U.S. Illinois Biometric Information Privacy Act (BIPA)

Why does it matter?

The General Assembly's findings in Section 5 explain the design: biometrics are biologically unique, so once compromised the individual has no recourse and is at heightened risk of identity theft, unlike a Social Security number that can be changed. BIPA answers with consent before collection, a public destruction policy and a per-violation damages schedule that any aggrieved person can invoke without a regulator, which is why time clocks, facial recognition, voice assistants and visitor systems used in Illinois are run under written releases and retention schedules. Public Act 103-769 narrowed the arithmetic of repeated scans to one recovery per person per section, but the $1,000 and $5,000 figures, fee shifting and injunctions in Section 20(a) are unchanged.

Key benefits include:

• Notice and release before collection

Section 15(b) requires written notice that a biometric is being collected or stored, written notice of the specific purpose and length of term, and a written release before any identifier or information is obtained.

• A public retention and destruction policy

Section 15(a) requires a written policy, available to the public, with a retention schedule and guidelines for permanent destruction when the initial purpose is satisfied or within 3 years of the individual's last interaction, whichever occurs first.

• No profit, limited disclosure

Section 15(c) forbids selling, leasing, trading or otherwise profiting from biometrics; Section 15(d) allows disclosure only with consent, to complete a transaction the subject requested, when required by law or under a warrant or subpoena.

• A defined standard of care

Section 15(e) requires the reasonable standard of care within the entity's industry and protection at least equal to that given other confidential and sensitive information.

• Private enforcement with fixed damages

Section 20(a) gives any aggrieved person a right of action with $1,000 or $5,000 liquidated damages per violation, or actual damages if greater, plus fees, costs and injunctions; Sections 20(b) and (c) count repeated collections or disclosures as one violation.

How does it work?

Section 10 draws the boundary. A biometric identifier is a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry; it does not include writing samples, written signatures, photographs, human biological samples used for valid scientific testing, demographic data, tattoo or physical descriptions, donated organs or tissue, blood or serum held for transplants, biological materials regulated under the Genetic Information Privacy Act, information captured from a patient in a health care setting or used for treatment, payment or operations under HIPAA, or X-rays, MRI, PET, CT and other diagnostic images. Biometric information is any information, however captured, converted, stored or shared, that is based on a biometric identifier and used to identify an individual, excluding information derived from the excluded items.

The same section defines the parties and the consent. A private entity is any individual, partnership, corporation, limited liability company, association or other group however organized, excluding state and local government agencies and the Illinois courts, clerks and judges. A written release means informed written consent, an electronic signature (an electronic sound, symbol or process attached to or logically associated with a record and adopted with intent to sign, added by Public Act 103-769) or, in the context of employment, a release executed by an employee as a condition of employment. Confidential and sensitive information, the benchmark in Section 15(e), includes genetic markers, account and PIN numbers, pass codes, driver's license numbers and Social Security numbers.

Section 15 is the operative core. Under 15(a) a private entity in possession of biometrics must develop a written policy, made available to the public, that sets a retention schedule and guidelines for permanently destroying identifiers and information when the initial purpose for collecting them has been satisfied or within 3 years of the individual's last interaction with the entity, whichever occurs first, and must follow that schedule absent a valid warrant or subpoena. Under 15(b) no private entity may collect, capture, purchase, receive through trade or otherwise obtain a person's biometric unless it first informs the subject or legally authorized representative in writing that a biometric is being collected or stored, informs them in writing of the specific purpose and length of term, and receives a written release.

Sections 15(c) to (e) govern what happens after collection. No private entity in possession of biometrics may sell, lease, trade or otherwise profit from them (c). None may disclose, redisclose or disseminate them unless the subject consents, the disclosure completes a financial transaction the subject requested or authorized, state or federal law or a municipal ordinance requires it, or a valid warrant or subpoena compels it (d). Every private entity must store, transmit and protect biometrics using the reasonable standard of care within its industry, and at least as protectively as its other confidential and sensitive information (e).

Section 20 supplies the remedy. Any person aggrieved by a violation has a right of action in an Illinois circuit court or as a supplemental claim in federal district court and, as a prevailing party, may recover for each violation liquidated damages of $1,000 or actual damages against a negligent violator, $5,000 or actual damages against an intentional or reckless violator, reasonable attorneys' fees and costs including expert witness fees, and other relief including an injunction. Since August 2, 2024, Section 20(b) treats repeated collection of the same biometric from the same person by the same method as a single violation of 15(b), and Section 20(c) treats repeated disclosure of the same biometric to the same recipient as a single violation of 15(d), with at most one recovery each.

