Why Illinois' BIPA Is the Center of This Area
The Illinois Biometric Information Privacy Act (740 ILCS 14, enacted 2008) is one of the only US laws that gives ordinary individuals a private right of action over biometric data collection — meaning you can sue directly, not just file a regulatory complaint. It requires a private entity to get informed written consent before collecting fingerprints, face geometry scans, iris scans, or voiceprints, including telling you in writing what's being collected, why, and how long it will be kept and used. The Illinois Supreme Court held in Rosenbach v. Six Flags (2019) that you don't need to show actual injury beyond the statutory violation itself to sue — the violation of your statutory right is enough to have standing.
A major shift happened in August 2024: the Illinois legislature passed SB 2979, amending BIPA so that a private entity can be held liable for only one violation per person per method of collection or disclosure — not a separate violation (and separate damages) every single time the same person is scanned by the same system. The Seventh Circuit Court of Appeals subsequently held this amendment applies retroactively to pending cases. This materially changed the financial exposure in BIPA cases compared to the earlier "per-scan" damages theory that drove some very large settlements — so don't assume older reporting about BIPA damages still reflects current law. verify the current retroactivity and application of SB 2979 to any specific pending matter
On the statute-of-limitations question, the Illinois Supreme Court resolved a real dispute in Tims v. Black Horse Carriers (February 2023), holding that a single five-year limitations period applies to all BIPA claims (rejecting an argument that some BIPA provisions should get a shorter one-year period). This gives BIPA claims a meaningfully longer window than many other privacy statutes.
What You Can Actually Recover Under BIPA
Liquidated damages are available without proving a specific dollar loss — but the per-person cap now matters a lot
Negligent violation
Liquidated damages of $1,000 or actual damages, whichever is greater, per BIPA's statutory text — now capped at one violation per person per collection/disclosure method under the 2024 amendment.
Intentional or reckless violation
Liquidated damages of $5,000 or actual damages, whichever is greater — same per-person cap applies post-amendment.
Injunctive relief and fees
A court can also order the entity to stop the unlawful practice and award reasonable attorney's fees and costs to a prevailing plaintiff.
Other States, and the EU/GDPR Approach
A few other US states have biometric privacy statutes — Texas' Capture or Use of Biometric Identifier Act (CUBI) and Washington's biometric privacy law among them — but critically, most of these do not include a private right of action; enforcement is generally limited to the state attorney general, meaning you typically cannot sue directly the way you can in Illinois. verify the current private-right-of-action status in any specific state before assuming you can sue
In the EU, GDPR treats biometric data used for the purpose of uniquely identifying a person as a "special category" of personal data under Article 9, generally requiring explicit consent (or another narrow legal basis) before it can be processed — a stricter baseline than ordinary personal data. In California, the CCPA/CPRA classifies biometric information as "sensitive personal information," giving consumers a right to limit its use and disclosure, though California's consumer privacy framework does not provide the same kind of direct statutory-damages private right of action that BIPA does for most violations. verify current CCPA/CPRA private-action provisions, which are narrower and tied mainly to data breaches
How to Pursue a Biometric Privacy Claim, Step by Step
Confirm your state's law first — the available remedy is completely different depending on where you are
Confirm what biometric data was actually collected
BIPA covers specific "biometric identifiers" (fingerprint, retina/iris scan, voiceprint, hand or face geometry scan) and "biometric information" derived from them — photographs alone and certain other data are treated differently under the statute's definitions. verify whether your specific situation involves data covered by BIPA's definitions
Check whether you received proper written notice and gave written consent
BIPA requires informed written consent before collection, including disclosure of the purpose and retention/destruction schedule — the absence of this notice/consent is usually the core of a BIPA claim.
Confirm which state's law applies to you
If you're not in Illinois, check whether your state has any biometric privacy statute at all, and specifically whether it includes a private right of action — many do not, which changes your realistic options substantially.
Document the collection and any retention/disclosure
Save any notices (or the absence of one), the device or system involved, dates, and any evidence the data was disclosed to a third party without consent.
Consult a privacy attorney about individual or class claims
BIPA cases are frequently brought as class actions given how many people a single employer's or vendor's system may affect — an attorney can assess whether your situation fits an existing or potential class claim, and how the 2024 damages cap affects valuation.
