Illinois Biometric Information Privacy Act (BIPA)

A private entity in possession of biometric identifiers or biometric information must develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying the data when the initial purpose for collecting it has been satisfied or within three years of the individual last interaction with the entity, whichever occurs first. Absent a valid warrant or subpoena, the entity must comply with that schedule and those guidelines.

Applies when

Chinese companies capturing face, fingerprint, iris or voice biometrics in Illinois, including facial access control, liveness detection, voiceprint assistants, AR or VR eye and hand modelling, and training models on face data.

Evidence to retain

• · Published biometric retention and destruction policy with an archived copy of the page
• · Biometric data inventory with last-interaction timestamps
• · Destruction execution logs and technical evidence
• · Records of handling any warrant or subpoena exception

Estimated first-time effort: 5–15 person-days (estimate, not a commitment)

Before collecting, capturing, purchasing, receiving through trade or otherwise obtaining a biometric identifier or biometric information, a private entity must first inform the subject or the subject legally authorized representative in writing that the data is being collected or stored; inform them in writing of the specific purpose and length of term for which it is being collected, stored and used; and receive a written release executed by the subject or that representative. The definition of written release in section 14/10 was amended by P.A. 103-769 (eff. 2024-08-02) and now reads informed written consent, electronic signature, or, in the context of employment, a release executed by an employee as a condition of employment, so an electronic signature is expressly available.

Applies when

As above, with the highest exposure in employee time and attendance, factory safety monitoring, access control and remote-work monitoring.

Evidence to retain

• · Written notice text including the purpose and term fields
• · Executed written releases or electronic signature records
• · Description of the system control that blocks collection before consent
• · Consent workflows differentiated for employees and third parties such as visitors and contractors

Estimated first-time effort: 5–20 person-days (estimate, not a commitment)

A private entity in possession of a biometric identifier or biometric information may not sell, lease, trade or otherwise profit from it, and may not disclose, redisclose or otherwise disseminate it except in the circumstances the statute allows. This is a hard constraint on product designs that train models on face or voice data or that monetize collected biometric data.

Applies when

Companies that use biometric data for model training, data partnerships or onward supply.

Evidence to retain

• · Inventory of outbound biometric data flows with the legal basis for each
• · Compliance review records for training-data provenance
• · Contract clauses prohibiting profiting and restricting disclosure
• · Data access audit logs

Estimated first-time effort: 5–15 person-days (estimate, not a commitment)

BIPA provides a private right of action: any person aggrieved by a violation may sue in state circuit court or as a supplemental claim in federal district court. A prevailing party may recover, for each violation, liquidated damages of $1,000 or actual damages, whichever is greater, against a private entity that negligently violates the Act, and $5,000 or actual damages, whichever is greater, against one that intentionally or recklessly violates it, plus reasonable attorney fees and costs including expert witness fees, and the court may grant other relief such as an injunction. The decisive damages limits are in section 14/20(b) and (c), added by P.A. 103-769 (eff. 2024-08-02): collecting the same biometric identifier or information from the same person using the same method of collection in more than one instance is a single violation of section 15(b) with at most one recovery, and disclosing the same data about the same person to the same recipient in more than one instance is a single violation of section 15(d) with at most one recovery. The older per-scan damages theory therefore no longer holds, though the completeness, retrievability and timestamp reliability of notice and consent records still drive class-action exposure directly.

Applies when

Any company performing biometric collection in Illinois.

Evidence to retain

• · Verification report on the completeness and retrievability of consent records
• · Timestamping and log retention design for biometric processing systems
• · Allocation-of-liability agreements with vendors such as face recognition SDK and access control suppliers
• · Insurance and risk reserve assessment records

Estimated first-time effort: 5–15 person-days (estimate, not a commitment)