Illinois Biometric Privacy Laws: Collection, Consent & Penalties (2026)

Illinois regulates biometric data through the Biometric Information Privacy Act, 740 ILCS 14, which requires private entities to obtain written informed consent before collecting fingerprints, face scans, or other biometric identifiers. BIPA is the only state biometric law with a private right of action, allowing statutory damages of $1,000 per negligent violation and $5,000 per intentional violation.

Illinois stands alone among all 50 states. Its Biometric Information Privacy Act, known as BIPA, is the only biometric privacy law in the country that lets individuals sue companies directly for collecting their fingerprints, face scans, or other biometric data without proper consent.

Since its passage in 2008, BIPA has generated billions of dollars in settlements, reshaped how employers use fingerprint timekeeping systems, and forced major technology companies to change how they handle facial recognition data. If you live or work in Illinois, understanding BIPA is essential whether you are an employee, a consumer, or a business owner.

This article covers the full scope of BIPA as it stands in 2026, including the 2024 amendment that changed how damages are calculated.

What Is the Illinois Biometric Information Privacy Act?

BIPA is codified at 740 ILCS 14/1 et seq. and took effect on October 3, 2008. The Illinois General Assembly passed the law after Pay By Touch, a biometric payment company, went bankrupt in 2007. That bankruptcy raised urgent questions about what would happen to the millions of fingerprint records the company held.

Unlike a Social Security number or a password, a fingerprint cannot be changed if it is compromised. The legislature recognized that biometric data demands stronger protections precisely because of its permanence.

BIPA applies to all private entities operating in Illinois, but the law carries several built-in exemptions. Government agencies and courts are excluded from the law. Section 25(c) also exempts financial institutions and their affiliates that are already subject to Title V of the federal Gramm-Leach-Bliley Act, Section 25(d) exempts entities licensed under the Private Detective, Private Alarm, Private Security, Fingerprint Vendor, and Locksmith Act of 2004, and Section 25(e) exempts contractors and agents working for a state or local government agency.

What Biometric Data Does BIPA Protect?

Under Section 10 of BIPA, a "biometric identifier" includes:

• Fingerprints
• Retina or iris scans
• Voiceprints
• Scans of hand geometry
• Scans of face geometry

"Biometric information" is defined more broadly as any information based on a biometric identifier that is used to identify an individual. This distinction matters because it extends BIPA's protections beyond the raw scan itself to any data derived from that scan.

BIPA specifically excludes writing samples, written signatures, photographs, human biological samples used for valid scientific testing or screening, demographic data, tattoo descriptions, and physical descriptions such as height, weight, hair color, or eye color. It also excludes donated organs and tissue covered under the Illinois Anatomical Gift Act, blood or serum stored for transplant recipients, biological materials regulated under the Genetic Information Privacy Act, and information captured from a patient in a health care setting or collected, used, or stored for treatment, payment, or health care operations under HIPAA. Medical imaging is excluded as well, including X-rays, CT scans, MRIs, PET scans, and mammography.

BIPA Consent and Notice Requirements

Section 15 of BIPA establishes strict requirements that private entities must follow before collecting any biometric data.

Written Notice Before Collection

Before collecting a biometric identifier or biometric information, a private entity must inform the individual in writing that biometric data is being collected or stored. The notice must also explain the specific purpose for collecting the data and the length of time it will be retained.

Written Consent Required

After providing notice, the entity must receive a written release from the individual or their legally authorized representative. The 2024 amendment (Public Act 103-769) clarified that "written release" includes an electronic signature, defined as "an electronic sound, symbol, or process attached to or logically associated with a record and executed or adopted by a person with the intent to sign the record."

This change made compliance easier for employers and businesses that use digital onboarding systems.

No Sale or Profit from Biometric Data

Section 15(c) flatly prohibits any private entity from selling, leasing, trading, or otherwise profiting from a person's biometric identifier or biometric information. There are no exceptions to this rule.

Restrictions on Disclosure

Section 15(d) prohibits disclosing or sharing biometric data with third parties unless one of four narrow exceptions applies:

• The individual has consented to the disclosure
• The disclosure completes a financial transaction that the individual requested or authorized
• A state or federal law requires or mandates the disclosure
• A valid warrant or subpoena issued by a court of competent jurisdiction compels the disclosure

Data Retention and Destruction

Section 15(a) requires every private entity that possesses biometric data to develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information.

Destruction must occur when the initial purpose for collecting the data has been satisfied or within three years of the individual's last interaction with the private entity, whichever comes first.

Security Standards

Section 15(e) requires entities to store, transmit, and protect biometric data using a reasonable standard of care within the entity's industry. The protections must be at least as strict as those the entity uses for other confidential and sensitive information it maintains, such as Social Security numbers and financial account data.

