Biometric Privacy Litigation: BIPA, Rosenbach, Cothron, the 2024 Amendment, and the Laws Following Illinois

Summary. This article explains how a 2008 Illinois statute written for finger-scan payment kiosks became the most consequential privacy litigation engine in the United States, and what the law looks like after the 2024 amendment. It walks through the Biometric Information Privacy Act section by section, then tells the stories of the cases that shaped it: Rosenbach on standing to sue without actual harm, Bryant, Fox, and Thornley on federal jurisdiction, Patel and the $650 million Facebook settlement, Tims on the five-year limitations period, Cothron on per-scan accrual, and the BNSF jury verdict that was vacated. It covers the defenses that work (labor preemption, the health care and financial institution exemptions, extraterritoriality) and those that failed (workers' compensation exclusivity), along with the insurance coverage cases. It then maps the laws that followed Illinois, from Texas and Washington to California, Colorado, New York City, Portland, and the Federal Trade Commission. A worked example, common mistakes, an FAQ, and takeaways for companies, plaintiffs, and insurers close the article.

In 2016, a family-owned commercial bakery outside Joliet replaced its paper time cards with a fingerprint time clock. The salesman called it "buddy-punch proof," and he was right: nobody could clock in for a late friend anymore. Each of the bakery's 140 hourly workers pressed a finger to the reader four times a shift, in and out for the day and in and out for lunch. The clock's software converted each print into a mathematical template and sent it to the vendor's cloud server, where it sat next to the payroll data.

Nobody at the bakery had heard of the Illinois Biometric Information Privacy Act. Nobody signed anything. There was no written policy saying how long the templates would be kept or when they would be destroyed.

Five years later a former mixer operator filed a class action in the Circuit Court of Cook County. The complaint was eleven pages long and alleged no stolen identity, no data breach, and no money lost. It alleged that the bakery had collected fingerprints without written notice and a signed release, had disclosed them to the time-clock vendor without consent, and had never published a retention schedule. It asked for $1,000 for each negligent violation and $5,000 for each reckless one.

The bakery's owner did the arithmetic on a napkin and then stopped, because the number was larger than the value of the company. Whether that arithmetic was right depended on two Illinois Supreme Court decisions issued two weeks apart in February 2023, and then on an amendment the General Assembly passed in 2024 to undo one of them. This article tells that story, from the statute's quiet enactment through the litigation wave it produced to the laws that other states, cities, and federal regulators have since written in its shadow.

The short answer

• BIPA regulates five things. A private entity that handles biometric identifiers (fingerprints, voiceprints, retina or iris scans, hand or face geometry) or information derived from them must publish a retention and destruction policy, give written notice and get a written release before collection, never sell or profit from the data, disclose it only with consent or legal authority, and protect it at least as carefully as other sensitive data. See the Biometric Information Privacy Act, 740 ILCS 14/15.
• Anyone "aggrieved" can sue, without showing harm. In Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186, the Illinois Supreme Court held that the violation of the statutory right is itself the injury. Liquidated damages are $1,000 per negligent violation and $5,000 per intentional or reckless violation, plus attorney's fees, under 740 ILCS 14/20.
• Federal court is a mixed blessing for defendants. Section 15(b) notice-and-consent claims carry Article III standing under Bryant v. Compass Group USA, Inc., 958 F.3d 617 (7th Cir. 2020), but some section 15(a) and 15(c) claims do not, and claims without standing go back to state court.
• The clock is long and, for a while, it ticked with every scan. Tims v. Black Horse Carriers, Inc., 2023 IL 127801 applied a five-year limitations period to every BIPA claim, and Cothron v. White Castle System, Inc., 2023 IL 128004 held that a separate claim accrues with each scan or transmission.
• The 2024 amendment cut the multiplier, not the statute. Public Act 103-0769 (Senate Bill 2979) provides that repeated collection or disclosure of the same biometric from the same person by the same method is a single violation with one recovery, and confirms that an electronic signature satisfies the written-release requirement. Whether it applies to cases pending when it took effect has divided trial courts.
• Some defenses work. Unionized workers' claims are often preempted by federal labor law. Health care workers' data used for treatment, payment, or operations falls within the HIPAA exclusion. Financial institutions subject to the Gramm-Leach-Bliley Act and contractors working for government agencies are carved out. Workers' compensation exclusivity is not a defense.
• Other jurisdictions followed, but none copied the private right of action wholesale. Texas and Washington rely on attorney general enforcement (Texas has used it to win settlements reported at more than $1 billion each from Meta and Google). California, Colorado, and most comprehensive state privacy laws treat biometrics as sensitive data. New York City and Portland regulate businesses open to the public. The FTC treats unfair biometric practices as violations of 15 U.S.C. § 45.

Why Illinois, and why 2008

BIPA was passed in 2008, before most Americans owned a smartphone with a fingerprint sensor and years before face recognition was built into photo apps. The immediate backdrop was the collapse of a finger-scan payment company that had piloted "pay by touch" checkout at grocery stores in Illinois and elsewhere. When that company went into bankruptcy, the fingerprints of its customers looked like an asset that might be sold. Legislators did not want a database of unchangeable identifiers auctioned off as part of a bankruptcy estate.

The legislative findings, codified at 740 ILCS 14/5, make the core point in one sentence that every BIPA brief quotes: Social Security numbers can be changed when compromised, but biometrics "are biologically unique to the individual; therefore, once compromised, the individual has no recourse." The findings note that members of the public were wary of biometric technology and that the full ramifications of the technology were not yet known. The cure the legislature chose was not a ban but a set of process rules: tell people, get their written permission, set a deadline for destruction, and do not trade in the data.

What made the statute unusual was the remedy. Most privacy statutes of that era were enforced by an agency or an attorney general. BIPA gave a private right of action to "any person aggrieved by a violation," with liquidated damages that did not depend on proof of loss and with fee shifting for a prevailing party. For seven years almost nobody noticed. The first significant wave of suits, beginning around 2015, targeted social-media face tagging and photo-book companies. The second wave, beginning around 2017 and still running, targeted ordinary employers that had bought fingerprint and hand-geometry time clocks. That second wave is why a statute about grocery-store payment kiosks became a concern for trucking companies, nursing homes, restaurants, and bakeries.

For a broader policy history of biometric regulation and its implications for model development, see Biometric Data Privacy Laws and Their Impact on AI Development. This article focuses on the litigation.

The statute, section by section

What counts as biometric data

Section 10 defines two categories. A biometric identifier is "a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry." Biometric information is any information, "regardless of how it is captured, converted, stored, or shared," that is based on a biometric identifier and used to identify an individual. The second category is what makes the statute reach the templates and hashes that most systems actually store: a vendor that keeps only a mathematical representation of a fingerprint, never the image, still holds biometric information. See 740 ILCS 14/10.

