Illinois data privacy laws are among the strictest in the United States, built around three state statutes: the Biometric Information Privacy Act (BIPA), the Personal Information Protection Act (PIPA), and the Genetic Information Privacy Act (GIPA). Two of them let residents sue companies directly for statutory damages, and the third routes enforcement through the Illinois Attorney General under the state’s consumer fraud law. BIPA alone has produced billions of dollars in class-action settlements.
Biometric Information Privacy Act (BIPA)
BIPA regulates how private companies collect, store, and use biological identifiers. The statute covers fingerprints, voiceprints, retina or iris scans, and scans of hand or face geometry, along with any information derived from those identifiers that is used to identify a person. Photographs, tattoo descriptions, and physical descriptors like height or eye color are explicitly excluded.1Justia Law. Illinois Code 740 ILCS 14 – Biometric Information Privacy Act
Before a company collects biometric data, it has to do two things. It must publish a written policy with a retention schedule and destruction guidelines; data has to be destroyed either when the original purpose is satisfied or within three years of the person’s last interaction with the company, whichever comes first. And it must notify the person in writing that data is being collected, explain the purpose, and obtain a written release.2Illinois General Assembly. 740 ILCS 14 – Biometric Information Privacy Act
Selling, leasing, or trading biometric identifiers is prohibited outright, even if the person consented to the original collection.2Illinois General Assembly. 740 ILCS 14 – Biometric Information Privacy Act
What You Can Recover Under BIPA
Individuals can sue under BIPA without waiting for a government agency to act. A prevailing plaintiff can recover $1,000 for each negligent violation or $5,000 for each intentional or reckless violation, plus attorney’s fees and court costs. The court can award actual damages instead if they exceed those statutory amounts.3Justia Law. Illinois Code 740 ILCS 14 – Biometric Information Privacy Act – Section 20
You do not have to prove separate harm beyond the statutory violation itself. The Illinois Supreme Court held in Rosenbach v. Six Flags Entertainment Corp. that a company’s failure to follow BIPA’s requirements is itself the injury that makes a person “aggrieved” and able to sue.4Illinois Courts. Rosenbach v Six Flags Entertainment Corp – 2019 IL 123186 A five-year statute of limitations applies to every BIPA claim, regardless of which subsection the claim arises under.
The 2024 Amendment and Per-Scan Damages
In 2023, the Illinois Supreme Court decided in Cothron v. White Castle System, Inc. that a separate BIPA claim accrues each time a company scans or transmits biometric data without authorization, not just the first time. For an employee whose fingerprint was scanned at the start of every shift for years, that reading produced theoretical liability in the thousands of violations.5Justia Law. Cothron v White Castle System Inc
The Illinois legislature responded in 2024 with SB 2979. The amendment limits damages for repeated collection of the same biometric data from the same person using the same method to a single recovery, and applies the same single-recovery cap to repeated disclosures of the same data to the same recipient. Going forward, that effectively overrides per-scan accrual.6LegiScan. Bill Text IL SB2979 – 103rd General Assembly
SB 2979 also confirmed that electronic consent satisfies BIPA’s “written release” requirement. A checkbox, click-through agreement, or similar digital confirmation now counts; a wet-ink signature is no longer required.7Greenberg Traurig. BIPA Update Illinois Limits Liability and Clarifies Electronic Consent for Biometric Data Collection
Personal Information Protection Act (PIPA)
PIPA governs what organizations have to do before and after a security breach exposes personal data about Illinois residents. Any organization that owns or licenses that data must notify the affected residents at no charge, in the most expedient time possible and without unreasonable delay.8Justia Law. Illinois Code 815 ILCS 530 – Personal Information Protection Act
What PIPA Treats as Personal Information
PIPA’s definition is broader than many people assume. It covers a resident’s name combined with any of the following, when the data is unencrypted or when the encryption keys have been compromised:
- Social Security number
- Driver’s license or state ID number
- Financial account number, or credit or debit card number, especially when paired with a security code or password that grants account access
- Medical information
- Health insurance information
- Biometric data used for authentication, such as fingerprints or retina images
PIPA also covers a separate category on its own: a username or email address combined with a password or security question and answer that would grant access to an online account.9Illinois General Assembly. 815 ILCS 530 – Personal Information Protection Act – Section 5
Notifying the Attorney General
When a breach affects more than 500 Illinois residents, the organization must also send written notice to the Illinois Attorney General describing the nature of the breach, the number of residents affected, and the steps taken or planned to address it.10Illinois General Assembly. 815 ILCS 530 – Notice of Breach, Notice to Attorney General
PIPA violations are treated as unlawful practices under the Illinois Consumer Fraud and Deceptive Business Practices Act. The Attorney General can pursue enforcement with the full set of consumer fraud remedies, including injunctions and civil penalties. PIPA itself does not create a private right of action; enforcement runs through the AG.11Justia Law. Illinois Code 815 ILCS 530 – Personal Information Protection Act – Section 20
Security and Disposal Rules
PIPA requires any entity holding records with personal information about Illinois residents to maintain reasonable security measures to protect those records from unauthorized access, destruction, or disclosure.12Illinois General Assembly. 815 ILCS 530 – Data Security The statute does not spell out exact technical controls. What’s “reasonable” scales with the nature of the information and the size and complexity of the business, which means a small medical practice and a large financial institution face different expectations but neither is excused from having a program. The Attorney General can investigate inadequate security even before a breach occurs.
