The State of Illinois has enacted the Biometric Information Privacy Act, one of the strongest state laws protecting individuals’ biometric data. BIPA makes it unlawful for a business to collect or otherwise obtain a person’s biometric identifiers or biometric information, unless it receives informed consent.

BIPA also prohibits selling, leasing, trading, or otherwise profiting from a person’s biometric identifiers or biometric information and requires private entities to develop and comply with a written policy—made available to the public establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information when the initial purpose for collecting such identifiers or information has been satisfied or within three years of the individual’s last interaction with the private entity, whichever occurs first.

Finally, BIPA provides for statutory damages of $5,000 for each willful and/or reckless violation of BIPA or, in the alternative, statutory damages of $1,000 for each negligent violation.

While many BIPA cases arise from employers’ using biometric time clocks to capture employees’ biometric information without consent, there are numerous other ways that companies illegally collect such information. For instance, numerous social media platforms, such as Facebook, TikTok and SnapChat, have settled BIPA cases for using biometric information to perform facial scans.

Our firm is incredibly well-versed in the nuances of BIPA; if you believe that your biometric information and/or identifiers have been captured without your consent, get in touch.

Representative Matters