The definition also lists what is not a biometric identifier: writing samples, written signatures, photographs, human biological samples used for valid scientific testing or screening, demographic data, tattoo descriptions, physical descriptions such as height and weight, donated organs and tissue, information captured from a patient in a health care setting or collected for health care treatment, payment, or operations under HIPAA, and images from X-rays, MRIs, and similar diagnostic procedures.

The photograph exclusion produced the first big interpretive fight. Facebook, Google, and Shutterfly argued that because photographs are excluded, face geometry derived from photographs must be excluded too. Courts rejected that reading. In Rivera v. Google Inc., 238 F. Supp. 3d 1088 (N.D. Ill. 2017), the court held that a face template created by scanning an uploaded photograph is a "scan of face geometry"; the exclusion covers the photograph itself, not the biometric measurements extracted from it. That reading has held, and it is the doctrinal foundation for every later face-recognition case, including the suits against Clearview AI.

DNA is a notable gap. Because "human biological samples used for valid scientific testing or screening" are excluded, genetic testing is regulated in Illinois by a different statute, the Genetic Information Privacy Act, which has its own private right of action.

The five duties in section 15

See 740 ILCS 14/15. Two drafting details drive much of the litigation.

"Possession" versus "collection." Subsections 15(a), (c), (d), and (e) apply to an entity "in possession" of biometric data. Subsection 15(b) applies to an entity that collects, captures, purchases, receives through trade, or otherwise obtains it. Several federal courts have read 15(b) to require an active step by the defendant, which matters for technology vendors that sell equipment but never decide to collect anything. In Heard v. Becton, Dickinson & Co., 440 F. Supp. 3d 960 (N.D. Ill. 2020), the court dismissed 15(b) claims against the maker of medication-dispensing cabinets because the complaint did not allege the manufacturer itself took an active step to collect the nurses' fingerprints, while recognizing that possession-based claims could proceed on adequate allegations. Vendors cannot count on that defense: later courts have let 15(b) claims proceed against vendors whose systems were alleged to capture and store the data on the vendor's own servers.

"Written release." The statute defines a written release as "informed written consent" or, in the employment context, a release executed by an employee as a condition of employment. Employers therefore do not need to give workers a genuine choice; they can make biometric enrollment a condition of the job, as long as the release is signed before collection. The 2024 amendment added that an electronic signature counts.

Damages and fees in section 20

Section 20 gives "any person aggrieved" a right of action in state circuit court or as a supplemental claim in federal court. A prevailing party "may recover" for each violation:

• against a private entity that negligently violates the Act, liquidated damages of $1,000 or actual damages, whichever is greater;
• against a private entity that intentionally or recklessly violates the Act, liquidated damages of $5,000 or actual damages, whichever is greater;
• reasonable attorney's fees and costs, including expert witness fees and other litigation expenses; and
• other relief, including an injunction.

Three words in that section did a great deal of work. "Aggrieved" was the subject of Rosenbach. "Each violation" was the subject of Cothron. "May recover" turned out to be the reason the largest jury verdict in BIPA history was vacated.

Exemptions in section 25

Section 25 contains the statutory carve-outs. The Act does not apply "in any manner" to a financial institution or an affiliate of a financial institution that is subject to Title V of the Gramm-Leach-Bliley Act, the privacy title codified at 15 U.S.C. § 6801 and defined in 15 U.S.C. § 6809. It does not apply to a contractor, subcontractor, or agent of a State agency or local unit of government when working for that agency or unit. It does not impair the admission or discovery of biometric data in court, and it does not conflict with the HIPAA framework. "Private entity" itself excludes state and local government agencies and Illinois courts, so public employers are outside the statute entirely.

The financial-institution exemption has been litigated mostly by banks and their vendors. The question is whether the defendant itself is a "financial institution" under Title V, which borrows the Bank Holding Company Act's broad list of "financial activities." That list is wider than it sounds: a federal court in Delaware held in 2023 that a voice-authentication vendor verifying callers to an insurer's financial-services line was itself engaged in a financial activity (authenticating the identity of persons conducting transactions) and therefore exempt. A vendor is not exempt merely because its customer is a bank, but a vendor whose own service is a recognized financial activity may be. The government-contractor exemption has been invoked by companies running systems for public agencies (for example, vendors operating fingerprint or face-matching systems for a police department or a state agency) and turns on whether the defendant was "working for" the government entity when it handled the data.

Rosenbach: a season pass and the meaning of "aggrieved"

In 2014, Stacy Rosenbach bought her fourteen-year-old son Alexander a season pass to Six Flags Great America in Gurnee, Illinois, so he could go on a school field trip. Six Flags had switched to a fingerprint system for season-pass holders: you scanned your thumb at the gate, and the system matched the scan to your pass. Alexander was fingerprinted at a security checkpoint. Neither he nor his mother received any written explanation of the purpose or how long the print would be kept, and neither signed a release.

Rosenbach sued under BIPA. She did not claim that anyone had stolen her son's fingerprint or used it to open a bank account. Six Flags argued that a person who suffered no actual harm was not "aggrieved" and could not sue. The Illinois appellate court agreed with Six Flags. The Illinois Supreme Court unanimously reversed in January 2019.

The court's reasoning in Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186 rested on the ordinary legal meaning of "aggrieved": a person is aggrieved when a legal right is invaded, whether or not the invasion produces a further pecuniary loss. BIPA gives individuals a right to control their biometric data and conditions collection on notice and consent. When a company collects without following the procedure, the individual has lost the very control the statute guarantees. The court called that injury "real and significant," not a "mere technicality," and pointed out that the statute's purpose is preventive: by the time an identity thief uses a compromised fingerprint, it is too late, because a fingerprint cannot be reissued. The private right of action, with liquidated damages, gives companies a reason to comply before harm occurs.

Rosenbach turned BIPA from a statute that required proof of harm into one that required proof of a procedural failure. Filing numbers climbed sharply after 2019, and the claims that followed were overwhelmingly employment cases about time clocks, because an employer that installed fingerprint clocks without paperwork had committed a provable violation as to every worker on the payroll.

Standing in federal court: Bryant, Fox, and Thornley

Rosenbach settled the question in Illinois courts, which are not bound by Article III. Federal courts are. Under Spokeo, Inc. v. Robins, 578 U.S. 330 (2016), a bare procedural violation divorced from concrete harm does not satisfy Article III, and TransUnion LLC v. Ramirez, 594 U.S. 413 (2021) later tightened the test by asking whether the asserted harm has a close relationship to a harm traditionally recognized as a basis for suit. Every BIPA defendant removing a case to federal court under the Class Action Fairness Act, 28 U.S.C. § 1332(d) and § 1453, therefore takes on the burden of establishing that the plaintiff has standing. That produces an inverted posture that surprises non-specialists: the defendant argues the plaintiff was injured, and the plaintiff argues she was not.

