BIPA Explained: Illinois Biometric Privacy Law, Fingerprints, Facial Recognition and Your Right to Sue
If a password is stolen, you can change it. Your fingerprint, face geometry, voiceprint, or iris pattern is different. You cannot simply replace your face or fingerprints after a company has collected them.
That is the basic privacy concern behind the Illinois Biometric Information Privacy Act (BIPA).
BIPA is one of the most important biometric privacy laws in the United States. It regulates how private companies collect, use, store, disclose, and destroy certain biometric identifiers and biometric information.
For employees, consumers, customers, and businesses using fingerprint scanners, facial recognition, voice recognition, or similar technology, BIPA can have significant legal consequences.
This guide explains what BIPA is, what information it covers, when consent may be required, what happens when a company violates the law, and why Illinois has become a major battleground for biometric privacy litigation.
What Is BIPA?
BIPA stands for the Biometric Information Privacy Act.
Illinois enacted BIPA in 2008 as a state privacy law designed to regulate the collection and handling of biometric identifiers and biometric information by private entities. The statute is codified at 740 ILCS 14.
The law recognizes that biometric information is fundamentally different from ordinary personal information.
A person can change a password or obtain a new account number. A person generally cannot change their fingerprints or facial characteristics after that information has been compromised.
BIPA therefore places specific obligations on private entities that collect or possess covered biometric information.
What Counts as Biometric Information Under BIPA?
BIPA distinguishes between a biometric identifier and biometric information.
The statute's definition of biometric identifier includes:
Retina or iris scans
Fingerprints
Voiceprints
Scans of hand geometry
Scans of face geometry
The statute also specifically excludes certain information, including ordinary photographs and various medical imaging and health-related information falling within statutory exclusions.
This distinction matters because not every piece of personal information is automatically covered by BIPA.
For example, a normal photograph is not necessarily a BIPA biometric identifier simply because a human being appears in the photograph. The legal question can become more complicated when technology converts or analyzes information for biometric identification.
Why Are Fingerprint Scanners a BIPA Issue?
One of the most common BIPA situations involves fingerprint-based systems.
Imagine an Illinois employer installs a fingerprint scanner.
Employees use their fingerprints every day to:
clock in and out;
access computers;
access workplace systems;
retrieve payroll information; or
enter restricted areas.
The employer may argue that the fingerprint is simply an efficient authentication tool.
BIPA asks a different question:
Did the company comply with the statutory requirements before collecting and using the biometric information?
Under Section 15(b), a private entity generally cannot collect, capture, purchase, receive through trade, or otherwise obtain a person's biometric identifier or biometric information unless it first provides required written information and obtains the person's written release/consent as required by the statute.
That requirement can make an ordinary workplace fingerprint scanner a significant privacy-law issue.
What Does BIPA Require Before Biometric Data Is Collected?
Section 15(b) is one of the most important provisions of BIPA.
Before collecting covered biometric information, the private entity must generally provide written notice explaining that the biometric identifier or biometric information is being collected or stored and provide information concerning the purpose and length of the collection, storage, and use.
The statute also requires the person's written release before collection, subject to the statutory framework.
In practical terms, a company should not treat biometric collection like an ordinary employee attendance procedure.
The company needs to consider:
What information is being collected?
Why is it being collected?
How long will it be kept?
Has the required notice been provided?
Has the required consent or release been obtained?
These questions can become critical if litigation later occurs.
What About BIPA's Retention and Destruction Rules?
BIPA does not only regulate the initial collection of biometric information.
Section 15(a) requires a private entity possessing biometric identifiers or biometric information to establish a publicly available written policy concerning retention and destruction.
The statute generally requires destruction when the initial purpose for collecting the information has been satisfied or within three years of the individual's last interaction with the private entity, whichever occurs first, subject to the statute's requirements and exceptions.
This creates another important compliance question:
What happens to your biometric data after the company no longer needs it?
A business may have a legitimate reason for initially collecting biometric information. That does not automatically answer how long the information can remain in its systems.
Can a Company Share Your Biometric Information?
