Illinois BIPA (Biometric Information Privacy Act)

The Biometric Information Privacy Act, 740 ILCS 14, is an Illinois law passed in 2008 that controls how private companies collect, store, and share biometric identifiers. The law defines those as a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry. Before collecting them, a company must tell the person in writing what is being collected and why, say how long it will be kept, and get a written release.

Companies must also publish a retention policy and destroy the data once its purpose is served or within 3 years of the person's last interaction with the company, whichever comes first. BIPA lets any aggrieved person recover $1,000 in liquidated damages for each negligent violation, or $5,000 for each intentional or reckless violation, plus attorneys' fees.

That private right of action is why BIPA produced so many class actions, including cases against employers using fingerprint time clocks and tech companies using face recognition. An amendment effective August 2, 2024 (Public Act 103-769) changed the math: a company that collects the same biometric data from the same person by the same method now commits a single violation, with at most one recovery, rather than a new violation every scan. The amendment also confirmed that an electronic signature counts as written consent.

You generally need to have been in Illinois when your data was collected. See our BIPA lawsuit page, the plain-English BIPA explainer, and the Snapchat BIPA settlement for a real example of how these cases resolve.