Documents to gather
- Any written notice or consent form you were given (or evidence none was provided)
- The device, app, or system that collected the biometric data
- Dates of collection, and how many times/methods were used
- Any evidence of disclosure to a third party (vendor, processor)
- Your employment or account records tied to the collection, if relevant
Timelines and Limitation Periods
Illinois gives you a longer window than many privacy statutes — but confirm your own state's rule
The five-year figure below is specific to Illinois BIPA claims following the Illinois Supreme Court's 2023 ruling — other states with biometric statutes may set different, and possibly much shorter, limitations periods.
| Jurisdiction | Limitation Period |
|---|---|
| Illinois — BIPA claims (all provisions) | 5 years, per Tims v. Black Horse Carriers (Ill. Sup. Ct. 2023) |
| Texas — CUBI enforcement | Attorney-general enforcement only in most cases; no general private right of action, so an individual deadline is generally not applicable in the same way verify |
| EU — GDPR complaint to a supervisory authority | No fixed deadline to complain to a data protection authority, but check national implementing rules and any civil-claim limitation period in your EU member state verify |
Realistic Outcomes and Caveats
Clear-cut Illinois BIPA cases — no written notice, no consent, biometric data plainly covered by the statute — remain a genuinely strong claim with statutory liquidated damages available even without proving a specific financial loss.
The 2024 damages amendment (one violation per person per method, applied retroactively per the Seventh Circuit) means the very large aggregate damages figures associated with older "per-scan" BIPA litigation are no longer the realistic baseline for new or pending claims — expect materially different valuation than pre-2024 cases.
Outside Illinois, your realistic options are often narrower — many states either have no biometric privacy statute or one without a private right of action, meaning a regulatory complaint (not a lawsuit) may be your main avenue.
Common Pitfalls
Assuming BIPA applies outside Illinois
BIPA is an Illinois statute — other states have different (often much weaker, or nonexistent) biometric privacy protections. Confirm which state's law actually governs your situation.
Relying on outdated "per-scan" damages expectations
The 2024 amendment capping liability to one violation per person per method changed the damages math significantly — don't assume pre-2024 settlement figures reflect what a current claim is worth.
Confusing a photograph with a "biometric identifier"
BIPA's definitions are specific (face geometry scans, not photographs generally) — not every use of your image is automatically a BIPA violation.
Missing that many states have no private right of action
A state having some biometric-related statute doesn't mean you personally can sue over it — several state biometric laws are enforceable only by the state attorney general.
Organize Your Biometric Privacy Case
Use the calculator to organize the notices (or lack of them), devices, and dates involved in the biometric data collection.
Organize Your Biometric Privacy Case
Use the calculator to organize the notices (or lack of them), devices, and dates involved in the biometric data collection.
This stays in your private workspace until you choose a next step. It does not submit a claim on your behalf on its own.
Official and Legal References
- Justia — 740 ILCS 14, Biometric Information Privacy Act (full text)
- Sidley Austin — Illinois Supreme Court Clarifies Statute of Limitations for BIPA Claims: Five Years
- Davis Wright Tremaine — Seventh Circuit Holds BIPA Amendment Limiting Damages Applies Retroactively
- EUR-Lex — GDPR Article 9 (Processing of Special Categories of Personal Data)
Illinois BIPA vs. Other US States vs. EU GDPR
Illinois' BIPA is unusual in giving individuals a direct private right of action with statutory liquidated damages. Most other US states with biometric-related statutes (e.g., Texas, Washington) restrict enforcement to the state attorney general, without an individual lawsuit right. The EU's GDPR takes a different structural approach — treating biometric identification data as a special category requiring explicit consent, enforced primarily through data protection authorities and, in some member states, individual civil claims. Confirm which regime actually covers your situation before assuming BIPA-style remedies are available.
Frequently Asked Questions
Real edge cases, answered in plain language
My employer uses a fingerprint time clock without asking me to sign anything — is that a BIPA violation?
Does the 2024 amendment mean my old BIPA claim is worthless now?
I'm not in Illinois — do I have any biometric privacy rights at all?
Organize Your Biometric Privacy Case
Use the calculator to organize the notices (or lack of them), devices, and dates involved in the biometric data collection.