Biometric authentication uses LocalAuthentication API

Biometric data (Face ID scans, fingerprint templates) is classified as sensitive biometric data under GDPR Art. 9 and is subject to heightened processing restrictions. The platform's official LocalAuthentication API (iOS) and BiometricPrompt (Android) are specifically designed so that biometric data never leaves the secure enclave — they return only a boolean pass/fail. Custom biometric implementations that attempt to capture or process biometric data directly violate GDPR Art. 9 and OWASP A07 (Identification and Authentication Failures). CWE-287 (Improper Authentication) applies when biometric auth lacks proper fallback to passcode, leaving users locked out on unenrolled devices. An implementation without hardware-availability and enrollment checks crashes on devices without biometric sensors.

Use expo-local-authentication (Expo) or react-native-biometrics (bare React Native). Always check hardware availability and enrollment before calling authenticate, and always enable device passcode as fallback.

import * as LocalAuthentication from 'expo-local-authentication'

async function authenticateUser(): Promise<boolean> {
  if (!await LocalAuthentication.hasHardwareAsync()) {
    // Fall through to passcode/password auth
    return false
  }
  if (!await LocalAuthentication.isEnrolledAsync()) {
    Alert.alert('No Biometrics', 'No biometric data enrolled. Use your passcode.')
    return false
  }
  const { success } = await LocalAuthentication.authenticateAsync({
    promptMessage: 'Authenticate to continue',
    fallbackLabel: 'Use passcode',
    disableDeviceFallback: false, // Always allow passcode fallback
  })
  return success
}

Never attempt to capture, store, or transmit biometric data directly. The platform APIs are the only compliant path — they ensure biometric templates never leave the secure enclave.