations.

Relevant principles include:

• lawfulness;
• fairness;
• transparency;
• purpose limitation;
• data minimisation;
• accuracy;
• storage limitation;
• security; and
• accountability.

The legal basis for processing must also be established.

10. Illegally obtained evidence

One of the most important distinctions is:

Unlawful processing does not automatically produce the same evidentiary consequence in every legal system.

A breach of GDPR may result in:

• regulatory enforcement;
• compensation;
• administrative penalties;
• orders concerning processing;

but whether the evidence is excluded from court proceedings depends upon the applicable procedural/evidentiary law.

In Spain, criminal proceedings have particularly important rules concerning evidence obtained in violation of fundamental rights.

11. Spanish constitutional protection

Article 18 of the Spanish Constitution protects, among other things:

• privacy;
• personal and family life;
• honour;
• image;
• secrecy of communications.

Behavioral biometric surveillance can therefore potentially implicate constitutional rights.

Where the state obtains biometric or behavioural information through intrusive surveillance, the constitutional analysis can become significantly stricter than in an ordinary private commercial dispute.

12. Case law — Barbulescu v Romania

ECtHR, Grand Chamber, Barbulescu v. Romania, Application No. 61496/08, judgment 5 September 2017.

This case concerned workplace monitoring rather than behavioral biometrics specifically.

The European Court of Human Rights examined the employee's right to privacy in the workplace under Article 8 of the European Convention on Human Rights.

Importance

The Court emphasised the need for adequate safeguards when employers monitor employees' communications.

Behavioral-biometric relevance

If an employer collects:

• keystroke behaviour;
• application interaction;
• mouse patterns;
• behavioural profiles;

the employer cannot assume that workplace systems eliminate the employee's privacy rights.

The proportionality of the monitoring matters.

13. López Ribalda and Others v Spain

ECtHR, Grand Chamber, Applications Nos. 1874/13 and 8567/13, judgment 17 October 2019.

The case concerned covert video surveillance of employees in a Spanish supermarket.

The Court considered whether covert monitoring violated Article 8.

Importance for behavioral biometrics

Although the case did not concern behavioral biometric algorithms, it is highly relevant because it establishes principles concerning workplace surveillance.

Factors include:

• transparency;
• scope of monitoring;
• legitimate purpose;
• extent of intrusion;
• consequences for employees;
• safeguards against abuse.

A Spanish employer using behavioral biometrics to continuously profile employees would therefore need to consider similar proportionality concerns.

14. S. and Marper v United Kingdom

ECtHR, Applications Nos. 30562/04 and 30566/04, judgment 4 December 2008.

This landmark case concerned retention of fingerprints and DNA profiles by authorities.

The Court found that indiscriminate retention violated Article 8.

Importance

The case demonstrates that biometric information has a special privacy dimension even where the information is used for legitimate law-enforcement purposes.

Behavioral-biometrics implication

The legal concern is not limited to fingerprints or DNA.

A behavioral profile capable of persistently identifying a person can also create substantial privacy implications.

15. Gaughran v United Kingdom

ECtHR, Application No. 45245/15, judgment 13 February 2020.

The Court considered indefinite retention of biometric information following a conviction.

The case reinforces the principle that biometric retention requires appropriate safeguards and proportionality.

Relevance

If a behavioral-biometric database is retained indefinitely, courts and regulators may scrutinise:

• retention period;
• purpose;
• necessity;
• safeguards;
• possibility of deletion.

16. Digital Rights Ireland

CJEU, Joined Cases C-293/12 and C-594/12.

The case concerned the EU Data Retention Directive.

The CJEU invalidated the Directive because of serious interference with fundamental rights that was not sufficiently limited by appropriate safeguards.

Behavioral-biometric significance

Large-scale behavioural monitoring raises similar questions:

How much information is collected?

For what purpose?

For how long?

Who can access it?

What safeguards exist?

The fact that technology can collect information does not itself establish that unlimited collection is legally permissible.

17. Tele2 Sverige / Watson

CJEU, Joined Cases C-203/15 and C-698/15.

The Court examined general and indiscriminate retention of communications data.

It placed strong emphasis on necessity and proportionality.

Relevance

Behavioral biometric systems can produce detailed behavioural profiles.

For example, a system could theoretically record:

• when a person logs in;
• how they type;
• how they move through applications;
• what transactions they initiate;
• which devices they use.

The more comprehensive the behavioural profile, the stronger the proportionality analysis becomes.

18. Schrems II

CJEU, Case C-311/18.

Although the case concerned international data transfers rather than courtroom admissibility, it is highly relevant to the underlying legality of biometric-data processing.

The CJEU emphasised the importance of effective protection for personal data when transferred outside the EU.

Practical significance

A Spanish bank using a behavioral-biometric provider located outside the EU must consider whether the relevant personal data are lawfully transferred and protected.

19. Banking example

Imagine a Spanish bank receives a claim:

“I did not make the €50,000 online transfer.”

The bank produces:

• login record;
• device information;
• IP information;
• keystroke dynamics;
• mouse movement;
• transaction sequence;
• behavioral-biometric score of 98.7%.

The bank argues that the customer made the transaction.

Court analysis

The judge may ask:

1. Was the account actually accessed from the customer's device?

2. Was the behavioral system operating correctly?

3. How was the customer's reference profile created?

4. What is the false-positive rate?

5. How independent was the validation?

6. Could malware or remote-access software produce the same pattern?

7. Could another person have used the customer's device?

8. Were the logs securely preserved?

9. Was the data lawfully collected?

10. Can the expert explain the methodology in a reproducible way?

The behavioral score should generally be treated as one evidentiary element within the complete digital record, rather than an infallible identification.