The Seventh Circuit sorted the claims in three decisions.

Bryant v. Compass Group USA, Inc., 958 F.3d 617 (7th Cir. 2020). Christine Bryant bought snacks from "Smart Market" vending kiosks in her workplace cafeteria, which required users to set up accounts with a fingerprint. She sued the kiosk operator in state court, and Compass removed. The Seventh Circuit held that her section 15(b) claim was concrete: by withholding the required disclosures and failing to obtain her written release, Compass deprived her of information and the opportunity to make an informed choice, an injury the court analogized to informational harms the Supreme Court has recognized. Her section 15(a) claim, as she pleaded it, was different. The duty to publish a retention policy runs to the public at large, and she alleged no particularized harm from its absence, so the federal court lacked jurisdiction over that portion.

Fox v. Dakkota Integrated Systems, LLC, 980 F.3d 1146 (7th Cir. 2020). Raven Fox's 15(a) claim was broader: she alleged not just that her employer failed to publish a policy, but that it failed to develop, comply with, and follow one, retaining her fingerprint data after she left. The court held that unlawful retention of a person's biometric data is a concrete and particularized injury, closely analogous to the invasion of privacy, so her 15(a) claim belonged in federal court. Bryant and Fox together mean that a 15(a) claim's fate depends on how it is pleaded: "you never published a policy" may lack standing, while "you kept my data past the deadline" has it.

Thornley v. Clearview AI, Inc., 984 F.3d 1241 (7th Cir. 2021). Clearview AI built a face-search tool by scraping billions of photos from the public internet and selling access to law enforcement and private customers. The plaintiffs in Thornley sued in state court on a deliberately narrow theory: a section 15(c) claim that Clearview profited from their biometric data, with an express disclaimer of any injury beyond the statutory violation itself. Clearview removed, and the plaintiffs moved to remand. The Seventh Circuit agreed with the plaintiffs: a bare allegation that a company profited from biometric data, without any claim of harm to the plaintiff, is a general regulatory grievance, not a particularized injury. Remand was proper.

When a federal court lacks jurisdiction over a removed claim, the remedy is remand, not dismissal; see 28 U.S.C. § 1447(c) and Collier v. SP Plus Corp., 889 F.3d 894 (7th Cir. 2018). For a defendant, that means a failed removal does not end the case; it simply returns it to Cook County. For the general law of standing after TransUnion, see Article III Standing After TransUnion: Concrete Injury, Traceability, and the End of No-Injury Claims, and for the removal mechanics, CAFA Jurisdiction and Class Action Removal: Amount in Controversy, Exceptions, and Mass Actions.

Patel v. Facebook: face templates at platform scale

In 2010 Facebook launched "Tag Suggestions." When a user uploaded a photo, Facebook's software detected faces, computed a face signature, and compared it with stored templates of the user's friends to suggest who was in the picture. Illinois users sued in 2015, and the consolidated case moved to the Northern District of California.

Facebook raised nearly every defense available. It argued that the plaintiffs lacked standing, that BIPA could not apply to conduct on servers outside Illinois, and that a class could not be certified because the extraterritoriality question and the potential damages (billions of dollars at $1,000 or $5,000 per class member) made class treatment inappropriate. In Patel v. Facebook, Inc., 932 F.3d 1264 (9th Cir. 2019), the Ninth Circuit rejected each argument at the class-certification stage. It held that the development of a face template without consent invades an individual's private affairs and concrete interests, satisfying Article III. It held that the extraterritoriality question could be decided on a classwide basis. And it held that the prospect of a large aggregate statutory award did not make a class action an inferior method under Fed. R. Civ. P. 23(b)(3).

Facebook settled. The district court granted final approval in February 2021 to a $650 million settlement, raised from an initial $550 million after the court expressed concerns; see In re Facebook Biometric Information Privacy Litigation (N.D. Cal. Feb. 26, 2021). Reported payments to the roughly 1.6 million claimants were several hundred dollars each. Facebook later announced it was shutting down its face-recognition system for tagging and deleting the associated templates.

The Ninth Circuit later drew a boundary in Zellmer v. Meta Platforms, Inc., 104 F.4th 1117 (9th Cir. 2024), a suit by a person who never had a Facebook account but appeared in photos uploaded by users. The court affirmed summary judgment for Meta: the face signatures created for non-users could not be used to identify them, and BIPA's definitions are concerned with data capable of identifying a person. The decision gives defendants a factual defense in face-detection cases where the system detects a face without linking it to identity, though its application depends heavily on the technical record.

Clearview AI: when the plaintiff class is everyone

Clearview's database, built from photos scraped from social media, news sites, and other public pages, put nearly every Illinois resident with an online photo in the putative class. The litigation took two tracks. A coalition led by the ACLU sued in Cook County, and in May 2022 Clearview agreed to a settlement that permanently barred it from selling or giving access to its face database to most private entities nationwide and, for five years, to Illinois state and local agencies, including police. The private class actions were consolidated in a multidistrict proceeding in the Northern District of Illinois; see In re Clearview AI, Inc., Consumer Privacy Litigation. Because Clearview lacked the cash to fund a conventional settlement, the parties agreed in 2024 to give the nationwide class a stake in the company equal to 23 percent of its equity as of September 2023, payable on a future sale, public offering, or similar event, with an option to sell the class's interest. The district court granted final approval in 2025, and objectors appealed to the Seventh Circuit, arguing among other things that the class received no injunctive relief and that the allocation among state subclasses was unfair.

The Clearview litigation matters for two reasons beyond its size. It is the leading example of a BIPA claim against a company with no relationship at all to the people whose faces it captured, which means notice and consent were never possible; the only compliant path was not to collect. And it shows the limits of the remedy: liquidated damages are meaningless against a defendant that cannot pay them, which is why both settlements emphasized conduct restrictions and contingent equity rather than cash.

For companies building or buying face-recognition or training datasets, the vendor side of this problem is addressed in AI Licensing Toolkit: Data Provenance Records, License Terms, and Indemnity Clauses and Trade Secrets and Generative AI: Reasonable Measures, Prompt Leakage, and Vendor Terms.

McDonald: the workers' compensation defense fails

Employers sued over time clocks looked for a defense that would end all the employee cases at once, and the Illinois Workers' Compensation Act seemed to offer one. The Act's exclusivity provision, 820 ILCS 305/5(a), bars employees from suing their employers for accidental injuries arising out of and in the course of employment; the remedy is a compensation claim, not a lawsuit.