When personal information is no longer needed, it has to be destroyed so that it cannot be read or reconstructed. Paper records can be shredded, burned, or pulverized; electronic media must be erased or physically destroyed. Third-party disposal vendors are allowed, but they have to follow the same standards and keep policies that prevent unauthorized access during collection, transport, and destruction.13Illinois General Assembly. 815 ILCS 530 – Disposal of Materials Containing Personal Information
Improper disposal carries civil penalties of up to $100 per affected individual, capped at $50,000 per disposal incident. The Attorney General can impose penalties after notice and a hearing or recover them in court. Financial institutions already subject to federal disposal rules under the Gramm-Leach-Bliley Act or the Fair Credit Reporting Act are exempt from this section.13Illinois General Assembly. 815 ILCS 530 – Disposal of Materials Containing Personal Information
Genetic Information Privacy Act (GIPA)
GIPA treats genetic testing results as confidential and privileged. Results can only be released to the person tested or to someone they specifically authorize in writing. Genetic information is generally inadmissible in court proceedings and not discoverable in litigation without that authorization.14Justia Law. Illinois Code 410 ILCS 513 – Genetic Information Privacy Act – Section 15
Before performing a genetic test, the entity collecting the sample has to obtain a signed release explaining the test’s purpose and identifying who will have access to the results. GIPA also restricts how insurers can use genetic data; insurance company violations are governed exclusively by remedies under the Illinois Insurance Code.
For other defendants, GIPA has its own private right of action with higher damages than BIPA. A negligent violation carries liquidated damages of $2,500 per violation, and an intentional or reckless violation reaches $15,000 per violation. Prevailing plaintiffs can also recover attorney’s fees and seek injunctions.15Justia Law. Illinois Code 410 ILCS 513 – Genetic Information Privacy Act – Section 40
How Federal Rules Fit On Top
Illinois law does not operate alone. The FTC’s Health Breach Notification Rule requires entities that handle personal health records but aren’t covered by HIPAA to notify consumers after a breach involving unsecured health information. When a breach reaches 500 or more people, the entity must also notify the media. The rule can apply to health apps, fitness trackers, and other consumer health tools.16Federal Trade Commission. Health Breach Notification Rule
The FTC Safeguards Rule covers financial institutions broadly defined, including auto dealers, mortgage brokers, and tax preparers, and requires a written information security program with administrative, technical, and physical safeguards scaled to the business.17Federal Trade Commission. FTC Safeguards Rule – What Your Business Needs to Know Organizations in critical infrastructure sectors have additional reporting duties to the Cybersecurity and Infrastructure Security Agency under CIRCIA.
Compliance with one framework does not excuse noncompliance with another, and the enforcement agencies operate independently. An Illinois company handling biometric, health, financial, or genetic data may need to satisfy BIPA, PIPA, GIPA, and one or more federal rules at the same time.
What This Means in Practice
If you run a business in Illinois, the most common mistake is treating these statutes as separate problems. A company that fingerprints employees for timekeeping, stores customer health data, and processes online account credentials is simultaneously subject to BIPA, PIPA, and potentially GIPA and federal rules. A single data governance program is more efficient than bolting on compliance one statute at a time.
For BIPA, the 2024 amendments reduced but did not eliminate litigation risk. Written policies, informed consent, and a published retention schedule are still required. The single-recovery cap only limits repeat collections of the same data from the same person using the same method; it doesn’t help a company that never obtained consent to begin with. With a five-year limitations period, employees and customers can still bring claims long after the initial collection.
On breach notification, PIPA requires notice “without unreasonable delay” but does not set a specific day count for private entities. State agencies face a 45-day deadline. The Attorney General evaluates whether a private organization’s timeline was reasonable given the circumstances, and organizations that sit on a breach for months face significantly worse outcomes than those that notify promptly and document their remediation.
If you’re an Illinois resident, your most direct tools are BIPA and GIPA, both of which let you file suit yourself for statutory damages without proving separate financial harm. For breaches involving Social Security numbers, account credentials, medical records, and the other categories PIPA covers, your path is a complaint to the Illinois Attorney General’s office rather than a private suit.