BIPA Lawsuit: Illinois Biometric Privacy Claims for Fingerprint and Face Scans

The Illinois Biometric Information Privacy Act, passed in 2008, is the strictest biometric privacy law in the country and the only one that lets ordinary people sue. It covers biometric identifiers such as a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry, and information derived from them.

Section 15 of the law sets five core rules for private companies:

• 15(a): publish a written retention and destruction policy, and destroy the data when its purpose is done or within 3 years of the person's last interaction, whichever comes first.
• 15(b): before collecting, inform the person in writing, state the purpose and how long the data will be kept, and get a written release.
• 15(c): never sell, lease, trade, or otherwise profit from biometric data.
• 15(d): do not disclose it to others without consent or another listed exception.
• 15(e): store and protect it with reasonable care.

Most BIPA lawsuits fall into a few groups:

Workplace timeclocks

The largest group involves employers who had workers clock in with a fingerprint, hand, or face scanner without written consent. Timeclock vendors are often sued too, because the scans flow to their systems. Settlements in these cases can pay individual workers hundreds of dollars.

Photo and social apps

Facebook, Google Photos, and Snapchat were each sued over features that scanned faces in photos or applied face filters. These produced some of the biggest privacy settlements in U.S. history. See our page on the Snapchat $35 million BIPA settlement.

Retail, beauty, and hiring tools

Newer suits target virtual makeup try-on tools, skin analysis apps, and video interview software that analyze faces or voices. The $4.7 million Neutrogena Skin360 settlement is an example.

Three Illinois Supreme Court decisions and one amendment define the current rules.

Ruling or law	Date	Effect
Rosenbach v. Six Flags	January 25, 2019	No actual harm needed
Tims v. Black Horse Carriers	February 2, 2023	Five-year limit for all claims
Cothron v. White Castle	February 17, 2023	Each scan was a new claim
SB 2979 amendment	August 2, 2024	One recovery per person per method

Cothron raised the prospect of damages multiplied by every daily fingerprint scan, which could reach billions of dollars for large employers. The legislature responded. Under the amendment effective August 2, 2024, a company that repeatedly collects the same biometric data from the same person using the same method has committed a single violation, entitling the person to "at most, one recovery." The same rule applies to repeated disclosures to the same recipient. The amendment also confirmed that an electronic signature counts as a written release.

Whether the amendment reached older cases was hotly disputed until April 1, 2026, when the Seventh Circuit held in Clay v. Union Pacific Railroad Co. that the damages limit is a remedial change that applies retroactively to cases pending when it took effect. That ruling binds federal courts in Illinois, Indiana, and Wisconsin. The practical result is that BIPA claims are now valued per person rather than per scan, which lowers settlement values but also makes settlements easier to reach.

New suits keep coming, especially against employers and technology vendors, and settlements keep opening for claims. All claims in pending cases are allegations until a court rules.

You may have a claim if all of these are true:

1. The collection happened in Illinois. You do not need to live in Illinois now, but the scan must have taken place there. Courts look at where the person and the device were.
2. A biometric identifier was involved: fingerprint, hand geometry, face geometry, retina or iris, or voiceprint. Photos alone are not biometric identifiers, but software that maps facial features in photos can be.
3. The company skipped a step: no written notice, no stated purpose or retention period, no signed release, no public retention policy, or sharing the data without consent.
4. It happened within five years.

People who probably do not qualify:

• People outside Illinois when the scan occurred. Other states' biometric laws, such as those in Texas and Washington, are enforced by the state attorney general, not by private lawsuits.
• Patients whose biometric data was collected in a health care setting, which the statute excludes.
• Workers whose employers got a signed consent form that met the law's requirements.
• Many employees of banks and other financial institutions covered by federal privacy rules, which BIPA exempts.

Unionized workers face a special hurdle: courts have held that some BIPA claims by union members must go through the grievance process under their collective bargaining agreement. Many employers also require arbitration. Our BIPA explainer goes deeper on these issues.