Marquita McDonald worked at Symphony Bronzeville Park, a Chicago nursing home, and used a fingerprint clock without signing a release. Symphony argued that any injury she suffered was a workplace injury within the exclusivity bar. In McDonald v. Symphony Bronzeville Park, LLC, 2022 IL 126511, the Illinois Supreme Court disagreed. The injury BIPA addresses, the loss of the ability to control one's biometric data, is not the type of physical or psychological injury the compensation system was designed to address; it is not compensable under the Act at all. Because the compensation system could not provide a remedy for it, exclusivity could not bar the statutory claim. The decision closed the most obvious systemic defense and confirmed that time-clock claims would proceed on their merits.

Labor preemption: the defense that does work

Federal labor law succeeded where workers' compensation failed. In Miller v. Southwest Airlines Co., 926 F.3d 898 (7th Cir. 2019), unionized airline employees challenged their employers' fingerprint timekeeping. The Seventh Circuit held that a union is the employees' bargaining agent on matters such as timekeeping methods, that the question whether the union consented (or whether the employer could implement the system under the management-rights clause) required interpreting the collective bargaining agreement, and that the dispute was therefore a "minor dispute" for the adjustment board under the Railway Labor Act. In Fernandez v. Kerry, Inc., 14 F.4th 644 (7th Cir. 2021), the court applied the same reasoning to employees covered by section 301 of the Labor Management Relations Act. And in Walton v. Roosevelt University, 2023 IL 128338, the Illinois Supreme Court agreed that BIPA claims by bargaining-unit employees are preempted by section 301, aligning state and federal courts.

Preemption is not a complete defense. It applies only to employees covered by a collective bargaining agreement, it requires a showing that the claim depends on interpreting that agreement, and courts have divided over whether it reaches claims (such as some section 15(d) disclosure claims) that do not depend on the union's authority. But for heavily unionized employers such as railroads, airlines, and manufacturers, it removes a large share of the putative class.

Tims and Cothron: the February 2023 one-two punch

BIPA contains no limitations period. Defendants argued for the one-year period in 735 ILCS 5/13-201, which covers actions "for slander, libel or for publication of matter violating the right of privacy," or for the two-year period for statutory penalties. Plaintiffs argued for the five-year catch-all for "all civil actions not otherwise provided for" in 735 ILCS 5/13-205.

Jorome Tims, a former employee of Black Horse Carriers, sued in 2019 over fingerprint timekeeping. The appellate court split the difference, applying the one-year period to the 15(c) and 15(d) claims (which involve publication or disclosure) and five years to the others. On February 2, 2023, in Tims v. Black Horse Carriers, Inc., 2023 IL 127801, the Illinois Supreme Court applied the five-year period to every BIPA claim. A single limitations period, the court reasoned, would promote certainty, and the legislature's purpose in creating BIPA (to encourage compliance before harm occurs) would be undercut by a short window.

Two weeks later, the court answered a question the Seventh Circuit had certified in Cothron v. White Castle System, Inc., 20 F.4th 1156 (7th Cir. 2021). Latrina Cothron had worked as a manager at a White Castle restaurant in Illinois since 2004. White Castle introduced a fingerprint system for accessing pay stubs and computers; BIPA took effect in 2008, and White Castle did not seek her consent until 2018. Cothron sued that year. White Castle argued that her claim accrued, if at all, the first time she scanned after BIPA took effect in 2008, so it was time-barred. Cothron argued that every scan was a new collection and every transmission to the vendor a new disclosure.

On February 17, 2023, in Cothron v. White Castle System, Inc., 2023 IL 128004, a divided Illinois Supreme Court sided with Cothron. The plain language of section 15(b) applies to every collection or capture, not just the first; section 15(d) applies to every disclosure. Each scan is a new violation, and a new claim accrues with each one.

White Castle had warned that, at that rate, its exposure in a class of about 9,500 Illinois employees could exceed $17 billion. The majority did not dispute the arithmetic. It answered in two ways. First, policy concerns about excessive damages were for the legislature, which it invited to revisit the statute. Second, the statute says a prevailing party "may recover" liquidated damages, so a trial court has discretion to award less than the full per-violation amount rather than impose an award that would destroy a defendant's business. The dissent argued that the majority's reading produced absurd and potentially unconstitutional results, and that the more natural reading was that a claim accrues once, on the first unconsented collection.

Together, Tims and Cothron meant that a plaintiff could look back five years and count every scan. For an employer with 500 hourly workers punching four times a shift, the theoretical number became astronomical, and the discretionary-damages escape hatch was little comfort because nobody knew how a judge or jury would use it.

Rogers v. BNSF: the verdict that proved the discretion point

The first BIPA class action to reach a jury was Rogers v. BNSF Railway Co., a case by truck drivers who had their fingerprints scanned by an automated gate system to enter BNSF's Illinois rail yards. BNSF argued that a third-party contractor operated the system. In October 2022 the jury found that BNSF had recklessly or intentionally violated BIPA as to about 45,600 drivers, and the court entered judgment of roughly $228 million, calculated at $5,000 per driver.

Then came Cothron. Because the Illinois Supreme Court had said that BIPA damages are discretionary, not automatic, the district court concluded that a jury had to decide the amount of damages, rather than the court multiplying a statutory figure by the class size. In June 2023 it vacated the damages award and ordered a new trial on damages; see Rogers v. BNSF Railway Co. (N.D. Ill. June 30, 2023). The parties settled before retrial for $75 million.

Rogers proved two things. A jury will find recklessness against a sophisticated defendant that knew about BIPA and relied on a vendor to handle compliance. And "may recover" is real: after Cothron, an aggregate award is a jury question shaped by evidence of the defendant's culpability and the harm, not an automatic multiplication.

The 2024 amendment

The General Assembly accepted the Cothron invitation. Senate Bill 2979 passed in May 2024 and was signed on August 2, 2024, as Public Act 103-0769, effective immediately. It made three changes.

1. One recovery per person, per method, for 15(b). A private entity that, in more than one instance, collects, captures, purchases, receives through trade, or otherwise obtains the same biometric identifier or information from the same person using the same method of collection, in violation of section 15(b), commits a single violation, and the aggrieved person is entitled to at most one recovery.
2. One recovery per person for 15(d). A private entity that discloses, rediscloses, or otherwise disseminates the same biometric identifier or information from the same person to the same recipient using the same method of collection, in violation of section 15(d), commits a single violation for which the aggrieved person may recover at most once, regardless of how many times the disclosure occurred.
3. Electronic signatures. The definition of "written release" now includes an electronic signature, and the amendment adds a definition of "electronic signature" (an electronic sound, symbol, or process attached to or logically associated with a record and executed or adopted with the intent to sign it).

What the amendment did not do matters as much. It did not change the $1,000 and $5,000 amounts, so the maximum recovery per person for 15(b) is still $5,000 (with a separate potential recovery for 15(d), and separate claims for 15(a), (c), and (e)). It did not change the five-year limitations period. It did not add a cure period, a right to notice before suit, or a requirement of actual harm, all of which earlier bills had proposed. It did not create a new exemption.

