BIPA
Illinois Biometric Information Privacy Act
Written notice and consent before collecting biometrics, a public retention schedule, and a private right of action that has produced some of the largest privacy settlements in the US.
The law in brief
Illinois' Biometric Information Privacy Act (BIPA) regulates how private organizations collect, use, keep and destroy biometric data such as fingerprints, face geometry and voiceprints. It is short, strict and, unusually, lets individuals sue directly, which has made it one of the most litigated privacy laws in the United States.
Who it applies to
- Private entities, meaning businesses and other non-government organizations, that collect or hold biometric identifiers or biometric information of people in Illinois.
- Biometric identifiers include retina or iris scans, fingerprints, voiceprints and scans of hand or face geometry; biometric information is information based on them that identifies a person.
- Government bodies and some financial institutions are excluded, as are certain health care uses.
What it requires
A public retention and destruction policy
Publish a written policy with a retention schedule, and destroy biometric data when its purpose is satisfied or within three years of the person's last interaction, whichever comes first.
Written notice and release before collection
Before collecting biometric data, tell the person in writing what is collected, why and for how long, and receive their written release.
No selling or profiting
Do not sell, lease, trade or otherwise profit from a person's biometric data.
Limited disclosure and reasonable care
Do not disclose biometric data without consent or another listed basis, and store and transmit it with at least the care used for other confidential information.
People's rights
People must be told in writing and give a written release before their biometric data is collected. They can sue directly for violations (Sec. 20).
Enforcement and penalties
A private right of action: $1,000 or actual damages for each negligent violation, and $5,000 or actual damages for each intentional or reckless violation, plus attorneys' fees and costs (Sec. 20). A 2024 amendment treats repeated collection of the same biometric data from the same person by the same method as a single violation, and confirms that electronic signatures count as a written release.
What to do first
- Find every biometric use: time clocks, door access, device unlock, identity verification and voice systems, including vendors' tools.
- Publish a written retention and destruction policy.
- Get informed written releases before collection, including from employees.
- Stop any sale or profit from biometric data and check vendor contracts.
- Protect it at least as well as other sensitive data, and destroy it on schedule.
Checked against the official text on 28 September 2026. Quotations are the operative words of the law, linked to the article they come from; the official text is the authority. This brief is written by the Association for practitioners and is not legal advice.
Recent developments
-
State bills propose exemption for biometric data converted to irreversible mathematical representations
The trend could reshape biometric privacy safeguards by carving out a carve‑out for transformed biometric data. Several U.S. state privacy bills are introducing a new exception that excludes biometric data once it is transformed into an irreversible mathematical representation that cannot be used to recreate the original measurement. The proposed language appears in bills such as Mississippi HB 1051 and similar measures in Pennsylvania and Georgia. The exemption could limit the scope of biometric privacy protections for technologies using one‑way mathematical transformations.
Source: Future of Privacy Forum. BIPA in the regulations library.
Sources
- Biometric Information Privacy Act (740 ILCS 14) Illinois General Assembly · Official text or regulator