White Castle just got dinged for a multi-million dollar amount for their fingerprint scanning employee tracker tech that sent biometric data to a third party in Illinois. Currently, Illinois' BIPA is the strongest and most enforced biometric law on the books in the US, but a few other states have them winding through the legislature (there are a few other niche laws, like NY and I think NJ regulate facial recognition use by residential management/landlords).

Even the big players with access to sophisticated lawyers are messing this up, and the legal landscape is only becoming more perilous. In the era of "big data distrust", I don't see why Panera thinks this is the way to go over a token on an app, or something that goes into a digital wallet.