The immediate fight was retroactivity. Plaintiffs with cases pending on August 2, 2024, argued that the amendment changed substantive rights and applied only prospectively; defendants argued that it was a remedial clarification that applied to pending cases. Several federal district judges in Chicago held in late 2024 and early 2025 that the amendment did not apply retroactively, and the issue was certified for interlocutory appeal to the Seventh Circuit in a group of cases led by Clay v. Union Pacific Railroad Co. For the outcome of that appeal and what it means for pending cases, see Defending or Bringing a Biometric Privacy Claim: A Practical Guide.

The table shows how the amendment changes the arithmetic for the bakery in the opening scene: 140 workers, four scans a shift, 250 shifts a year, five years inside the limitations period, all scans transmitted to one vendor.

Even the per-person number is real money for a small company, particularly once attorney's fees on both sides are added. But it is a number a company can insure, reserve for, and settle, which the per-scan number never was.

Mosby and the health care exclusion

Hospitals were among the largest BIPA defendants because nurses and pharmacists routinely use fingerprint readers to open automated medication-dispensing cabinets. Lucille Mosby, a nurse at Ingalls Memorial Hospital, alleged that the hospital and the cabinet manufacturer required her to scan her fingerprint to access medications without the required notice and release. The defendants pointed to the second half of the section 10 exclusion: biometric identifiers do not include "information collected, used, or stored for health care treatment, payment, or operations under" HIPAA. The appellate court read that clause as limited to patient information. The Illinois Supreme Court reversed in Mosby v. Ingalls Memorial Hospital, 2023 IL 129081, holding that the clause is not limited to patients: a health care worker's biometric data used to dispense medication to patients is collected for "health care treatment, payment, or operations" as those terms are defined in the HIPAA regulations at 45 C.F.R. Part 160 and Part 164.

Mosby is narrower than hospitals hoped. The exclusion turns on the purpose of the collection, not the identity of the employer. Timekeeping, building access, and payroll are not health care treatment, payment, or operations simply because a hospital does them, and courts have been skeptical of attempts to stretch the exclusion to cover workforce timekeeping, particularly on a motion to dismiss without evidence of how the data was actually used. The first clause of the exclusion, "information captured from a patient in a health care setting," has its own limits: in Marino v. Gunnar Optiks LLC, 2024 IL App (1st) 231826, the court held that a shopper using a website's virtual try-on tool for nonprescription glasses was not a "patient in a health care setting."

Vendors, possession, and devices

Time-clock and software vendors face BIPA claims of their own. Three lines of cases define their exposure.

First, possession requires control. In Barnett v. Apple Inc., 225 N.E.3d 602 (Ill. App. Ct. 2022), the court affirmed dismissal of claims over Face ID and Touch ID because the biometric data was created and stored only on the user's own device, Apple did not collect it on any server, and the user alone decided whether to enable the feature. A company that never has the data does not "possess" it.

Second, collection may require an active step, as Heard held for the medication-cabinet manufacturer, though courts differ on how much a vendor must do. A vendor that designs a system to send templates to its own cloud and stores them there is much closer to "collecting" than one that sells a standalone device.

Third, disclosure to a vendor is itself a section 15(d) event for the employer. Most time-clock complaints plead that the employer disclosed workers' biometric data to the vendor that hosted the system, without consent. That is why the employer's release form must cover disclosure to named or described vendors, and why vendors increasingly insist on contractual representations that their customers have obtained BIPA-compliant releases.

Extraterritoriality

BIPA does not say where it applies. Illinois follows a presumption that a statute does not have extraterritorial effect unless the legislature clearly intended it, and under Avery v. State Farm Mutual Automobile Insurance Co., 216 Ill. 2d 100 (2005), a claim under an Illinois statute without extraterritorial reach can proceed only if the circumstances relating to the transaction occurred "primarily and substantially" in Illinois. For an Illinois employer scanning Illinois workers at an Illinois facility, the answer is easy. For an online service based in California that processes photos uploaded by Illinois users on servers in Oregon, it is a fact question, and courts have generally declined to resolve it on the pleadings. Patel treated it as a classwide question; other courts have held that the place where the plaintiff was located when the data was captured is a significant but not decisive factor. Defendants should expect extraterritoriality to be a summary judgment issue, not a motion to dismiss issue.

Arbitration and mass arbitration

Consumer-facing companies with arbitration clauses and class waivers enforceable under 9 U.S.C. § 2 and AT&T Mobility LLC v. Concepcion, 563 U.S. 333 (2011), and employers with arbitration agreements upheld under Epic Systems Corp. v. Lewis, 584 U.S. 497 (2018), discovered that individual arbitration did not end BIPA exposure. Plaintiffs' firms began filing thousands of individual arbitration demands, each carrying a modest claim but each triggering filing and administrative fees the company had agreed to pay.

Wallrich v. Samsung Electronics America, Inc., 106 F.4th 609 (7th Cir. 2024) involved roughly 50,000 BIPA arbitration demands over face and fingerprint features on Samsung devices. When Samsung declined to pay the AAA's fees and the AAA closed the cases, the claimants asked a federal court to compel Samsung to arbitrate and pay. The Seventh Circuit affirmed denial of the petition, holding that the claimants had not carried their burden of proving that each had an arbitration agreement with Samsung (a spreadsheet of names and a few declarations were not enough) and that the AAA's administration of its own fee rules was a matter for the AAA. The decision is a cautionary tale for both sides: claimants must be able to prove each agreement, and companies that rely on the arbitral forum to manage fees may find that it does so on its own terms. For clause design, see Mass Arbitration: How Thousands of Individual Claims Became a Strategic Problem and Employment Arbitration Agreements After Epic Systems and the EFAA.

Insurance: who pays for a BIPA claim

Because BIPA liability can be large and is rarely tied to physical injury, coverage disputes have been nearly as important as the merits.

Commercial general liability. Klaudia Sekura sued a Schaumburg tanning salon franchise that scanned customers' fingerprints for membership and shared the data with an out-of-state vendor. The salon's CGL insurer, West Bend, denied a defense. In West Bend Mutual Insurance Co. v. Krishna Schaumburg Tan, Inc., 2021 IL 125978, the Illinois Supreme Court held that the policy's "personal and advertising injury" coverage, which reaches "publication of material that violates a person's right of privacy," was triggered: "publication" includes disclosure to a single third party, and BIPA protects a right of privacy. The policy's "violation of statutes" exclusion, which named the TCPA and CAN-SPAM and then referred to other statutes that address the sending of material, did not apply because BIPA regulates the handling of biometric data, not the method of communication.

