BIPA explained: Illinois biometric privacy rights and lawsuits

Illinois enacted BIPA in 2008. It protects two categories of data:

• Biometric identifiers: BIPA defines a biometric identifier as a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry, and excludes things like photographs, signatures, writing samples, and physical descriptions.
• Biometric information: any information based on a biometric identifier that is used to identify a person, such as a face template stored in a database.

BIPA applies to private entities, not state or local government agencies or Illinois courts. It protects people whose biometric data is collected in Illinois, which in practice usually means Illinois residents. Common situations include:

• Fingerprint or hand-scan time clocks at work.
• Face recognition in photo apps and social networks.
• Virtual try-on tools for glasses and makeup.
• Voiceprint authentication at banks and call centers.
• Identity verification that matches a selfie to an ID.

See our page on biometric privacy lawsuits for current cases.

Section 15 of the Act sets five rules:

1. Written policy (15(a)). Publish a retention schedule and destroy biometric data when the purpose is satisfied or within 3 years of the person's last interaction, whichever comes first.
2. Notice and consent (15(b)). Before collecting biometric data, a company must inform the person in writing that it is being collected, state the specific purpose and how long it will be stored and used, and receive a written release.
3. No selling or profiting (15(c)). A company may not sell, lease, trade, or otherwise profit from biometric data.
4. No disclosure without consent (15(d)). A company generally may not disclose biometric data to others without consent or a legal requirement.
5. Reasonable security (15(e)). Biometric data must be protected at least as carefully as other confidential information.

Most BIPA lawsuits are about Section 15(b), where the company never gave notice or never got a written release. After a 2024 amendment, a "written release" can include an electronic signature.

Under 740 ILCS 14/20, a prevailing party can recover $1,000 in liquidated damages for each negligent violation and $5,000 for each intentional or reckless violation, or actual damages if greater, plus reasonable attorney fees, costs, and an injunction.

Three decisions and one amendment shape the numbers today:

• Rosenbach v. Six Flags (Ill. January 25, 2019). The Illinois Supreme Court held that a person need not allege actual injury or adverse effect, beyond the violation of their rights under the Act, to be "aggrieved" and seek liquidated damages.
• Tims v. Black Horse Carriers (Ill. February 2, 2023). All BIPA claims are subject to a five-year statute of limitations.
• Cothron v. White Castle (Ill. February 17, 2023). A separate claim accrued each time biometric data was unlawfully collected or disclosed, which raised the prospect of damages for every fingerprint scan.
• The 2024 amendment (Public Act 103-769, effective August 2, 2024). The legislature responded to Cothron: repeated collection of the same biometric data from the same person by the same method is now a single violation, with at most one recovery. The same rule applies to repeated disclosures to the same recipient.

• Facebook, $650 million. On February 26, 2021, Judge James Donato of the Northern District of California approved a $650 million settlement for Illinois Facebook users over face recognition, saying it would put at least $345 into the hands of every class member who wanted to be compensated. It remains one of the largest privacy settlements ever.
• Snapchat, $35 million. Illinois residents who used Snapchat Lenses or Filters from November 17, 2015 were covered by a $35 million settlement of BIPA claims in DuPage County, Illinois. Payments have been made. See the Snapchat BIPA settlement.
• TikTok, $92 million. In the TikTok privacy settlement in federal court in Illinois, the plan of allocation gave each valid Illinois Subclass claim five extra pro rata shares on top of the single share paid to every nationwide claimant, reflecting the added value of Illinois biometric claims. See the TikTok privacy settlement and our TikTok lawsuit page.

Payments in consumer BIPA settlements usually depend on how many people file claims, so amounts vary widely. See how class action money is divided.

You may have a claim if all of these are true:

• A company scanned your fingerprint, hand, face, iris, or voice, or created a template from it.
• It happened in Illinois, typically while you lived or worked there.
• You never received a written notice explaining the purpose and retention period, or never signed a release.
• It happened within the last five years.

You likely do not have a BIPA claim if the collector was a government agency, if the data was an ordinary photo that was never used to create a face template, or if you signed a clear written consent. Many consumer apps have arbitration clauses that can block class actions.

BIPA claims must be filed within five years, the limitations period the Illinois Supreme Court applied to all BIPA claims in 2023. Save any sign-up screens, employee handbooks, or consent forms you received, and note when the collection started. Outside Illinois, biometric data may be protected by general state privacy laws; see California class action settlements. For a closer look at privacy cases, see Amazon Alexa privacy and Google lawsuits. If you think your biometric data was collected without consent, a free case review takes about two minutes.