Another major BIPA issue is disclosure.
Section 15(d) restricts private entities from disclosing, redisclosing, or otherwise disseminating biometric identifiers or biometric information without the required consent, subject to statutory exceptions.
This can become especially important when a business uses a third-party technology vendor.
For example, imagine:
An employer collects an employee's fingerprint.
The fingerprint is processed by an outside technology company.
The employer and vendor have different systems.
The employee never received the required notice or provided the required consent.
That arrangement can raise BIPA questions concerning both collection and disclosure.
The fact that a third-party vendor performs the technical processing does not automatically eliminate the legal issues surrounding biometric data.
Can You Sue a Company Under BIPA?
Yes, BIPA provides a private right of action.
Section 20 states that a person aggrieved by a violation may bring an action in Illinois state court or as a supplemental claim in federal district court.
The statute provides for liquidated damages or actual damages, depending on the violation and circumstances, along with reasonable attorneys' fees and costs and potentially injunctive or other appropriate relief.
The statutory amounts are significant.
For a negligent violation, the statute provides for $1,000 or actual damages, whichever is greater.
For an intentional or reckless violation, the statute provides for $5,000 or actual damages, whichever is greater.
The statute also provides for attorneys' fees and costs and other appropriate relief.
But there is an important development that anyone researching older BIPA articles needs to understand.
BIPA Changed in 2024
Illinois amended BIPA through Public Act 103-0769, effective August 2, 2024.
The amendment addressed how repeated collection or disclosure involving the same biometric identifier, person, method, and circumstances is treated for purposes of damages.
Under the current statutory language, repeated collection of the same biometric identifier or biometric information from the same person using the same method of collection is treated as a single violation under Section 15(b), with at most one recovery for that repeated conduct.
The amendment similarly addresses repeated disclosure or dissemination of the same biometric identifier or biometric information to the same recipient using the same method.
This change is extremely important because older online explanations of BIPA damages may describe the law without accounting for the 2024 amendment.
What Did the Illinois Supreme Court Say in Cothron v. White Castle?
One of the most important BIPA cases is Cothron v. White Castle System, Inc.
The case involved an employee whose workplace required fingerprint scans to access systems. The case reached the Illinois Supreme Court after the federal appellate court asked the Illinois Supreme Court to interpret BIPA.
In 2023, the Illinois Supreme Court held that a separate BIPA claim could accrue each time a private entity scanned an individual's biometric identifier or transmitted the information in violation of Sections 15(b) or 15(d).
That decision became enormously important in BIPA litigation because repeated biometric scans could potentially create repeated statutory violations.
However, the later 2024 statutory amendment changed the damages framework for certain repeated violations.
Therefore, anyone researching BIPA today should not simply read Cothron and assume that the 2023 damages landscape remains unchanged.
The case and the subsequent statutory amendment need to be considered together.
What Did Rosenbach v. Six Flags Change?
Another landmark BIPA decision is Rosenbach v. Six Flags Entertainment Corp.
The case became important because the Illinois Supreme Court considered whether a person must show additional harm beyond a violation of BIPA's notice-and-consent requirements.
The court rejected the argument that a person must necessarily prove additional actual harm before pursuing a claim for the type of statutory violation involved in that case.
That principle helped make BIPA unusual compared with many privacy claims where plaintiffs may face questions about whether they suffered a sufficiently concrete injury.
For anyone researching a potential BIPA claim, however, the precise facts and the particular statutory subsection matter.
Does BIPA Apply Only to Employees?
No.
BIPA can arise in a variety of private-sector situations.
Potential examples include:
Employment
Fingerprint-based timekeeping systems and workplace authentication technology can create BIPA questions.
Retail
Businesses may use biometric technology for payments, security, customer identification, or loss prevention.
Hospitality
Hotels, entertainment businesses, and other companies may use facial or fingerprint technology for access or identification.
Technology
Companies developing or operating biometric systems may encounter BIPA compliance issues.
Security
Biometric access systems can raise questions involving fingerprints, facial geometry, and other covered identifiers.
