Biometric Information Privacy Act (BIPA)
The Biometric Information Privacy Act (BIPA) is an Illinois law that regulates how private entities collect, use, retain, disclose, and destroy certain biometric identifiers and biometric information. At Net Law Advocates, we represent individuals in matters involving fingerprints, scans of face or hand geometry, voiceprints, and other biometric information covered by the statute.
Unlike passwords or account numbers, biometric characteristics generally cannot simply be replaced if compromised. BIPA therefore establishes specific requirements involving notice, written releases, retention and destruction policies, disclosure, and protection of covered biometric information. Our broader Biometric Privacy resources address biometric issues across different technologies and jurisdictions, while this page focuses specifically on rights and potential claims under Illinois BIPA.
Understanding BIPA And Your Rights
BIPA is an Illinois statute governing private entities’ handling of certain biometric identifiers and biometric information. The statute defines biometric identifiers to include retina or iris scans, fingerprints, voiceprints, and scans of hand or face geometry, subject to statutory exclusions. Illinois General Assembly
Among other requirements, covered private entities generally must provide specified written information and obtain a written release before collecting covered biometric identifiers or biometric information. BIPA also establishes requirements concerning retention and destruction policies, disclosure and dissemination, profiting from biometric data, and the safeguarding of covered information.
BIPA provides a private right of action for a person “aggrieved” by a violation of the Act. A prevailing party may recover the remedies authorized by the statute, including liquidated or actual damages where applicable, reasonable attorneys’ fees and costs, and other relief a court deems appropriate.
Common BIPA Violations We See
Potential BIPA violations may arise in workplace and consumer settings where covered biometric technologies are used for timekeeping, access, identity verification, security, or other purposes. Issues may include:
- Collecting covered fingerprints without the notice and written release required by BIPA
- Collecting covered facial geometry without required notice or authorization
- Collecting covered voiceprints without satisfying applicable requirements
- Disclosing biometric information to third parties without satisfying BIPA’s requirements
- Failing to develop and make publicly available a compliant retention and destruction policy
- Retaining biometric information contrary to applicable retention and destruction requirements
- Failing to use the safeguards required by the statute
Whether particular conduct violates BIPA depends on the information and technology involved, the statutory provision at issue, and the facts surrounding the collection, use, retention, disclosure, or protection of the data. Individuals concerned about these practices can also learn more about biometric data collection without consent and biometric data retention and destruction.
Employees And Biometric Timekeeping Systems
Illinois employers may use fingerprint scanners, hand geometry systems, or other biometric technologies for timekeeping, access, or workforce management. Depending on the technology and circumstances, BIPA issues may arise when:
- Required written information was not provided
- A required written release was not obtained
- Biometric information was disclosed to a vendor or another party without satisfying applicable requirements
- Required retention and destruction policies were not established or followed
- Covered biometric information was not protected as required by the statute
Employees who encounter these technologies can learn more about the broader privacy issues associated with workplace biometrics. Whether a particular employer’s practices violate BIPA requires evaluating the technology, information collected, disclosures and releases, retention practices, third-party involvement, and other relevant facts.
Consumers And Biometric Tracking
Businesses may use facial recognition tools, voiceprint systems, and other biometric technologies for customer access, security, identity verification, or other purposes. Examples may include:
- Retail stores using facial recognition
- Apps using facial scans for account verification
- Gyms and fitness centers using fingerprint entry
- Financial services using voice-based authentication
- Venues using facial recognition or similar technologies for admission or security
Whether these practices fall within BIPA depends on the technology, the information collected, how it is used, and whether the statutory requirements and any applicable exceptions are satisfied. Individuals concerned about facial scanning can learn more about facial recognition privacy.
What Individuals May Recover In A BIPA Case
BIPA establishes specific remedies for an aggrieved person who prevails on a claim. Depending on the circumstances, the statute authorizes:
- $1,000 in liquidated damages or actual damages, whichever is greater, for a negligent violation
- $5,000 in liquidated damages or actual damages, whichever is greater, for an intentional or reckless violation
- Reasonable attorneys’ fees and costs, including expert witness fees and other litigation expenses
- Other relief, including injunctive relief, as a court deems appropriate
Illinois amended BIPA in 2024 to address how repeated collection and disclosure violations are counted. Under the amended statute, repeated collection of the same person’s biometric identifier or biometric information using the same method constitutes a single violation of Section 15(b) for which the person is entitled to, at most, one recovery. Similar limits apply to repeated disclosures of the same information to the same recipient under Section 15(d). The remedies potentially available in a particular case therefore depend on the alleged violation and the specific facts.
How We Handle BIPA Claims
Our attorneys review how biometric information was collected, used, stored, retained, protected, or disclosed and evaluate whether the requirements of BIPA may apply. This may include reviewing written releases, notices, retention policies, vendor involvement, and other relevant records.
