Biometric Information Privacy Act (BIPA)
The Biometric Information Privacy Act (BIPA) requires entities that collect biometric data, such as fingerprints, facial recognition, or retina scans, to obtain informed consent from individuals before collecting their data, store it securely, and adhere to strict retention and destruction guidelines.
| Jurisdiction | Illinois |
|---|---|
| Category | Privacy & Data Protection |
| Status | Active |
| Latest development |
Analysis
Detailed Analysis of BIPA's Key Requirements
The Biometric Information Privacy Act (BIPA) is a comprehensive regulation aimed at protecting individuals' biometric data. Here are the key requirements:
Informed Consent
Entities must obtain informed consent from individuals before collecting their biometric data. This includes:
- Notification: Entities must inform individuals in writing about the collection, storage, and use of biometric data. The notification should include the purpose and duration of data collection, storage, and use BIPA.
- Written Consent: Explicit written consent from the individual is mandatory before collecting any biometric data BIPA.
Data Protection
Entities must implement robust security measures to protect biometric data from unauthorized access, breaches, and leaks. This includes:
- Encryption: Use advanced security protocols like encryption to protect biometric data both in transit and at rest BIPA.
- Access Control: Restrict access to biometric data to authorized personnel only. Implement physical and digital access controls to ensure that only trained and authorized individuals can handle biometric systems BIPA.
Disclosure Restrictions
Biometric data cannot be sold, leased, traded, or otherwise used for profit. Disclosure is only permitted under specific circumstances, such as with the individual’s consent or as required by law BIPA.
Retention and Destruction
Entities must establish a clear policy for the retention and destruction of biometric data. Data should be destroyed when the initial purpose for collection has been fulfilled or within three years of the individual’s last interaction with the business, whichever comes first BIPA.
Common Compliance Challenges
- Lack of Awareness: Many entities may not be aware of the specific requirements of BIPA, leading to non-compliance.
- Data Collection Practices: Ensuring that only necessary biometric data is collected can be challenging, especially in complex systems.
- Consent Management: Obtaining and managing informed consent from a large number of individuals can be cumbersome.
- Security Measures: Implementing and maintaining robust security measures to protect biometric data is a significant challenge.
Best Practices for Implementation
- Obtain Informed Consent: Always inform individuals about the purpose and duration of biometric data collection, storage, and use. Obtain explicit written consent before collecting any biometric data BIPA.
- Minimize Data Collection: Collect only the biometric data necessary for the specific purpose. Avoid excessive or unnecessary data collection to reduce the risk of misuse BIPA.
- Implement Strong Security Measures: Use advanced security protocols, such as encryption, to protect biometric data both in transit and at rest. Regularly update security measures to address new threats BIPA.
- Limit Access: Restrict access to biometric data to authorized personnel only. Implement physical and digital access controls to ensure that only trained and authorized individuals can handle biometric systems BIPA.
- Regular Audits and Assessments: Conduct regular audits and privacy impact assessments to ensure compliance with data protection regulations and to identify potential vulnerabilities BIPA.
- Transparency and Communication: Clearly communicate with individuals about what biometric data is being collected, how it will be used, and with whom it will be shared. Provide easy-to-understand privacy policies and obtain feedback from your employees BIPA.
- Retention and Destruction Policies: Establish clear policies for the retention and destruction of biometric
Recent developments
- — Lewis Brisbois notes ongoing BIPA risks for entities collecting biometrics in Illinois, amid 2025 litigation trends and expectations of increased AG enforcement in 2026[10] (source)
- — 2025 review highlights continued BIPA litigation developments, including a unique AI facial database settlement approved by courts and a New Jersey ruling rejecting a medical exception for AI skincare assessments using biometrics without consent[1] (source)
Read the full guide to Biometric Information Privacy Act (BIPA)
Related regulations
- UK Data Protection Act 2018 — United Kingdom, Active
- Texas Data Privacy and Security Act (TDPSA) — Texas, Active, effective 2024-07-01
- General Data Protection Law (LGPD) — Brazil, Active, effective 2020-09-18
- COPPA (Children's Online Privacy Protection Act) — United States, Active
- Oregon Consumer Privacy Act (OCPA) — Oregon, Active, effective 2024-07-01
- Montana Consumer Data Privacy Act (MCDPA) — Montana, Active, effective 2024-10-01
- New Hampshire Privacy Act (NHPA) — New Hampshire, Active, effective 2025-01-01
- Nebraska Data Privacy Act (NDPA) — Nebraska, Active, effective 2025-01-01
Put it into practice
- Generate the policy: Illinois BIPA policy generator (generatepolicy.com)
- Buy the policy pack: State Privacy Law Checklist (cyberpolicy.shop)
- Build it yourself: 2026 US Privacy Program Workbook (ciso.diy)
Browse all regulations · Compliance deadlines · Latest updates