What Is the Illinois Biometric Information Privacy Act?

The Illinois Biometric Information Privacy Act, known as BIPA, is a 2008 state law that regulates how private companies handle fingerprints, face scans, voiceprints, and other biometric data collected from people in Illinois. It requires written notice and consent before collection, forces companies to publish a retention and destruction policy, bans the sale of biometric data, and lets individuals sue for $1,000 to $5,000 per violation. It is the most aggressive biometric privacy statute in the country, and a 2024 amendment reshaped how damages are calculated.

What Data BIPA Covers

BIPA protects a specific, closed list of biometric identifiers: retina or iris scans, fingerprints, voiceprints, and scans of hand or face geometry.¹ It also protects “biometric information,” meaning any data derived from one of those identifiers that can be used to identify a person. A digital template created from a fingerprint scan qualifies even though it isn’t the raw print.

The exclusions matter just as much. BIPA does not apply to writing samples, written signatures, photographs, demographic data, tattoo descriptions, or basic physical descriptions like height, weight, and eye color.¹ A company using ordinary photographs on employee badges isn’t triggering BIPA. Run those same photographs through facial-geometry mapping software and the output crosses the line into covered data.

Healthcare has its own carve-out. Information captured from a patient in a healthcare setting, or collected and stored for treatment, payment, or operations under HIPAA, falls outside BIPA.¹ Medical imaging like X-rays, CT scans, MRIs, and mammograms is excluded too, as are biological samples used for genetic testing under the Illinois Genetic Information Privacy Act and donated organs or tissues under the Illinois Anatomical Gift Act.

Who Has To Comply

BIPA applies to “private entities,” defined broadly to include individuals, partnerships, corporations, LLCs, and associations.¹ In practice, the businesses most frequently sued are employers using fingerprint or facial-scan time clocks, tech companies deploying facial recognition, and retailers collecting biometric data for loss prevention or customer identification.

Three categories are exempt. State and local government agencies are not private entities under the statute, and the same exemption extends to contractors and subcontractors working on behalf of those agencies. Illinois courts and their clerks are excluded. Financial institutions already regulated under the federal Gramm-Leach-Bliley Act fall outside BIPA as well.

BIPA reaches beyond Illinois borders. A federal court declined to dismiss BIPA claims against an out-of-state company that collected biometric data from individuals in Illinois, reasoning that applying the law in that context would not regulate the company’s conduct in other states.² If your app, website, or physical location collects biometric data from someone in Illinois, assume BIPA applies regardless of where your servers or headquarters sit.

What Companies Must Do Before Collecting Biometric Data

Before collecting any biometric identifier or biometric information, a private entity has to do three things. It must inform the person in writing that biometric data is being collected or stored. It must disclose the specific purpose and the length of time the data will be collected, stored, and used. And it must obtain a written release from the person.³ All three steps must happen before the first scan.

The 2024 amendment clarified that an electronic signature satisfies the written-release requirement. The statute now defines an electronic signature as an electronic sound, symbol, or process attached to or associated with a record and adopted by a person with the intent to sign.¹ A tap on an iPad screen or a click-through consent box now clearly qualifies. In the employment context, the release can be executed as a condition of employment.

Consent is purpose-specific, not a blanket authorization. A company that obtains consent to use fingerprints for timekeeping cannot later repurpose that data for marketing analytics without going through the consent process again for the new purpose.

Retention, Destruction, and the Ban on Selling

Every private entity holding biometric data must develop a publicly available written policy that sets a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information.³ The destruction deadline is whichever comes first: when the original purpose for collecting the data has been fulfilled, or three years after the individual’s last interaction with the entity. An employer that collects a worker’s fingerprint for a time clock must destroy that data no later than three years after the employee leaves.

The statute flatly bans profiting from biometric data. No private entity may sell, lease, trade, or otherwise profit from a person’s biometric identifier or biometric information.³ There is no exception and no consent form that authorizes it. Disclosure to third parties is permitted only in narrow circumstances: when the individual consents, when the disclosure completes a financial transaction the individual authorized, when required by state or federal law, or under a valid court-issued warrant or subpoena.

Companies must also protect biometric data using the reasonable standard of care within their industry and must treat it at least as protectively as other confidential and sensitive information like Social Security numbers and account credentials.³ A company that encrypts financial account numbers but stores fingerprint templates in plaintext is out of compliance.

What Happens When a Company Violates BIPA

BIPA’s enforcement mechanism is what makes it genuinely feared. It gives every affected individual the right to sue in state circuit court or federal district court. Most privacy statutes rely on a government agency; BIPA lets individual plaintiffs and class-action attorneys do the work. The results have been staggering. Facebook settled a BIPA class action for $650 million in 2020. Google paid $100 million in 2022. TikTok’s parent company agreed to $92 million in 2021.

