Biometric Information Privacy Act (BIPA) - Compliance Guide

· About Biometric Information Privacy Act (BIPA)

Key Takeaways

  • BIPA applies to private entities collecting Illinois residents’ biometric identifiers or biometric information and requires notice, written consent, a published retention policy, and secure storage before collection or disclosure.[1][2]
  • The Illinois Supreme Court has held that a BIPA claim accrues with each collection or disclosure, which drove very large statutory-damages exposure before the 2024 amendment to Section 20.[3][5]
  • Public Act 103-0769, effective 2 August 2024, changed Section 20 to cap recovery to one award per person per same method of collection, limiting repeated statutory-damages claims in many pending and future cases.[5][6]
  • The Seventh Circuit held on 1 April 2026 that the 2024 damages amendment applies retroactively to pending cases, sharply reducing per-scan exposure in cases that were still open when the amendment became effective.[6][9]
  • Private plaintiffs may recover statutory damages of $1,000 per negligent violation or $5,000 per intentional or reckless violation, plus attorneys’ fees and injunctive relief, while the Illinois Attorney General can also enforce the Act.[1][2]
  • BIPA has no general “small business” exemption and reaches private entities, including out-of-state companies, when Illinois biometric data is collected or used in Illinois-facing operations; exemptions are narrow and tied to specific functions and statutory definitions.[1][2]

What It Is

BIPA is Illinois’s biometric privacy statute, codified at 740 ILCS 14, regulating the collection, capture, purchase, receipt through trade, use, storage, and disclosure of biometric identifiers and biometric information by private entities.[1][2] The Act is enforced through a private right of action and by the Illinois Attorney General.[1][2]

The core obligations were enacted in 2008, and the statute was later amended in 2024 by Public Act 103-0769; that amendment took effect on 2 August 2024.[5] The amendment did not repeal BIPA’s notice, consent, retention, destruction, and security duties; it changed damages treatment in Section 20.[5]

The most important 2025–2026 development is judicial rather than legislative: on 1 April 2026, the Seventh Circuit held that the 2024 damages amendment applies retroactively to cases pending when the amendment became effective.[6][9] As of 6 September 2026, that is the controlling federal appellate interpretation for pending federal cases in the Seventh Circuit, while the underlying Illinois statute remains in force.[6][9]

Who Must Comply

BIPA applies to private entities that collect or otherwise handle biometric identifiers or biometric information of Illinois residents or persons in Illinois-facing contexts.[1][2] The statute defines biometric identifiers to include fingerprints, voiceprints, retina or iris scans, hand or face geometry, and similar data used to identify an individual.[2]

The statute has extraterritorial effect in practice when a company’s conduct involves Illinois biometric data or Illinois-based employees, customers, or users, even if the company is headquartered elsewhere.[1][2] There is no broad employee-only exemption or de minimis carve-out.

The Act excludes certain categories from the definition of biometric information and does not regulate some internal or security uses in the same way as commercial identification systems.[2] The statutory exemptions are narrow and must be tested against the text of Section 10 rather than assumed from industry practice.[2]

Core Requirements

  1. Notice and purpose disclosure: Before collecting or obtaining a biometric identifier or biometric information, a private entity must inform the subject in writing that biometric data is being collected or stored, explain the specific purpose and length of term for which it is being collected, stored, and used, and obtain informed consent.[1][2]
  1. Written release/consent: The entity must obtain a written release, and the 2024 amendment made clear that consent may be obtained electronically in qualifying circumstances, which matters for onboarding and remote workflows.[5][13]
  1. Public retention and destruction policy: The entity must develop a written policy establishing a retention schedule and guidelines for permanently destroying biometric identifiers and information when the initial purpose has been satisfied or within three years of the individual’s last interaction, whichever occurs first.[1][2]
  1. No sale or profit: The entity may not sell, lease, trade, or otherwise profit from biometric identifiers or biometric information.[1][2]
  1. Limited disclosure: The entity may not disclose biometric data except in the limited circumstances identified by statute, such as with consent, to complete a transaction requested by the subject, or as required by law.[1][2]
  1. Reasonable security: The entity must store, transmit, and protect biometric information using a reasonable standard of care within the entity’s industry and at least the same level of protection used for other confidential and sensitive information.[1][2]
  1. Damages and litigation posture: For a violation, a prevailing party can recover statutory damages of $1,000 per negligent violation or $5,000 per intentional or reckless violation, plus attorneys’ fees and costs, with injunctive relief also available.[1][2][5]

Deadlines and Penalties

| milestone | date | what applies | |---|---:|---| | Original BIPA enactment | 2008 | Core notice, consent, retention, security, and no-profit rules became effective.[1][2] | | Section 20 amendment enacted | 2 August 2024 | Damages provisions changed to limit recovery to one award per person per same method of collection in more than one instance.[5] | | Seventh Circuit retroactivity ruling | 1 April 2026 | Pending cases in the Seventh Circuit are subject to the 2024 damages amendment.[6][9] | | Current operative status | 6 September 2026 | BIPA remains fully enforceable, with private litigation and AG enforcement continuing.[1][2][6] |