Depending on the circumstances, BIPA claims may involve individual plaintiffs or broader litigation concerning practices affecting multiple employees or consumers. We evaluate the applicable statutory provisions, available evidence, and remedies that may be available under the law.
BIPA Claim Frequently Asked Questions
What Exactly Does BIPA Require Companies To Do Before Collecting Biometric Data?
Before a private entity collects or otherwise obtains covered biometric identifiers or biometric information, BIPA generally requires it to inform the person or their legally authorized representative in writing that the information is being collected or stored, state the specific purpose and length of term for which it is being collected, stored, and used, and receive a written release. The statute also establishes requirements concerning retention and destruction policies, disclosure, and protection of covered biometric information.
Can I Bring A BIPA Claim Even If I Was Not Financially Harmed?
BIPA provides a private right of action to a person “aggrieved” by a violation of the Act and authorizes liquidated damages in circumstances specified by the statute. A person therefore does not necessarily need to establish traditional financial loss to pursue a BIPA claim. Whether a particular plaintiff can establish a violation, standing, and entitlement to relief depends on the statutory provision involved, the forum, and the facts of the case.
What Types Of Employers Commonly Violate BIPA?
BIPA litigation has involved employers using fingerprint time clocks, hand scanners, biometric access systems, and other technologies involving covered biometric information. These technologies may be used in manufacturing, retail, logistics, healthcare, restaurants, food service, warehousing, and other workplaces. Whether BIPA applies depends on the technology, information involved, entity involved, and circumstances of the particular practice.
Are Facial Recognition Tools Covered Under BIPA?
BIPA’s definition of a biometric identifier expressly includes a “scan of hand or face geometry.” Whether a particular facial recognition or facial analysis technology involves information covered by BIPA depends on how the technology operates and what information is collected or generated. When covered biometric information is collected, BIPA’s applicable requirements must be evaluated.
How Do I Know If My Fingerprint Or Facial Scan Was Collected Without My Permission?
If you were required to provide a fingerprint, use a hand scanner, or complete a facial scan without receiving written information about the collection or providing a written release, the circumstances may warrant further review. Whether BIPA was violated depends on whether the technology and information are covered by the statute, whether BIPA applies to the entity and conduct involved, and whether the statutory requirements were satisfied.
Can A Company Share Biometric Data With A Vendor?
BIPA restricts private entities from disclosing or otherwise disseminating covered biometric identifiers or biometric information unless one of the circumstances authorized by the statute applies. Third-party vendors may be involved in storing or processing biometric information, so evaluating a potential claim may require examining what information was disclosed, to whom, for what purpose, and whether the disclosure satisfied BIPA’s requirements.
How Long Do I Have To File A BIPA Claim?
The Illinois Supreme Court has held that a five-year statute of limitations applies to claims under BIPA. Determining when that period began to run and whether a particular claim is timely still requires evaluating the alleged violation and the facts of the case. Individuals with potential claims should therefore avoid assuming that they have a particular amount of time remaining and should have the circumstances reviewed promptly.
What Compensation May Be Available In A BIPA Case?
A prevailing party may recover $1,000 in liquidated damages or actual damages, whichever is greater, for a negligent violation, and $5,000 in liquidated damages or actual damages, whichever is greater, for an intentional or reckless violation. BIPA also authorizes reasonable attorneys’ fees and costs and other relief, including injunctive relief, as a court deems appropriate. The amount and type of relief available depend on the violation and circumstances, including the 2024 statutory rules governing repeated collections and disclosures.
Does BIPA Apply To Out-Of-State Companies Operating In Illinois?
BIPA may apply to conduct involving an out-of-state company when the relevant biometric activity has a sufficient connection to Illinois, but the analysis is fact-specific. A company’s location outside Illinois does not by itself determine whether BIPA applies. Relevant considerations may include where the collection or other challenged conduct occurred and the circumstances connecting the activity to Illinois.
How Can A Lawyer Help With A BIPA Case?
An attorney can review how biometric information was collected, stored, used, retained, protected, or disclosed; determine which BIPA provisions may apply; review relevant notices, releases, policies, and records; and evaluate whether the available evidence supports a claim. If a viable claim exists, counsel can also evaluate the remedies available under the statute.
Contact Net Law Advocates For A Free, Confidential Consultation
If you believe your fingerprint, voiceprint, facial geometry, or other covered biometric information was collected, retained, disclosed, or otherwise handled in violation of BIPA, contact Net Law Advocates to discuss what happened. Call 888-913-2318 or fill out our secure web form to schedule a free, confidential consultation. We can review the circumstances and evaluate whether Illinois BIPA or another applicable biometric privacy law may provide legal options.