BIPA

Illinois's biometric privacy law, and the litigation risk that comes with it.

It limits how companies can collect and use fingerprints, face scans, and similar data from people in Illinois, and it lets individuals sue when companies break the rules.

The Illinois Biometric Information Privacy Act, requiring written consent and a published retention schedule, with a private right of action. A private right of action means individuals can sue a company directly, instead of relying on a government agency to enforce the law.

Enacted in 2008, BIPA was the first comprehensive US biometric privacy law. A company that collects biometric identifiers, such as fingerprints, face geometry, and voiceprints, must generally do four things:

• Give notice, by telling the person in writing that biometric data is being collected and why.
• Get a written release, which is the person's written consent, and electronic signatures can count.
• Publish a retention policy, with a schedule and guidelines for permanently destroying the data.
• Protect the data, with a reasonable standard of care.

People can sue for statutory damages of $1,000 for a negligent violation or $5,000 for an intentional or reckless one.

The damages rules have changed:

1. In 2023, the Illinois Supreme Court held in Cothron v. White Castle that a separate violation could accrue with each scan or transmission.
2. In August 2024, Illinois amended the law so a person can recover for only one violation, instead of one per scan, when the same method collects the same person's data.
3. In April 2026, the US Court of Appeals for the Seventh Circuit held that the amendment applies to cases that were already pending when it took effect.

BIPA sits next to terms that are easy to mix up:

• GDPR is the EU's broader data protection law, which also treats biometric data as special.
• Consent is the written release that BIPA requires before collection.
• Biometric template is the stored mathematical summary of a trait, which BIPA can still cover.

For more, see the Privacy Hub.