The catch-all exclusion. Insurers then relied on a broader version of the exclusion that added a catch-all for any statute that "addresses, prohibits, or limits the printing, dissemination, disposal, collecting, recording, sending, transmitting, communicating or distribution of material or information." In Citizens Insurance Co. of America v. Wynndalco Enterprises, LLC, 70 F.4th 987 (7th Cir. 2023), involving a company alleged to have licensed Clearview's database to Illinois customers, the Seventh Circuit held the catch-all ambiguous when read alongside the specific statutes it followed, and resolved the ambiguity for the insured: the insurer owed a defense. In Thermoflex Waukegan, LLC v. Mitsui Sumitomo Insurance USA, Inc., 102 F.4th 438 (7th Cir. 2024), the court held that an umbrella insurer owed a defense of BIPA class claims, subject to exhaustion of the underlying coverage.

The market response. Insurers have since added explicit biometric exclusions to many CGL, employment practices, and cyber forms. A company buying insurance in 2025 should assume that a new policy excludes BIPA claims unless it negotiates otherwise, and should look to older policy years (claims under Tims can reach back five years, and occurrence-based policies respond to the period when the injury occurred) for coverage. For a broader look at coverage, see Business Insurance and Coverage Disputes: CGL, E&O, Cyber, and D&O.

The economics of a BIPA case

BIPA cases settle. Very few have been tried, and the settlement value is driven by a handful of variables that both sides can estimate early.

• Class size and duration. The number of people enrolled within the limitations period is the multiplier. Time-clock vendors' records usually make it precise.
• Culpability. A company that never heard of BIPA is in the negligent tier; a company that knew about BIPA (because its vendor warned it, because a competitor was sued, because its lawyer sent a memo) and did nothing is exposed to the reckless tier. Rogers showed what a jury does with evidence that a sophisticated defendant left compliance to a contractor.
• Defenses that shrink the class. Union members, workers outside Illinois, and persons who signed releases at some point all come out of the class.
• Insurance. A carrier defending under a reservation of rights changes the settlement dynamics, often for the better.
• Fees. Section 20 shifts fees to a prevailing plaintiff, and class counsel's fee is typically a percentage of the common fund in settlement.

Publicly reported employment settlements, before and after the 2024 amendment, have commonly fallen in a range from a few hundred dollars to somewhat over a thousand dollars per class member, with outliers in both directions. Consumer settlements against large platforms have been larger in aggregate but smaller per person. These figures are only reference points; the facts of each case control. For valuation and negotiation technique generally, see Settlement Negotiation Tactics: Principled Negotiation, Anchoring, and Handling Hardball in Litigation.

The laws following Illinois

No other state has enacted a BIPA clone with a private right of action and liquidated damages, though bills have been introduced in many legislatures every year since 2018. What has spread is the idea that biometric data deserves special treatment, enforced mostly by regulators.

Texas. Texas enacted its law in 2009 and for more than a decade did little with it. That changed in 2022, when the attorney general sued Meta over the same Tag Suggestions feature at issue in Patel, and then Google over face and voice features in Google Photos, Nest, and Google Assistant. Meta settled in July 2024 for $1.4 billion, payable over five years; Google settled in May 2025 for $1.375 billion in a deal that also resolved a separate Texas privacy suit. Because CUBI's penalty is up to $25,000 per violation and the attorney general counts violations per Texan, the Texas statute turned out to be as potent as BIPA in the hands of a motivated enforcer.

California. The CCPA does not regulate biometrics through a separate regime, but its definitions do the work. "Biometric information" is listed as personal information in § 1798.140, and the processing of biometric information to uniquely identify a consumer is "sensitive personal information." The private right of action in § 1798.150 is limited to data breaches involving information defined in § 1798.81.5, which includes unique biometric data used to authenticate identity. A breach of a facial-template database can therefore produce a private class action in California, with statutory damages, even though routine processing cannot. For the general structure of these laws, see State Consumer Privacy Laws: The CCPA, the CPRA, and the Multi-State Patchwork.

Colorado. HB 24-1130 added biometric-specific provisions to the Colorado Privacy Act. Among other things, it requires a controller that processes biometric identifiers to adopt a written policy with a retention schedule and deletion triggers, to obtain consent before collection, and to limit employers' use of employee biometrics to specified purposes. Unlike the rest of the Colorado Privacy Act, the biometric provisions apply without regard to the volume thresholds, so a small business that uses fingerprint clocks in Colorado is covered. The Attorney General has rulemaking authority under the Act, so check the current Colorado Privacy Act rules for implementing detail.

Cities. New York City's 2021 ordinance targets retail stores, restaurants, and entertainment venues. It does not require consent; it requires signage at customer entrances and prohibits selling or otherwise profiting from biometric data. Portland, Oregon went further, banning private use of face recognition in places of public accommodation beginning in 2021.

The Federal Trade Commission. There is no federal biometric privacy statute. The FTC uses its authority over unfair and deceptive practices under 15 U.S.C. § 45, and in May 2023 it issued a Policy Statement on Biometric Information and Section 5 of the FTC Act. The statement lists practices the Commission will scrutinize: false or unsubstantiated claims about the accuracy or fairness of a biometric system; failing to assess foreseeable harms before deploying it; failing to address known risks, including bias; surreptitious or unexpected collection; failing to evaluate vendors; failing to train staff; and failing to monitor systems after deployment.

The statement was followed in December 2023 by the FTC's action against Rite Aid. The Commission alleged that from 2012 to 2020 Rite Aid used face-recognition technology in hundreds of stores to identify suspected shoplifters, that the system generated thousands of false matches, that the errors fell disproportionately on women and people of color, and that Rite Aid failed to take reasonable steps to test the system or train employees. The stipulated order barred Rite Aid from using face recognition for surveillance for five years and required it to delete the images and any models or algorithms derived from them. An earlier order against the photo-app company Everalbum (2021) had required deletion of face-recognition models trained on users' photos without consent. These "algorithmic disgorgement" remedies are a direct threat to companies that train AI systems on biometric data. For the governance programs that address these risks, see AI Governance and Compliance: Building a Program for the EU AI Act, State AI Laws, and Everything After.

Splits and open questions

Even after fifteen years of litigation, several basic questions remain unsettled or only recently settled.

Does the amendment reach pending cases? As of this writing the question is before the Seventh Circuit. Plaintiffs argue that the amendment changed the substantive scope of liability that Cothron identified and therefore applies only to claims filed after August 2, 2024. Defendants argue that it changed only the remedy, which Illinois law treats as procedural, and therefore applies to pending cases. Illinois state appellate courts had not resolved the issue. Until a definitive ruling, defendants in pre-amendment cases should brief both outcomes and plaintiffs should develop evidence of culpability that supports the reckless tier, since per-person recovery makes the $5,000 figure the main lever.