Maximum statutory damages are $1,000 per negligent violation and $5,000 per intentional or reckless violation under Section 20, as amended, with the retroactive one-recovery rule limiting repeated recovery in covered scenarios.[1][2][5][6] Other sanctions include injunctions, declaratory relief, attorneys’ fees, and costs in private suits, plus enforcement action by the Illinois Attorney General.[1][2]

How to Comply

  1. Inventory every biometric use case: Map all fingerprint, face, iris, voice, gait, and similar identifiers used in access control, timekeeping, customer verification, fraud prevention, and AI features. Distinguish biometric identifiers from ordinary photos, video, or account data under the statutory definitions.[2]
  1. Build a BIPA notice-and-consent flow: Provide a written notice before first collection, state the specific purpose and retention period, and capture written or electronic consent where allowed. Align the workflow with ISO 42001 controls for AI-enabled biometric systems when those systems are in scope.[5][13]
  1. Adopt and publish a retention/destruction schedule: Set a compliant schedule for deletion when the purpose ends or after three years of last interaction, whichever comes first, and ensure the policy is publicly available as required by statute.[1][2]
  1. Harden security controls: Treat biometric templates and raw captures as highly sensitive data and map protections to ISO 27001 and NIST CSF 2.0 domains such as access control, encryption, logging, incident response, and third-party risk.[1][2]
  1. Contract with vendors carefully: Put biometric restrictions, deletion duties, audit rights, breach notification, and no-sale/no-retention terms into processor and service-provider agreements. Confirm vendors do not repurpose data for model training or secondary analytics.[1][2]
  1. Limit disclosure paths: Restrict internal access, document lawful disclosure exceptions, and maintain approval workflows for subpoenas, law-enforcement requests, and transaction-specific sharing.[1][2]
  1. Prepare litigation and retention holds: Keep evidence of notice, consent, deletion, and technical safeguards, but do not overretain biometric data beyond the policy period. Preserve only what is needed for legal defense and incident response.
  1. Track legal updates: Reassess damages exposure and settlement strategy in light of the 2024 amendment and the 2026 retroactivity ruling, especially for legacy claims and multi-scan systems.[5][6][9]

Related Regulations

  • Texas Capture or Use of Biometric Identifier Act is similar in notice and deletion concepts but differs in enforcement design and litigation exposure.
  • Washington biometric privacy law overlaps on consent and security expectations, but its scope and remedies are not identical to BIPA.
  • Colorado Privacy Act overlaps for biometric data as sensitive data, but BIPA is more prescriptive on written consent and destruction timelines.
  • Illinois consumer privacy and data-breach laws can apply alongside BIPA when biometric data is part of a broader personal-data incident.
  • GDPR can conflict with or exceed BIPA on lawful basis, minimization, and cross-border transfer rules when an organization operates in the EU and Illinois.

FAQ

Does BIPA apply to companies outside Illinois?

Yes, if they collect or use biometric identifiers or biometric information in a way that implicates Illinois residents or Illinois operations. BIPA is not limited to Illinois-headquartered companies, and out-of-state employers, vendors, and platforms have repeatedly faced BIPA claims.[1][2]

Does BIPA cover employee time clocks and access systems?

Yes, employee-facing biometric timekeeping and access control are among the most common BIPA risk areas. Employers still need written notice, written consent, a retention/destruction policy, and reasonable security, even when the data is collected for workplace administration.[1][2]

What changed in 2024?

Public Act 103-0769 amended Section 20, effective 2 August 2024, to curb repetitive recovery for repeated collection from the same person using the same method. The amendment did not eliminate the underlying notice, consent, retention, and security obligations.[5]

Are per-scan damages still available?

The 2024 amendment greatly reduced per-scan exposure for covered repeated collections, and the Seventh Circuit held in 2026 that the amendment applies retroactively to pending cases.[6][9] Even so, BIPA litigation remains active, and damages can still be substantial for negligent or intentional violations.[1][2][6]

Does using facial recognition in AI products trigger BIPA?

It can. If a product captures or generates biometric identifiers or biometric information used to identify a person, BIPA’s notice, consent, retention, and security rules may apply even where the feature is embedded in an AI workflow.[2][5] ISO 42001 is useful for governance, but it does not replace statutory compliance.

Is there a general exemption for de minimis or low-risk collection?

No broad exemption appears in the statute for low-volume or low-risk collection. Compliance depends on the statutory definitions and exceptions in Section 10, so even limited biometric use should be reviewed carefully.[2]

Sources

Put it into practice

More compliance guides