Página traduzida e verificada automaticamente. Prevalece a versão em inglês. Algumas partes ainda estão em inglês enquanto a tradução é verificada. Ver em inglês · Informar um erro de tradução
BIPA
Illinois Biometric Information Privacy Act
Aviso e consentimento por escrito antes de coletar dados biométricos, uma tabela pública de retenção e um direito privado de ação que gerou alguns dos maiores acordos de privacidade dos EUA.
The law in brief
Illinois' Biometric Information Privacy Act (BIPA) regulates how private organizations collect, use, keep and destroy biometric data such as fingerprints, face geometry and voiceprints. It is short, strict and, unusually, lets individuals sue directly, which has made it one of the most litigated privacy laws in the United States.
A quem se aplica
- Private entities, meaning businesses and other non-government organizations, that collect or hold biometric identifiers or biometric information of people in Illinois.
- Biometric identifiers include retina or iris scans, fingerprints, voiceprints and scans of hand or face geometry; biometric information is information based on them that identifies a person.
- Government bodies and some financial institutions are excluded, as are certain health care uses.
What it requires
A public retention and destruction policy
Publish a written policy with a retention schedule, and destroy biometric data when its purpose is satisfied or within three years of the person's last interaction, whichever comes first.
Written notice and release before collection
Before collecting biometric data, tell the person in writing what is collected, why and for how long, and receive their written release.
No selling or profiting
Do not sell, lease, trade or otherwise profit from a person's biometric data.
Limited disclosure and reasonable care
Do not disclose biometric data without consent or another listed basis, and store and transmit it with at least the care used for other confidential information.
Direitos das pessoas
People must be told in writing and give a written release before their biometric data is collected. They can sue directly for violations (Sec. 20).
Enforcement and penalties
Direito privado de ação: $1,000 ou danos efetivos por violação culposa, e $5,000 ou danos efetivos por violação intencional ou imprudente, além de honorários advocatícios e custas (Sec. 20). Uma alteração de 2024 trata a coleta repetida dos mesmos dados biométricos da mesma pessoa pelo mesmo método como uma única violação, e confirma que assinaturas eletrônicas valem como autorização por escrito.
What to do first
- Find every biometric use: time clocks, door access, device unlock, identity verification and voice systems, including vendors' tools.
- Publish a written retention and destruction policy.
- Get informed written releases before collection, including from employees.
- Stop any sale or profit from biometric data and check vendor contracts.
- Protect it at least as well as other sensitive data, and destroy it on schedule.
Checked against the official text on 28 September 2026. Quotations are the operative words of the law, linked to the article they come from; the official text is the authority. This brief is written by the Association for practitioners and is not legal advice.
Novidades recentes
-
State bills propose exemption for biometric data converted to irreversible mathematical representations
The trend could reshape biometric privacy safeguards by carving out a carve‑out for transformed biometric data. Several U.S. state privacy bills are introducing a new exception that excludes biometric data once it is transformed into an irreversible mathematical representation that cannot be used to recreate the original measurement. The proposed language appears in bills such as Mississippi HB 1051 and similar measures in Pennsylvania and Georgia. The exemption could limit the scope of biometric privacy protections for technologies using one‑way mathematical transformations.
Source: Future of Privacy Forum. BIPA in the regulations library.
Fontes
- Biometric Information Privacy Act (740 ILCS 14) Assembleia Geral de Illinois · Texto oficial ou regulador
Biblioteca de regulamentações
Todas as leis estaduais de privacidade dos EUA em um só mapa
24 estados têm uma lei abrangente de privacidade na biblioteca, ao lado das leis da UE, do Reino Unido, federais dos EUA e globais: 102 no total, cada uma explicada em linguagem simples com suas fontes. Selecione um estado para ver o que se aplica lá.
- Em vigor
- Entrando em vigor
- Leis setoriais