BIPA's Private Right of Action and Damages

What sets BIPA apart from every other state biometric privacy law is Section 20, which creates a private right of action. Individuals do not need to wait for the attorney general or any government agency to act. They can file suit directly.

Damages Structure

Any person aggrieved by a BIPA violation may recover:

• Negligent violations: Liquidated damages of $1,000 or actual damages, whichever is greater
• Intentional or reckless violations: Liquidated damages of $5,000 or actual damages, whichever is greater
• Attorney fees and costs: Including expert witness fees and other litigation expenses
• Injunctive relief: Courts may issue orders to stop ongoing violations

No Actual Harm Required (Rosenbach v. Six Flags)

In Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186, the Illinois Supreme Court held that a person does not need to show actual injury or adverse effect beyond the statutory violation itself to qualify as "aggrieved" under BIPA. The court stated that "a person is prejudiced or aggrieved, in the legal sense, when a legal right is invaded by the act complained of" and that "no additional consequences need be pleaded or proved."

This ruling opened the floodgates for BIPA litigation by confirming that the mere act of collecting biometric data without consent is enough to sue.

Five-Year Statute of Limitations

BIPA does not include its own statute of limitations. In February 2023, the Illinois Supreme Court ruled in Tims v. Black Horse Carriers, Inc. that the five-year catchall limitations period under the Illinois Code of Civil Procedure applies to all BIPA claims. The court reasoned that the "full ramifications of the harms associated with biometric technology is unknown" and that a longer limitations period gives individuals more time to discover violations.

The 2024 Amendment: How Damages Changed

The Cothron v. White Castle Problem

In Cothron v. White Castle System, Inc., 2023 IL 128004 (February 17, 2023), the Illinois Supreme Court ruled 4-3 that a separate BIPA claim accrues every time a private entity scans or transmits biometric data without consent. Under this per-scan interpretation, an employer that required daily fingerprint scans for timekeeping could face thousands of individual violations per employee.

White Castle alone faced potential liability of up to $17 billion because its employees had scanned their fingerprints multiple times per shift over a period of years.

Public Act 103-769 (Effective August 2, 2024)

The Illinois General Assembly responded to the Cothron ruling by passing SB 2979, signed into law as Public Act 103-0769. The amendment made three key changes:

Single-violation rule: When a private entity collects the same biometric identifier from the same person more than once using the same method, or discloses the same biometric information to the same recipient multiple times, the repeated acts constitute a single violation. The aggrieved person is entitled to at most one recovery.

Electronic signatures accepted: The amendment added a definition of "electronic signature" and confirmed that a "written release" under Section 15(b) may be obtained through an electronic signature. This eliminated ambiguity about whether digital consent forms satisfied BIPA's written consent requirement.

Retroactivity: PA 103-0769 does not state whether it applies retroactively, and Illinois federal courts split on the question through 2025. On April 1, 2026, the Seventh Circuit held in Clay v. Union Pacific Railroad Co. that the single-violation rule is a remedial change to damages, not liability, so it applies retroactively to any case that was still pending when the amendment took effect, including cases filed and involving conduct that occurred before August 2, 2024.

Major BIPA Settlements and Verdicts

BIPA has produced the largest biometric privacy settlements in United States history. The following cases illustrate the law's financial impact:

The Clearview AI settlement was notable as the first BIPA case resolved through an equity stake rather than cash. A federal court approved a deal granting the plaintiff class a 23% ownership stake in Clearview AI, valued at approximately $51.75 million based on a $225 million company valuation.

Employer Obligations Under BIPA

BIPA litigation has disproportionately targeted employers, particularly those using fingerprint-based timekeeping systems. Employers in Illinois must take the following steps to comply with BIPA:

Before Collecting Any Biometric Data

1. Create a written biometric data policy that establishes your retention schedule and destruction guidelines. Make this policy publicly available.
2. Provide written notice to each employee explaining what biometric data you will collect, why you are collecting it, and how long you will retain it.
3. Obtain written consent from each employee before the first scan. An electronic signature on a digital form satisfies this requirement after the 2024 amendment.

During Employment

4. Never share biometric data with third-party vendors (such as timekeeping software providers) without employee consent or unless a statutory exception applies.
5. Protect biometric data with at least the same level of security you use for Social Security numbers and financial account information.
6. Do not sell or profit from employee biometric data under any circumstances.

After Employment Ends

7. Destroy biometric data when the purpose for collecting it has been satisfied or within three years of the employee's last interaction with your organization, whichever comes first.

Current BIPA Litigation Landscape (2025-2026)

Despite the 2024 amendment reducing potential damages exposure, BIPA litigation remains active. Approximately 150 new BIPA class actions were filed in 2025, though that number represents a decline from the 427 filings in 2024.

