Illinois BIPA Guide: Consent, Retention and Risk

Illinois' Biometric Information Privacy Act (BIPA) lets any person whose fingerprint, face geometry or voiceprint was collected without the right notice and written release sue for $1,000 or $5,000 per violation, with no need to show harm. That private right of action has made BIPA the most litigated biometric law in the United States and the main reason time clocks, identity verification flows, voice systems and AI vendors are designed around Illinois. The 2024 amendment (Public Act 103-0769) capped recovery at one violation per person per collection method and allowed electronic signatures, and in April 2026 the Seventh Circuit held that change applies to pending cases. This guide covers what BIPA requires, how the case law shapes risk, where Texas and Washington differ, and what security and identity teams must build. It is written for privacy, security and engineering leads and for executives weighing biometric features. The technology itself is covered in the Biometrics Guide, and comprehensive state privacy laws in the US State Privacy Laws Guide.

Key takeaways

Five duties, all in Section 15: a public retention and destruction policy, notice and a written release before collection, no profiting from biometrics, disclosure only on consent or listed grounds, and industry-standard protection.
No harm needed to sue: the Illinois Supreme Court held in Rosenbach v. Six Flags (2019) that a violation of Section 15 makes a person "aggrieved" without any further injury.
Damages are now per person, not per scan: Public Act 103-0769 (effective 2 August 2024) treats repeated collection from the same person by the same method as a single violation, reversing the per-scan accrual of Cothron v. White Castle (2023).
Retroactivity is settled federally, not yet statewide: the Seventh Circuit held in Clay v. Union Pacific (1 April 2026) that the amendment applies to pending cases; no Illinois Supreme Court ruling on the point was found as of October 2026.
Vendors and machines are in scope: any private entity that collects, captures, receives or possesses biometrics is covered, which includes the SaaS, verification and AI providers your systems send face or voice data to.

Scope: who and what is covered

Term	Meaning under BIPA	Practical note
Biometric identifier	Retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry	Excludes items such as writing samples, signatures, photographs, physical descriptions and information captured in a health care setting under HIPAA
Biometric information	Any information, however captured, converted or stored, based on a biometric identifier and used to identify an individual	Templates and hashes derived from a scan are covered even if the raw image is discarded
Private entity	Individuals, partnerships, corporations, LLCs, associations and other groups	State and local government bodies are not private entities; their contractors are exempt when working for them (Sec. 25(e))
Written release	Informed written consent or electronic signature; in employment, a release executed as a condition of employment	Electronic signature was added by Public Act 103-0769
Electronic signature	An electronic sound, symbol or process attached to or logically associated with a record and adopted with intent to sign it	Mirrors E-SIGN and Illinois UETA wording

Section 25 sets the exemptions: financial institutions and affiliates subject to Title V of the Gramm-Leach-Bliley Act are outside the Act entirely (Sec. 25(c)); the Act does not conflict with HIPAA or the X-Ray Retention Act (Sec. 25(b)) or the private security licensing act (Sec. 25(d)); and contractors, subcontractors and agents of a State agency or local government are exempt when working for that agency (Sec. 25(e)). Nothing in BIPA limits its reach to Illinois companies: the litigated cases involve national employers, railways, retailers and technology firms whose Illinois staff, customers or users were scanned.

Key obligations

Section	Duty	What compliance looks like
15(a)	Develop a written, publicly available retention schedule and destruction guidelines; destroy biometrics when the initial purpose is satisfied or within 3 years of the individual's last interaction, whichever comes first	Published policy; automated deletion jobs keyed to last interaction and purpose end; evidence of deletion
15(b)	Before collecting, inform the person in writing that biometrics are collected or stored, state the specific purpose and length of term, and receive a written release	Consent captured and logged before first enrolment; no "scan first, sign later" onboarding
15(c)	Do not sell, lease, trade or otherwise profit from biometrics	Contract terms with vendors barring resale or training use for their own benefit
15(d)	Do not disclose or disseminate biometrics unless the person consents, the disclosure completes a financial transaction the person requested, law requires it, or a warrant or subpoena requires it	Separate disclosure consent naming processors and vendors; inventory of every recipient
15(e)	Store, transmit and protect biometrics with the reasonable standard of care within the industry, and at least as protectively as other confidential and sensitive information	Encryption, access control and monitoring equal to the entity's controls for its most sensitive data

Timing is the trap: Section 15(b) applies before collection. A consent form signed after the first time clock enrolment leaves the first collection non-compliant.
Disclosure includes vendors: sending templates to a cloud time-and-attendance provider, an identity verification service or a speech analytics platform is a disclosure under 15(d) and needs consent.
Retention is a published commitment: 15(a) requires the policy to be public and followed, so a policy that says three years while backups keep templates indefinitely is itself a gap. See the Data Retention and Secure Deletion Guide.
Employment: the release may be a condition of employment, but it still has to come first, in writing or by electronic signature. See the Employee Monitoring and Privacy Guide.