What is a "scan of face geometry"? Courts agree that a face template extracted from a photo qualifies (Rivera). They have been less consistent about face detection (finding a face in an image without identifying it), age and emotion estimation, virtual try-on tools that map facial landmarks to fit a product, and liveness checks used in identity verification. Zellmer suggests that data incapable of identifying anyone is outside BIPA; plaintiffs respond that the statute regulates "scans," not identification, and that the identification requirement applies only to "biometric information."

What is a "voiceprint"? A recording of a voice is not, by itself, a voiceprint; a voiceprint is a template used to identify a speaker. Claims against voice assistants, call-center authentication, and AI transcription tools turn on whether the system creates a speaker-identification template or merely converts speech to text.

AI training data. Several suits allege that companies built or trained face-recognition systems on datasets of photos scraped or licensed without consent. The open questions include whether training a model on face images "collects" biometric identifiers when the model never identifies anyone, whether the trained model itself is "biometric information," and whether the Illinois connection is sufficient when the dataset, the training, and the developer are all elsewhere. The FTC's deletion remedies make these questions important even outside Illinois.

How much discretion do courts have over damages? Cothron said damages are discretionary, and Rogers treated the amount as a jury question. How juries should be instructed, what evidence of harm or culpability is admissible to reduce or increase the award, and whether a court can reduce an award as a matter of law remain largely unsettled.

Labor preemption at the margins. Miller, Fernandez, and Walton settle the core rule for unionized employees, but courts continue to divide over claims by employees hired before the union agreed to the technology, claims under section 15(d) that do not depend on the union's consent, and claims against third-party vendors (who are not parties to the collective bargaining agreement).

What this means for each side

For companies using biometrics in Illinois. Compliance is cheap and litigation is not. A public retention policy, a written notice and release signed before enrollment, a release that covers disclosure to vendors, a destruction schedule that is actually followed, and contract terms that make vendors responsible for their own compliance eliminate almost every claim. For a company that is already out of compliance, the five-year look-back means that fixing the problem today does not erase past exposure, but it does stop the class from growing. The step-by-step program is in Biometric Data Compliance Checklist: A Practical Checklist, and the documents themselves (policies, consent forms, vendor addenda) are in Biometric Privacy Toolkit: Retention Policies, Consent Forms, and Vendor Terms.

For companies sued. The first thirty days matter most: decide on removal (and whether the claims as pleaded have Article III standing), tender to every insurer that issued a policy during the class period, preserve the time-clock data and vendor contracts, and identify the threshold defenses (arbitration, labor preemption, the exemptions, extraterritoriality). After the amendment, the realistic exposure is calculable, and early, data-driven settlement discussions are often in the defendant's interest.

For plaintiffs. The amendment cut the value of per-scan theories but left the per-person claim intact. Strong cases now turn on class size, evidence of recklessness (knowledge of BIPA and a failure to act), multiple distinct violations (15(a) retention failures, 15(b) collection, and 15(d) disclosure to distinct recipients), and avoiding removal-and-dismissal traps by pleading the injury carefully. Mass arbitration remains an option against companies with consumer arbitration clauses, but Wallrich means counsel must be able to prove each client's agreement.

For insurers and brokers. Older occurrence policies without biometric exclusions are where coverage lives. New business should be underwritten with explicit questions about biometric practices, and exclusions should be drafted with Wynndalco in mind: a catch-all that follows a list of communication statutes is likely to be read narrowly.

For policymakers. The Illinois experience shows both the power and the cost of a private right of action with liquidated damages. Compliance improved dramatically, and most large employers and platforms in Illinois now obtain consent. But the litigation fell heaviest on small employers who bought off-the-shelf equipment, and the per-scan rule produced numbers detached from any harm. States considering biometric laws have mostly chosen attorney general enforcement (Texas, Washington, Colorado) or comprehensive privacy statutes with opt-in consent, sometimes paired with a cure period.

Worked example: Kessler Bread Company

Return to the bakery in the opening scene, which we will call Kessler Bread Company. The facts: Kessler installed fingerprint time clocks from a vendor, ClockCloud, in March 2016. The clocks stored templates on ClockCloud's servers. Kessler had 140 hourly workers at any one time, with turnover bringing the total number enrolled over the five years before suit to about 310. Nobody signed anything until Kessler's lawyer, after reading about Cothron, rolled out a consent form in May 2023. The class action was filed in Cook County in March 2023 by a former mixer operator, Teresa Okafor.

Limitations. Under Tims, the class reaches back five years from March 2023, to March 2018. Workers who left before March 2018 are out. That trims the class to about 260.

Removal. Kessler is an Illinois citizen. A few class members commute from Indiana, so CAFA's minimal diversity requirement is probably met, but more than two-thirds of the class and the only defendant are Illinois citizens, so the home-state exception in 28 U.S.C. § 1332(d)(4) would require the federal court to decline jurisdiction, and after the amendment the amount in controversy may not exceed $5 million anyway. The case stays in state court. (A national employer with a significant number of out-of-state class members would face a different analysis; see Removing or Remanding a Class Action Under CAFA: A Practical Guide.)

Defenses. Kessler is not unionized, so labor preemption is unavailable. It is not a financial institution, a health care provider, or a government contractor. Its arbitration agreement covers only managers hired after 2021. Workers' compensation exclusivity is foreclosed by McDonald.

Damages before the amendment. Under Cothron, each of the 260 class members scanned roughly 1,000 times a year. Even confining the count to 15(b) collections and the negligent tier, the theoretical number exceeds $1 billion. Nobody expects a court to award that; Cothron itself said a court could award less. But the uncertainty makes the case almost impossible to value.

Damages after the amendment. If the amendment applies, each class member has at most one 15(b) recovery and one 15(d) recovery (for the disclosure to ClockCloud), plus whatever 15(a) claim survives. The theoretical maximum becomes 260 x ($1,000 + $1,000) = $520,000 at the negligent tier, or 260 x ($5,000 + $5,000) = $2.6 million at the reckless tier, plus fees. Okafor's counsel will argue recklessness, pointing to ClockCloud's 2019 email to customers recommending BIPA consent forms, which Kessler's office manager received and filed. Kessler will argue negligence at most, pointing to its prompt remediation in 2023.

Insurance. Kessler's CGL policies for 2018 through 2021 contain the narrow "violation of statutes" exclusion that West Bend held inapplicable; its 2022 and later policies contain an express biometric exclusion. Under West Bend, the earlier carriers owe a defense. Kessler tenders to all of them.

Settlement. With a defense funded, a realistic exposure of $520,000 to $2.6 million plus fees, and the reckless-tier evidence a genuine risk, the parties mediate. A settlement in the range that publicly reported employment cases suggest (several hundred to somewhat over a thousand dollars per class member, plus fees and administration) is the likely outcome, funded largely by the 2018 to 2021 carriers. Kessler also adopts the compliance program it should have adopted in 2016. The litigation response is walked through in detail in Defending or Bringing a Biometric Privacy Claim: A Practical Guide.