Damages come in two tiers. For a negligent violation, a prevailing plaintiff can recover $1,000 in liquidated damages or actual damages, whichever is greater. For an intentional or reckless violation, the figure jumps to $5,000 or actual damages. On top of that, a prevailing party can recover reasonable attorney fees, expert witness costs, and other litigation expenses, and courts can grant injunctive relief.⁴ Fee-shifting is a major driver of BIPA litigation because it lets plaintiffs’ attorneys take cases on contingency without worrying about whether individual damages justify the cost.

A plaintiff does not need to prove any actual injury beyond the statutory violation itself. The Illinois Supreme Court held that “an individual need not allege some actual injury or adverse effect, beyond violation of his or her rights under the Act” to seek damages and injunctive relief.⁵ A company that scans an employee’s fingerprint without first providing written notice has violated BIPA regardless of whether the data was ever misused or breached.

One narrower limit applies to unionized workers. When an employee is covered by a collective bargaining agreement with a broad management-rights clause, BIPA claims are preempted by federal labor law and must go through the union’s grievance-arbitration process rather than the courts.

The 2024 Amendment Changed the Damages Math

Before August 2024, BIPA’s damages math was terrifying for employers. The Illinois Supreme Court had held that “a separate claim accrues under the Act each time a private entity scans or transmits an individual’s biometric identifier or information” without proper consent.⁶ Under that reading, an employee who clocked in with a fingerprint twice a day for five years could represent tens of thousands of individual violations at $1,000 to $5,000 each. White Castle alone faced potential liability estimated in the billions.

On August 2, 2024, Governor Pritzker signed SB 2979 into law, effective immediately. The amendment added subsections to Section 20 that collapse repeated collections and disclosures into a single violation per person. A company that collects the same biometric identifier from the same person using the same method multiple times has committed one violation, not thousands.⁴ The same rule applies to repeated disclosures of the same biometric data from the same person to the same recipient.

The change doesn’t eliminate liability, but it caps the multiplication problem that turned routine time-clock usage into billion-dollar exposure. A company that never obtained consent from 500 employees still faces 500 violations, just not 500 multiplied by every scan those employees ever made. At least one federal court has ruled the amendment applies retroactively to pending cases, treating it as a clarification of existing law rather than a substantive change.

How Long You Have To Sue

BIPA claims must be filed within five years of the violation. The Illinois Supreme Court established this deadline by applying the state’s general five-year catchall limitations period for civil actions not covered by a more specific statute.⁷ The five-year window applies uniformly to all BIPA claims, whether negligent or intentional. Defendants had argued for a shorter one-year or two-year period, and the court rejected those arguments.

For employees whose biometric data was collected years ago without proper consent, the window may still be open. The per-person damages model shrinks the per-plaintiff exposure compared to the old per-scan approach, but across a workforce the numbers can still be large.

Practical Compliance Steps

BIPA compliance comes down to a handful of concrete actions, and getting them right before collecting any data is far cheaper than litigating afterward. The consent requirement is where most companies fail, usually because they started collecting fingerprints or face scans before realizing BIPA applied and then tried to backfill consent later.

Before the first collection, deliver written notice that identifies the specific biometric data being collected, states the purpose, and discloses how long it will be stored. An electronic notice through an app or kiosk works if it appears before the scan.
Obtain an affirmative written release, which can now be an electronic signature. A clear, specific click-through checkbox qualifies. Burying consent language inside a 40-page employee handbook invites litigation.
Publish a written retention policy stating how long you keep biometric data and when you destroy it. The destruction deadline is the earlier of when the original purpose is fulfilled or three years after the person’s last interaction with your company.³
Store and transmit biometric data using at least the same safeguards you apply to Social Security numbers and financial account data. If your industry has a recognized standard of care, meet it.³
Never sell, lease, trade, or profit from biometric data. There is no workaround.³
Review your commercial general liability policy. Insurers have added explicit biometric-data exclusions to newer policies, and you want to know whether a BIPA claim would be covered before one lands.

1
Justia Law. Illinois Code 740 ILCS 14 – Biometric Information Privacy Act
2
Justia. Monroy v. Shutterfly, Inc., No. 1:2016cv10984 – Document 39
3
Illinois General Assembly. Illinois Code 740 ILCS 14/15 – Retention, Collection, Disclosure, Destruction
4
Illinois General Assembly. Illinois Code 740 ILCS 14/20 – Right of Action
5
Illinois Courts. Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186
6
Justia. Cothron v. White Castle System, Inc., 2023 IL 128004
7
Illinois Courts. Tims v. Black Horse Carriers, Inc., 2023 IL 127801