Timeline and current status

Status checked on 24 October 2026 against the Illinois General Assembly's statute text and published decisions.

Date	Event	Effect
3 October 2008	BIPA in force (Public Act 95-994)	Sections 15, 20 and 25 as originally enacted
25 January 2019	Rosenbach v. Six Flags, 2019 IL 123186	No actual harm required to sue
Late 2022 to 2024	Rogers v. BNSF	First BIPA jury verdict, $228 million judgment, vacated in June 2023, then a $75 million settlement
February 2023	Cothron v. White Castle, 2023 IL 128004 (4 to 3)	Separate claim accrues with each scan or transmission; court invited the legislature to address damages
2 August 2024	SB 2979 signed as Public Act 103-0769, effective that day	Per-person single violation for 15(b) and 15(d); electronic signature counts as written release
1 April 2026	Clay v. Union Pacific (7th Cir.)	Amendment is remedial and applies retroactively to pending cases

Clay binds federal courts in the Seventh Circuit. Illinois state courts are not bound by it, and several federal district courts had previously ruled the other way, so treat retroactivity in a state court case as an open question until the Illinois Supreme Court decides it.

Enforcement and penalties

BIPA has no regulator. Enforcement is by private action under Section 20, filed in an Illinois circuit court or as a supplemental claim in federal court.

Remedy (Sec. 20)	Amount or scope
Negligent violation	$1,000 liquidated damages or actual damages, whichever is greater
Intentional or reckless violation	$5,000 liquidated damages or actual damages, whichever is greater
Fees and costs	Reasonable attorneys' fees and costs, including expert witness fees and other litigation expenses
Other relief	Injunction or other relief the court considers appropriate
Repeated collection (Sec. 20(b))	Same identifier, same person, same method of collection: one violation of 15(b), at most one recovery
Repeated disclosure (Sec. 20(c))	Same identifier, same person, same recipient: one violation of 15(d), at most one recovery

The arithmetic explains the risk. In Rogers v. BNSF the jury found that 45,600 truck drivers' biometrics were used in violation of the Act, and the judge entered $228 million at $5,000 each, before vacating the award because the jury, not the court, should set damages. The case then settled for $75 million. After the amendment, exposure is still roughly class size multiplied by $1,000 or $5,000 for each distinct violation type (collection, disclosure to each recipient), which remains large for any employer or consumer service with tens of thousands of Illinois users. The amendment did not touch Sections 15(a), 15(c) or 15(e), so retention, profiting and security failures remain separate claims.

Texas and Washington compared

Element	Illinois BIPA	Texas (Bus. and Com. Code Sec. 503.001)	Washington (RCW 19.375)
Trigger	Any collection or possession by a private entity	Capture for a commercial purpose	Enrolment in a database for a commercial purpose
Consent	Written notice and written release before collection	Inform and obtain consent before capture	Notice, consent or a mechanism to prevent commercial use; context dependent
Retention	Purpose end or 3 years after last interaction, whichever first	Reasonable time, no later than 1 year after the purpose expires	No longer than reasonably necessary
Security purpose carve-out	None	Employer security purpose ends with employment	Notice and consent not required for security purposes
Enforcement	Private right of action	Attorney General, up to $25,000 per violation	Attorney General only, under the Consumer Protection Act

Comprehensive state privacy laws also treat biometric data as sensitive data needing opt-in consent; see the US State Privacy Laws Guide.

What it means for AI agents and non-human identities

Integrations are disclosures: every service account or API key that sends face images, fingerprints or voice audio to a verification, attendance or speech provider is a 15(d) disclosure path. Inventory those credentials, name an owner for each, and map each to the consent that covers it. See the NHI Ownership Guide.
Voice agents can create voiceprints: an AI voice agent or call analytics tool that performs speaker identification produces biometric information. Plain recording and transcription are a different question; check what the vendor actually computes before assuming either way.
Training is profiting risk: a vendor that uses your users' face templates to improve its own models may breach 15(c). Contracts should prohibit it and require deletion on termination.
Machine access needs the 15(e) standard: the pipelines, backups and analytics jobs that can read templates are the most likely leak path. Scope those identities to the minimum, rotate their secrets and log every read.
Deepfake defences collect biometrics too: liveness and face match checks used against AI impersonation are biometric collection. See the Deepfake-Resistant Identity Verification Guide.