Section 25 limits the Act's reach: it does not affect the admission or discovery of biometrics in court, does not conflict with the X-Ray Retention Act or HIPAA and their rules, does not apply in any manner to a financial institution or affiliate subject to Title V of the Gramm-Leach-Bliley Act, does not conflict with the Private Detective, Private Alarm, Private Security, Fingerprint Vendor, and Locksmith Act of 2004, and does not apply to a contractor, subcontractor or agent of a state agency or local unit of government when working for that body. Section 99 made the Act effective upon becoming law, October 3, 2008; Section 30 was repealed internally effective January 1, 2009.

Key Elements

• Biometric identifier and information (Section 10)

Retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry, with the listed exclusions; and any information based on such an identifier that is used to identify an individual.

• Private entity and written release (Section 10)

Any individual or organization however organized, excluding government agencies and courts; consent means informed written consent, an electronic signature or, in employment, a release executed as a condition of employment.

• Retention and destruction policy (Section 15(a))

A written, publicly available policy with a retention schedule and destruction guidelines: destroy when the initial purpose is satisfied or within 3 years of the last interaction, whichever is first.

• Notice and release before collection (Section 15(b))

Written notice of collection or storage, written notice of the specific purpose and length of term, and a written release, all before the biometric is obtained.

• No profit, limited disclosure, standard of care (Section 15(c) to (e))

No selling, leasing, trading or profiting; disclosure only with consent, to complete a requested transaction, as required by law or under a warrant or subpoena; industry-standard care at least equal to other sensitive data.

• Right of action and the single-violation rule (Section 20)

$1,000 or actual damages per negligent violation, $5,000 or actual per intentional or reckless violation, fees, costs and injunctions; repeated collection or disclosure of the same biometric counts once per person per section.

What does it cover?

BIPA applies to any private entity, defined in Section 10 as any individual, partnership, corporation, limited liability company, association or other group however organized, that collects, captures, purchases, receives through trade, possesses, stores, transmits or discloses biometric identifiers or biometric information. Section 15 names no geographic test; the Act is an Illinois statute enforced through Illinois circuit courts and federal supplemental claims under Section 20. It does not apply to state or local government agencies or the Illinois courts (Section 10), to contractors and agents working for a public body (Section 25(e)), or to financial institutions subject to Title V of the Gramm-Leach-Bliley Act (Section 25(c)), and HIPAA-regulated patient information and diagnostic images are outside the definition of biometric identifier (Section 10).

What are its objectives?

The General Assembly stated its purpose in Section 5(g): to serve the public welfare, security and safety by regulating the collection, use, safeguarding, handling, storage, retention and destruction of biometric identifiers and information.

Protect identifiers that cannot be changed once compromised, as Section 5(c) explains, by requiring informed written consent before any biometric is collected (Section 15(b)).

Make the lifecycle public and finite through a published retention schedule and destruction within 3 years of the last interaction (Section 15(a)).

Keep biometrics out of commerce and out of unauthorized hands through the no-profit and limited-disclosure rules (Sections 15(c) and (d)).

Hold the data to at least the protection given other confidential and sensitive information (Section 15(e)).

Enforce through the individuals affected, with liquidated damages, fees and injunctions, counted per person per section since the 2024 amendment (Section 20).

Framework in Context

BIPA's private right of action with liquidated damages sets it apart from other state biometric laws, and the Illinois Supreme Court has read it broadly: in Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186, a person is aggrieved under Section 20 when a private entity violates Section 15, without alleging further injury, and in Cothron v. White Castle System, Inc., 2023 IL 128004, a claim accrues each time a biometric is scanned or transmitted in violation of the Act. Public Act 103-769 (Senate Bill 2979) answered Cothron with the single-violation rule in Sections 20(b) and (c). The Act meets federal regimes by exclusion: HIPAA treatment, payment and operations data and GLBA Title V institutions are outside it (Sections 10 and 25).

Common Framework Mappings

Organizations map BIPA's Section 15 duties to the privacy and security frameworks below so that one biometric data inventory, consent record and retention schedule serve Illinois and the other regimes they operate under.

Mapped frameworks include:

SOC 2

CCPA/CPRA

GDPR

HIPAA

ISO 27701

NIST Privacy Framework v1.0

NIST 800-53 Rev.5

PCI DSS 4.0.1