Workplace timeclocks produce more BIPA cases than any other setting. If you are trying to figure out whether your job counts, start with how you clocked in:

• Finger, hand, or face scanners at the timeclock are the classic BIPA fact pattern. A PIN pad or badge swipe alone is not biometric.
• Phone apps that use face matching to verify you at clock-in can also count, depending on how they work.
• Former employees can bring claims too, as long as the scans happened in Illinois within the five-year period.

Check your onboarding paperwork for a biometric consent form. Since the 2024 amendment, an electronic signature counts as a written release, so a click-through form in a hiring portal may satisfy the law if it contained the required disclosures. The law requires consent before collection begins, so a form signed after months of scanning may not cover the earlier scans, a point employers often dispute.

Timeclock vendors are frequent defendants because the scans are stored on their systems. That can matter if your employer has gone out of business or requires arbitration, since the vendor may not have an agreement with you. If you were told to sign a consent form or lose your job, mention that to an attorney.

Some timeclock settlements pay automatically to everyone on the employer's payroll records, with no claim form, so keep your address current with former employers if you have worked in Illinois.

Under 740 ILCS 14/20, a person can recover liquidated damages of $1,000 for each negligent violation or $5,000 for each intentional or reckless violation, or actual damages if greater, plus attorney fees. These are statutory damages, so you do not need to show financial loss.

After the 2024 amendment, repeated scans by the same method count once. A worker who scanned a finger twice a day for three years without consent now has, at most, one recovery for the collection claim, not thousands. Separate violations, such as a missing retention policy or unauthorized sharing with a vendor, can still be pleaded as distinct claims.

Real settlements show the range:

Settlement	Fund	Per-person result
Facebook (N.D. Cal., 2021)	$650 million	At least $345 each
Google Photos (Cook County, 2022)	$100 million	Pro rata share
Snapchat (2022)	$35 million	Pro rata share
Neutrogena Skin360 (D.N.J., 2026)	$4.7 million	Pro rata share

In the Facebook case, Judge James Donato approved the $650 million settlement on February 26, 2021, and about 1.6 million Illinois users filed claims. Workplace timeclock settlements have smaller funds but fewer claimants, so individual payments can land in the hundreds of dollars. Consumer app settlements with huge classes pay less per person. See how class action money is divided.

Some BIPA settlements are open for claims as of September 2026. The best documented is:

• Neutrogena Skin360 (Melzer v. Johnson & Johnson Consumer Inc., No. 3:22-cv-03149, D.N.J.). A $4.7 million fund for anyone who, while in Illinois, did a Skin360 skin assessment between December 9, 2019 and May 5, 2023. The claim deadline is November 25, 2026, and the final approval hearing is December 17, 2026. Payments are a pro rata share after fees and costs. File only on the official settlement website named in the notice.

Workplace timeclock settlements open and close regularly, and many pay automatically to workers on the employer's records without a claim form. If you get a notice, read it closely for whether you need to file. Our open settlements list is updated as new ones open, and our guide on how to file a settlement claim covers the process.

In Tims v. Black Horse Carriers, decided February 2, 2023, the Illinois Supreme Court held that a five-year statute of limitations applies to all BIPA claims. The clock generally starts when the violation happens. For collection without consent, that is typically the first scan. After the 2024 amendment, later scans by the same method do not restart it for damages purposes.

Practical timing points:

• If you started using a fingerprint timeclock more than five years ago and have never been part of a case, your collection claim may be time-barred, though a disclosure or retention claim could have a later start date.
• Settlement claim deadlines are firm. The Skin360 deadline is November 25, 2026.
• A pending class action generally pauses the clock for people in the proposed class.

1. Write down the details: the company, the device or app feature, where you were, and the dates.
2. Look for paperwork. Check onboarding documents, handbooks, and app terms for a biometric consent form. Its absence is often the key fact.
3. Check for open settlements before anything else, since filing a claim is free.
4. Do not sign a new consent or release that covers past collection without understanding it.
5. Keep proof of Illinois presence, such as pay stubs or location records.

Independent attorneys who handle biometric privacy cases can tell you whether a claim is still timely and whether arbitration or a union agreement affects it. A free case review takes about two minutes. For related app privacy cases, see our pages on TikTok and Google.