Compliance steps

Find every biometric touchpoint: time clocks, door readers, identity verification, voice systems, device unlock features you process server-side, and vendor SDKs in your apps. Include those run by contractors on your behalf.
Decide whether you need to possess biometrics at all: on-device matching where the template never leaves the user's device (for example platform authenticators used with passkeys) is a different risk profile from server-side templates. Prefer it where it meets the requirement, and take legal advice on your specific design.
Publish the 15(a) policy: purpose, retention trigger (purpose end or 3 years after last interaction, whichever first) and destruction method, linked from the point of collection.
Capture consent first: written or electronic release before enrolment, naming the specific purpose, duration and any recipients; block enrolment in the system until consent is recorded.
Paper the vendors: processing agreements that ban sale and own-use, require 15(e) security and confirm deletion on purpose end or termination.
Secure and log: encrypt templates at rest and in transit, restrict access to named human and machine identities, alert on bulk reads.
Automate destruction: deletion jobs keyed to employment end or last interaction, including backups and vendor copies, with evidence retained.
Test and roll back: pilot new consent and deletion flows with one site or product; if consent capture fails, pause enrolment rather than collecting first. Keep the previous system available until consent coverage reaches 100% on the new one.

Decision guidance

Situation	Option	Trade-off
Small employer with a fingerprint time clock	Switch to badge or PIN, or keep the clock with consent and a published policy	Removing biometrics removes the class action risk; keeping it needs ongoing consent discipline at every hire
Consumer app adding face verification	Vendor verification with explicit consent and short retention, or on-device options	Vendor route adds a 15(d) recipient; on-device reduces possession but may not meet assurance needs
Large enterprise with many sites	Central biometric register, single consent service and automated deletion	Upfront engineering cost, but consistent evidence across sites and vendors

Detection, measurement and framework mapping

Monitor: enrolments without a matching consent record, templates past their retention date, new API keys or OAuth grants to biometric vendors, and bulk exports from template stores.
Metrics: percentage of enrolments with consent recorded before collection (target 100%); templates held beyond policy retention (target zero); biometric recipients with a signed agreement and consent coverage; median days from purpose end to verified deletion; machine identities with template access that have a named owner.

BIPA duty	NIST SP 800-53 Rev. 5	NIST CSF 2.0	ISO/IEC 27001:2022 Annex A
Notice and written release (15(b))	PT-4, PT-5	GV.OC-03	A.5.34
Purpose limitation	PT-2, PT-3	GV.OC-03	A.5.34
Retention and destruction (15(a))	SI-12, SI-12.3	PR.DS-01	A.8.10
Disclosure and vendors (15(c), 15(d))	SA-9	GV.SC-05	A.5.19
Reasonable security (15(e))	SC-28, AC-6	PR.DS-01, PR.AA-05	A.8.24
Inventory of biometric data	RA-8	ID.AM-07	A.5.12

Common failure patterns

Consent after collection: forms signed during onboarding after the first time clock scan, leaving the first collection outside Section 15(b).
Policy not public or not followed: a retention schedule kept internally, or a published one that backups and vendors ignore.
Unlisted recipients: consent covers the employer but not the payroll or attendance vendor that actually holds the templates.
Assuming the amendment removed risk: per-person damages still scale with headcount, and 15(a), 15(c) and 15(e) claims are unaffected.
Treating vendor features as out of scope: face match, speaker identification or liveness switched on in an SDK by default, with no one noticing that the organisation now collects biometrics.

Practitioner checklist

Inventory every system and vendor that collects, receives or stores biometric identifiers or information.
Publish a 15(a) retention and destruction policy and link it at each point of collection.
Block enrolment until a written or electronic release is recorded.
Name every recipient in the disclosure consent and in signed agreements.
Prohibit vendor sale, resale and own-model training on your biometric data.
Encrypt templates and restrict access to named human and machine identities.
Automate deletion at purpose end or 3 years after last interaction, including backups.
Review Texas, Washington and comprehensive state law requirements for non-Illinois users.
Track the retroactivity question in Illinois state courts with counsel.

Standards and references

Related NHI Mgmt Group resources: Biometrics Guide · US State Privacy Laws Guide · Deepfake-Resistant Identity Verification Guide · Global Privacy Regulatory Map. This guide summarises the Illinois Biometric Information Privacy Act and related Texas and Washington biometric laws as of October 2026 and is not legal advice.

Illinois BIPA and Biometric Privacy Guide: Consent, Retention and Litigation Risk