20. AI-generated biometric conclusions

The legal situation becomes more complicated when machine-learning models produce the identification.

Suppose a bank's system says:

“Probability that the user is the enrolled customer: 99.2%.”

The court should not simply treat the number as self-proving.

Important questions include:

• What dataset trained the model?
• Was the relevant person included in validation?
• What is the base rate?
• How is the 99.2% figure calculated?
• What does “probability” actually mean?
• Was the model modified after the transaction?
• Can the result be reproduced?
• Were false positives tested?
• Was the algorithm independently audited?

An impressive numerical score can still be legally weak if the methodology cannot be demonstrated.

21. European AI Act

The EU Artificial Intelligence Act (Regulation (EU) 2024/1689) adds another layer.

AI systems involving biometric identification and related applications can fall within different regulatory categories depending upon their purpose and deployment.

The regulatory consequences can be substantially different for:

• ordinary authentication;
• biometric categorisation;
• remote biometric identification;
• law enforcement;
• employment;
• access to essential services.

Therefore, an organisation cannot assume that all behavioral-biometric AI systems are regulated identically.

22. Criminal proceedings

The threshold for relying on behavioral biometrics can be especially significant in criminal cases.

Suppose prosecutors argue:

“The accused's typing pattern proves that he sent the threatening message.”

The defence could challenge:

• scientific validity;
• collection method;
• database construction;
• statistical error;
• alternative users;
• device sharing;
• malware;
• expert qualifications;
• chain of custody.

The court must distinguish between:

evidence capable of supporting an inference

and

evidence capable of establishing guilt to the required standard.

Behavioral biometrics rarely should be treated as self-authenticating proof of identity.

23. Civil proceedings

Civil courts may encounter behavioral biometric evidence in:

• banking disputes;
• electronic-contract disputes;
• employment litigation;
• insurance claims;
• intellectual-property disputes;
• online fraud;
• digital-signature disputes.

The standard of proof may differ from criminal proceedings, but authenticity and reliability remain important.

24. Case-law principle: technology is not automatically evidence

The central legal principle emerging from electronic-evidence jurisprudence is:

The existence of sophisticated technology does not eliminate the requirement to establish authenticity and reliability.

This is especially important for behavioral biometrics because the underlying evidence is often probabilistic.

A court should ideally be given:

raw evidence → processing methodology → validation → expert interpretation → conclusion

rather than simply:

algorithm → “match.”

25. Chain of custody

For litigation, organisations should preserve:

• original logs;
• timestamps;
• system configuration;
• relevant model version;
• audit records;
• authentication records;
• device information;
• relevant database entries;
• hash values where appropriate;
• access records;
• expert methodology.

If a bank changes its behavioral model every month, it may be important to establish which model produced the historical result.

Otherwise the opposing party can argue:

“The evidence was generated by a system that did not exist in its present form when the transaction occurred.”

26. Reliability factors courts should consider

A strong behavioral-biometric evidentiary foundation should address:

Scientific validity

Has the technique been scientifically validated?

Error rate

What is the false-positive and false-negative rate?

Sample size

Was enough behavioural data available?

Individual variability

Can legitimate changes in behaviour cause misidentification?

Environmental factors

Can device, keyboard, touchscreen or network conditions affect the result?

Reproducibility

Can an independent expert reproduce the result?

Algorithmic transparency

Can the relevant methodology be explained?

Data integrity

Were the underlying records preserved?

Alternative explanations

Could another person produce the same behavioural pattern?

27. Admissibility versus weight

This is perhaps the most important courtroom distinction.

A judge may say:

“I admit the behavioral-biometric evidence.”

That does not necessarily mean:

“I accept the identification as conclusive.”

The evidence may be admitted but given limited weight because of:

• high error rates;
• insufficient validation;
• weak chain of custody;
• lack of transparency;
• alternative explanations.

Conversely, a well-validated system supported by multiple independent digital records can have substantial evidentiary weight.

28. Practical admissibility checklist

29. Key legal conclusion

Behavioral biometric evidence is not inherently inadmissible merely because it is generated by an algorithm, nor is it automatically conclusive merely because it is biometric.

Its legal strength depends upon the entire evidentiary chain.

For Spain and the EU, the analysis should combine:

Spanish procedural evidence law

EU electronic-identification/e-signature law

GDPR

EU AI regulation

fundamental-rights jurisprudence

scientific reliability and expert-evidence principles.

The most useful European authorities include S. and Marper v UK*, Gaughran v UK, Barbulescu v Romania, López Ribalda v Spain, Digital Rights Ireland, Tele2 Sverige/Watson and *Schrems II. These cases do not establish a single rule saying that behavioral biometrics is admissible or inadmissible; instead, they establish the surrounding principles of privacy, proportionality, lawful processing, safeguards and reliability that determine how such evidence can legitimately be collected and subsequently used.

Bottom line

For a Spanish bank or business defending a transaction in court, the strongest approach is not to rely solely on a behavioral-biometric score. The stronger evidentiary package is:

behavioral biometric evidence + transaction record + device information + authentication logs + secure audit trail + expert validation + evidence of lawful processing.

That combination allows the court to assess the biometric conclusion as part of a demonstrable and independently verifiable evidentiary chain rather than treating an opaque algorithmic output as unquestionable proof.