Key trends shaping current BIPA litigation include:

AI and facial recognition targets. Courts have examined whether artificial intelligence systems that create voice clones or provide skincare assessments using facial data violate BIPA. One court held that "receiving advice from AI was not medical treatment" and therefore the healthcare exemption did not apply.

Mass arbitration. BIPA has become a staple of mass arbitration claims, with plaintiffs' firms using individual arbitration demands rather than class actions to pressure settlements.

Expanding industry targets. Recent cases have targeted cosmetics retailers using virtual try-on technology, photo storage platforms licensing images for AI training, and education technology companies collecting student voice and face data.

Class certification success. Both state and federal courts in Illinois have continued granting contested motions to certify BIPA class actions, finding that common questions about an entity's consent and notice practices predominate over individual issues.

Total BIPA class action settlements in 2025 reached approximately $136.6 million, a decline from 2024's $206 million total, reflecting the single-violation amendment's impact on damages calculations.

How BIPA Compares to Other State Biometric Laws

Several states have enacted biometric privacy laws following Illinois's lead, but none match BIPA's enforcement power:

Texas has a biometric privacy statute (Tex. Bus. & Com. Code Chapter 503) but enforcement rests solely with the attorney general. There is no private right of action. The Texas AG secured a $1.4 billion settlement from Meta in 2024.

Washington passed a biometric identifier law (RCW 19.375) but it also lacks a private right of action and has produced minimal litigation.

Colorado, Connecticut, and Virginia include biometric data protections within their comprehensive consumer privacy laws but do not provide private rights of action for biometric violations specifically.

Illinois's private right of action remains the single feature that makes BIPA the most consequential biometric privacy law in the country.

For more on how BIPA fits within Illinois's broader privacy framework, see the parent guide on Illinois Data Privacy Laws.

This article provides general legal information about the Illinois Biometric Information Privacy Act and is current as of March 2026. It is not legal advice. Consult a licensed Illinois attorney for guidance on your specific situation.

• Illinois AI Meeting Recording Laws
• Illinois Alimony Laws
• Illinois At-Will Employment Laws
• Illinois Car Accident Laws
• Illinois Car Seat Laws
• Illinois Child Custody Laws
• Illinois Child Support Laws
• Illinois Common Law Marriage Laws
• Illinois Dashcam Laws
• Illinois Deepfake Laws
• Illinois Divorce Laws
• Illinois Dog Bite Laws
• Illinois Drone Laws
• Illinois Emancipation Laws
• Illinois Employee Monitoring Laws
• Illinois Expungement Laws

More Illinois Laws

• Illinois Deepfake Laws
• Illinois Employee Monitoring Laws
• Illinois GPS Tracking Laws
• Illinois Recording Laws

Frequently Asked Questions

Does BIPA apply to photographs or video recordings?

No, not by themselves. BIPA specifically excludes photographs from the definition of biometric identifier, and extracting data from a photograph does not automatically change that. Courts applying the statute ask two questions about the extracted data: is it a scan of face geometry, and is it capable of identifying a person. Both have to be true. In Doe v. Apple, decided September 30, 2026, the Southern District of Illinois applied that two-part test and held that a face crop, meaning the cropped image software produces after locating a face in a photo without measuring its geometry, is not a biometric identifier, because the location of a face within a photo says nothing about that face's geometry. A face geometry scan capable of identifying the person it came from is covered by BIPA; a derived image that merely located the face is not.

Can my employer require a fingerprint scan as a condition of employment?

Yes, but only after meeting BIPA's notice and consent requirements. Your employer must provide written notice explaining what biometric data is being collected and why, and must obtain your written consent before the first scan. A written release executed as a condition of employment satisfies the consent requirement under Section 15(b).

How long does a company have to keep my biometric data?

A company must destroy your biometric data when the original purpose for collecting it has been satisfied or within three years of your last interaction with the company, whichever comes first. For employees, this typically means destruction within three years after your last day of employment.

What should I do if I believe a company violated my rights under BIPA?

You can file a lawsuit directly in Illinois state circuit court. You do not need to file a complaint with any government agency first. Under the Rosenbach v. Six Flags ruling, you do not need to prove actual harm. The statutory violation itself is sufficient. Many BIPA cases are filed as class actions. The statute of limitations is five years from the date of the violation.

Does the 2024 BIPA amendment reduce what I can recover in damages?

The 2024 amendment (Public Act 103-769) limits recovery so that repeated collections of the same biometric data from the same person count as a single violation rather than one violation per scan. You can still recover $1,000 for a negligent violation or $5,000 for an intentional violation, plus attorney fees and costs. The change means you receive one damages award per violation type rather than a separate award for every individual scan.