The actual legal analysis depends on the technology, the entity involved, the information collected, the purpose, the notices provided, consent, retention practices, and other facts.
What About Facial Recognition?
Facial recognition is one of the reasons BIPA continues to attract attention.
Modern cameras can do far more than simply take photographs.
Some systems can analyze facial characteristics and compare them against databases or stored biometric templates.
That creates a critical legal distinction:
Taking a photograph and creating or using biometric information are not necessarily the same legal event.
BIPA's definition specifically addresses scans of face geometry, while the statute also excludes ordinary photographs from the definition of biometric identifiers.
Therefore, whether a particular facial-recognition system falls within BIPA can depend heavily on what the technology actually captures, converts, stores, and uses.
Does AI Make BIPA More Important?
Potentially, yes.
Artificial intelligence is rapidly increasing the ability of companies to analyze images, voices, behavioral signals, and other data.
That raises difficult questions about where ordinary personal information ends and biometric identification begins.
Illinois legislators have already introduced proposals addressing emerging technology.
For example, HB2984 in the 2026 Illinois General Assembly proposed adding certain neural data to BIPA's definition of biometric identifier. As of the latest legislative status reflected by the Illinois General Assembly, the bill had been re-referred to the Rules Committee rather than enacted into law.
Other 2026 proposals have addressed biometric technology used for security purposes, biometric locks, and biometric time clocks. For example, SB3122 was introduced in February 2026 and, according to the Illinois General Assembly's status page, was referred to Assignments.
These proposals are important to watch, but they should not be confused with current enacted law.
Can a Company Use Biometrics for Security?
Security-related biometric use is another developing area.
Illinois lawmakers introduced 2026 proposals that would modify BIPA's treatment of certain biometric collection or use for security purposes.
For example, SB3856 proposed defining "security purpose" broadly enough to cover areas such as preventing or investigating retail theft, fraud, protecting property, controlling access, protecting people from harm, and assisting law enforcement investigations. The bill's listed action was referral to Assignments.
That means businesses following BIPA developments should distinguish carefully between:
what the current statute says
and
what a proposed amendment would change if enacted.
A bill introduced in the Illinois General Assembly is not automatically Illinois law.
What Should an Illinois Employee Ask About a Fingerprint System?
If your employer requires biometric identification, you may want to find out:
What biometric information is being collected?
Why is the company collecting it?
Who receives or processes the information?
Is a third-party vendor involved?
What written notice was provided?
Was written consent or a written release obtained?
What is the company's retention policy?
When will the information be destroyed?
Is there a publicly available biometric privacy policy?
Does the company have a procedure for responding to privacy requests or complaints?
Keeping copies of notices, consent forms, employee policies, and relevant communications can become important if a dispute develops.
What Should Businesses Do to Reduce BIPA Risk?
Companies using biometric technology should not wait until they receive a lawsuit to examine their compliance program.
A practical compliance review should consider:
Inventory the data.
Determine exactly what biometric identifiers and biometric information the company collects or possesses.
Review consent procedures.
Make sure the required written disclosures and releases are properly handled.
Review retention policies.
Confirm that the company has an appropriate written retention and destruction policy.
Review vendors.
Identify third parties that receive, process, store, or otherwise handle biometric information.
Review contracts.
Biometric-data agreements should clearly allocate responsibilities for security, retention, destruction, and compliance.
Review technology.
Understand whether a system merely stores photographs or actually creates biometric templates or performs biometric identification.
Monitor Illinois legislation.
BIPA continues to be an active area of legislative debate, particularly as biometric technology, AI, security systems, and workplace technology evolve.
Why BIPA Matters Beyond Illinois
BIPA is an Illinois law, but its impact extends far beyond Illinois.
The law has become an important reference point in the broader American debate over biometric privacy.
Companies operating nationally may need to think about different state privacy laws governing biometric information, including laws in states such as Texas and Washington, as well as newer comprehensive privacy frameworks.
Illinois is particularly important because BIPA combines specific statutory requirements with a private right of action.
