Biometric Information Privacy Act (BIPA)

What BIPA covers

BIPA protects biometric identifiers: a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry, and biometric information, meaning any information based on those identifiers that is used to identify a person. The law excludes things like photographs, writing samples, physical descriptions and certain health care data.

In HR, the common sources are:

• Finger-scan or face-scan timeclocks used for time and attendance
• Badge and door access systems using fingerprints or face recognition
• Video interview or assessment tools that analyze facial geometry or voice
• Identity verification tools that match a selfie to an ID document during onboarding or remote proctoring
• Voice authentication in contact center systems

It applies to any private entity collecting biometrics from people in Illinois, regardless of where the company is headquartered.

What employers must do

1. Publish a written policy, available to the public, with a retention schedule and destruction guidelines. Biometrics must be destroyed when the original purpose has been satisfied or within three years of the person's last interaction with the company, whichever comes first.
2. Inform in writing before collection: that biometrics are being collected or stored, the specific purpose and how long they will be kept.
3. Get a written release signed by the person. A 2024 amendment confirmed that an electronic signature counts. For employees, the release can be part of employment paperwork.
4. Never sell, lease, trade or profit from biometric data.
5. Limit disclosure to cases the law allows, such as with consent or as required by law.
6. Protect it with at least the care used for other confidential and sensitive information in your industry.

Why it matters: damages and case law

BIPA is unusual because it gives individuals a private right of action. Plaintiffs can recover $1,000 per negligent violation or $5,000 per intentional or reckless violation, or actual damages if greater, plus attorneys' fees. Three Illinois Supreme Court decisions shaped the risk:

• Rosenbach v. Six Flags (2019): a person does not need to show actual harm; a technical violation is enough to sue.
• Tims v. Black Horse Carriers (2023): a five-year limitations period applies to these claims.
• Cothron v. White Castle (2023): each scan without consent could be a separate violation, raising the prospect of enormous damages for daily timeclock use.

In August 2024 Illinois amended BIPA so that repeated collection of the same biometric by the same method counts as a single violation per person. That reduced, but did not remove, exposure. Hundreds of class actions have been filed against employers over timeclocks alone.

Worked example

A food distributor with 400 warehouse employees in Illinois installs finger-scan timeclocks. Before activation, HR publishes a biometric policy on its website, adds a BIPA notice and electronic consent form to onboarding, and offers a badge alternative for anyone who declines. The vendor contract confirms the vendor will not use templates for any other purpose and will delete them within 30 days of an employee's separation. HR runs a quarterly report of terminated employees and confirms deletion. Without the consent step, each of those 400 employees could have a claim worth $1,000 to $5,000.

BIPA and AI hiring tools

Video interview and assessment tools are a second exposure area. If a tool extracts face geometry or a voiceprint, even to detect fraud or confirm identity, BIPA consent is needed before the interview, separate from any notice under the Illinois AI Video Interview Act. Ask vendors exactly what features they extract, whether those features can identify a person and where they are stored. Many vendors have removed facial analysis features for this reason.

Common mistakes and best practice

• Consent after first use rather than before.
• No public retention policy, or a policy that doesn't match what the vendor actually does.
• Forgetting former employees: biometric templates that sit in a timeclock database years after separation.
• Vendor blind spots: the employer is responsible even when the vendor holds the data.
• Assuming other states don't matter: Texas and Washington have biometric laws too, without a private right of action, and several cities and states regulate biometric use in other ways.

This is general information; have counsel review policies and consent language.