Common mistakes

• Treating a template as "not biometric." Vendors often say they store "only a mathematical representation, not a fingerprint." Under section 10, the representation is biometric information.
• Getting consent after enrollment. Section 15(b) requires the release before collection. A consent form handed out a year after the clock went live does not cure the past; it only stops future violations.
• Forgetting disclosure. A release that authorizes collection but not disclosure to the time-clock vendor leaves a 15(d) claim.
• Writing a retention policy and not following it. After Fox, a published policy that the company ignores is evidence of a concrete 15(a) injury.
• Assuming the vendor handles compliance. Rogers shows that a jury may find a company reckless for leaving compliance to a contractor. Contracts should allocate responsibility, but the employer remains liable for its own collection and disclosure.
• Removing a case without thinking about standing. A defendant that removes must establish Article III standing, and claims without it come back to state court. Removing a 15(a) public-disclosure or bare 15(c) claim invites a remand fight and a fee request.
• Missing old insurance. Five-year look-backs and occurrence-based coverage mean that policies purchased years ago may respond. Tender to all of them.
• Ignoring other states. A multistate employer that fixes Illinois may still be collecting biometrics in Texas, Washington, Colorado, or New York City under different rules.

Frequently asked questions

Can I sue under BIPA if nothing bad happened with my fingerprint? Yes. Under Rosenbach, the violation of the statutory notice-and-consent procedure is itself the injury. Whether you can sue in federal court is a separate question that depends on which section was violated and how the claim is pleaded.

Does BIPA apply to my company if we are not based in Illinois? It can. BIPA applies to private entities that collect biometric data in Illinois, and courts look at whether the relevant circumstances occurred primarily and substantially in Illinois. A company scanning workers or customers located in Illinois should assume it is covered.

Is a photograph a biometric identifier? No, photographs are expressly excluded. But a face template or geometric scan extracted from a photograph is a biometric identifier, which is why photo-tagging and face-search services have been sued.

After the 2024 amendment, how much can a plaintiff recover? For repeated collection of the same biometric by the same method, one recovery: $1,000 if negligent or $5,000 if intentional or reckless (or actual damages if greater). A separate recovery may be available for disclosures to each distinct recipient, and for violations of sections 15(a), (c), and (e), plus attorney's fees. Courts have discretion to award less.

Can an employer require employees to use a fingerprint clock? Yes, as long as it gives the written notice and obtains a signed release before collection. BIPA expressly allows a release "executed by an employee as a condition of employment." Other states, including Colorado, impose additional limits on employer use.

Do hospitals have to comply with BIPA? For patient data and for worker data collected for treatment, payment, or operations under HIPAA, generally no, under the section 10 exclusion and Mosby. For timekeeping, building access, and other employment functions, yes.

Is there a federal biometric privacy law? No. The FTC regulates biometric practices under its general authority over unfair and deceptive practices, and some sector laws (such as HIPAA for health data and the Gramm-Leach-Bliley Act for financial institutions) cover biometric data held by regulated entities.

Will my insurance cover a BIPA lawsuit? Possibly, under older CGL policies without a biometric exclusion, as West Bend and Wynndalco illustrate. Newer policies frequently exclude biometric claims. Tender to every carrier that issued a policy during the class period and let coverage counsel sort it out.

Takeaways

1. BIPA's five duties are simple: publish a retention policy, give written notice, get a written release before collection, never profit, and disclose only with consent. Almost every lawsuit traces to skipping one of them.
2. Rosenbach removed the harm requirement in state court; Bryant, Fox, and Thornley determine which claims can be heard in federal court.
3. Tims gives plaintiffs five years; Cothron made each scan a violation; the 2024 amendment limits recovery to once per person, per method, and per recipient.
4. Labor preemption, the HIPAA exclusion as read in Mosby, the Gramm-Leach-Bliley exemption, and the government-contractor exemption can remove large parts of a class; workers' compensation exclusivity cannot.
5. Insurance often exists in older policies, and West Bend and Wynndalco favor policyholders on the standard exclusions.
6. Outside Illinois, Texas has shown that attorney general enforcement can produce billion-dollar results, and California, Colorado, New York City, Portland, and the FTC each add their own layer.
7. The unsettled frontier is AI: face detection, voice analysis, virtual try-on, and training data. Companies building those systems should treat BIPA compliance and data provenance as design requirements, not afterthoughts.

This document is general information, not legal advice for any particular situation. Biometric privacy law is changing quickly; confirm current statutes, regulations, and case law before acting.

Related Documents

Related Articles

• Biometric Data Privacy Laws and Their Impact on AI Development: the policy and AI-development perspective on the same statutes.
• State Consumer Privacy Laws: The CCPA, the CPRA, and the Multi-State Patchwork: how sensitive-data rules in comprehensive state laws reach biometrics.
• Article III Standing After TransUnion: Concrete Injury, Traceability, and the End of No-Injury Claims: the federal standing doctrine behind Bryant, Fox, and Thornley.
• CAFA Jurisdiction and Class Action Removal: Amount in Controversy, Exceptions, and Mass Actions: the removal statute most BIPA defendants invoke.
• Mass Arbitration: How Thousands of Individual Claims Became a Strategic Problem: the arbitration strategy behind Wallrich.
• Trade Secrets and Generative AI: Reasonable Measures, Prompt Leakage, and Vendor Terms: vendor terms and data controls for AI systems that may touch biometric data.
• Settlement Negotiation Tactics: Principled Negotiation, Anchoring, and Handling Hardball in Litigation: valuing and negotiating a class settlement.

Related Guides

• Defending or Bringing a Biometric Privacy Claim: A Practical Guide: the step-by-step litigation companion to this article, for both sides.
• Removing or Remanding a Class Action Under CAFA: A Practical Guide: mechanics of removal and remand.
• Employee Monitoring and Workplace Privacy: A Practical Guide: biometric time clocks in the context of other workplace monitoring.

Related Checklists

• Biometric Data Compliance Checklist: A Practical Checklist: the compliance program that prevents these claims.
• CAFA Removal and Remand Checklist: A Practical Checklist: deadlines and evidence for a removal decision.
• Litigation Hold and Evidence Preservation Checklist: A Practical Checklist: preserving time-clock and vendor data once a claim arrives.

Related Toolkits

• Biometric Privacy Toolkit: Retention Policies, Consent Forms, and Vendor Terms: the policies, releases, and vendor addenda referred to throughout.
• AI Licensing Toolkit: Data Provenance Records, License Terms, and Indemnity Clauses: provenance and indemnity terms for datasets that may contain biometric data.
• Class Action Defense Toolkit: From Complaint Through Settlement Approval: templates for the class action itself.
• Insurance Coverage Toolkit: Placing, Tendering, and Litigating Claims: tender letters and coverage analysis.