That makes biometric privacy compliance more than a theoretical issue.
For businesses, a fingerprint scanner may look like an ordinary piece of workplace technology.
From a privacy-law perspective, it can be the beginning of a much more complicated legal question.
Frequently Asked Questions About BIPA
What does BIPA stand for?
BIPA stands for the Biometric Information Privacy Act, an Illinois law regulating certain biometric identifiers and biometric information held or collected by private entities.
Is BIPA a federal law?
No. BIPA is an Illinois state law. It is codified at 740 ILCS 14.
Does BIPA cover fingerprints?
Yes. Fingerprints are expressly included within BIPA's definition of biometric identifiers.
Does BIPA cover facial recognition?
Potentially. BIPA includes scans of face geometry within its definition of biometric identifiers, although the precise application depends on the technology and circumstances. Ordinary photographs are excluded from the statutory definition of biometric identifier.
Can an employee sue an employer under BIPA?
Potentially, yes. BIPA provides a private right of action against an offending private entity, subject to the statute and applicable procedural and substantive requirements.
How much can someone recover under BIPA?
The statute currently provides liquidated damages of $1,000 or actual damages, whichever is greater, for negligent violations, and $5,000 or actual damages, whichever is greater, for intentional or reckless violations, along with potential attorneys' fees, costs, and other relief. The 2024 amendment also changed how certain repeated violations are treated for recovery purposes.
Is every fingerprint scan automatically a BIPA violation?
No.
The legal question depends on the circumstances, including the entity involved, the type of biometric information, notice, consent, purpose, disclosure, retention, applicable statutory provisions, and other facts.
Is BIPA still changing in 2026?
Illinois lawmakers introduced several BIPA-related proposals during the 2026 legislative session, including proposals concerning security-related biometric use and neural data. Proposed legislation should not be confused with enacted law.
Conclusion
BIPA is one of the most significant biometric privacy laws in the United States.
If an Illinois company collects your fingerprint, analyzes your face, processes your voice, or uses another technology involving covered biometric information, the important question is not simply whether the technology works.
The legal question is also how the company collected, disclosed, stored, and eventually destroyed that information.
For individuals, BIPA can provide an important privacy protection.
For employers and businesses, it creates compliance responsibilities that should be addressed before biometric technology is deployed.
And as artificial intelligence and biometric identification become increasingly intertwined, the boundaries of biometric privacy law are likely to remain an important legal issue in the United States.
Official Sources
Illinois General Assembly — Biometric Information Privacy Act (740 ILCS 14)
The official Illinois statutory text contains BIPA's definitions, requirements, retention provisions, and remedies.
Read 740 ILCS 14 — Biometric Information Privacy Act
Illinois General Assembly — Public Act 103-0769
This 2024 law amended BIPA, including provisions addressing how certain repeated biometric collection and disclosure violations are treated.
Read Public Act 103-0769
Illinois General Assembly — SB3122 (2026)
SB3122 is a 2026 proposed BIPA amendment addressing security purposes, biometric locks, biometric time clocks, notice, cure periods, and other provisions. The bill remains proposed legislation and should not be treated as current law.
View SB3122 Bill Status
Illinois General Assembly — HB2984 (2026)
HB2984 proposes adding certain neural data to BIPA's definition of a biometric identifier. Its current legislative status should be checked before relying on the proposal as law.
View HB2984 Bill Status
Illinois Supreme Court — Cothron v. White Castle System, Inc.
This important Illinois Supreme Court case addressed when BIPA claims accrue for repeated biometric scans and transmissions.
Illinois Supreme Court — Cothron v. White Castle System, Inc.
Legal Disclaimer
This article explains Illinois law for general informational purposes only. It is not legal advice and does not create an attorney-client relationship. BIPA claims can depend on specific facts, dates, statutory amendments, court decisions, and procedural rules. Anyone considering a BIPA claim or defending a BIPA lawsuit should consult a qualified attorney familiar with Illinois biometric privacy law.
Comments
Post a Comment
Comment should be in the form of message and helpful to the viewers