Biometric Privacy Toolkit: Retention Policies, Consent Forms, and Vendor Terms

Summary. This toolkit provides working templates for a biometric privacy program and for the first weeks of a biometric privacy claim, each with its purpose, owner, timing, bracketed placeholders, and drafting commentary tied to the governing authority. The compliance templates are a biometric data inventory worksheet, a public retention and destruction policy, an employee notice and written release, a consumer notice and consent for app and in-store flows, a vendor biometric addendum, and a destruction certificate. The litigation templates are a biometric-specific litigation hold notice that addresses the conflict between preservation and BIPA's destruction duty, an insurance tender letter, and a litigation response memo outline that tracks removal, arbitration, exemptions, damages after the 2024 amendment and the Seventh Circuit's 2026 decision in Clay v. Union Pacific, and settlement. A running example follows a regional optical retailer with fingerprint time clocks and a virtual try-on feature through each template. The templates assume Illinois law as the baseline and flag additions for Texas, Colorado, California, and New York City.

Biometric privacy compliance is mostly paperwork, and the paperwork has to exist before the first scan. The Illinois Biometric Information Privacy Act (740 ILCS 14) requires a public written retention and destruction policy, written notice of collection, purpose, and term, and a written release, all before collection; it forbids profiting from biometric data and disclosing it without consent; and it requires reasonable security. Each missing document is a separate claim, and the five-year limitations period recognized in Tims v. Black Horse Carriers, Inc., 2023 IL 127801 means that missing documents stay expensive for a long time.

These templates are the documents the Biometric Data Compliance Checklist: A Practical Checklist calls for, plus the first litigation documents described in Defending or Bringing a Biometric Privacy Claim: A Practical Guide. The case law behind them is explained in Biometric Privacy Litigation: BIPA, Rosenbach, Cothron, the 2024 Amendment, and the Laws Following Illinois.

Template index

The running example: Lakeshore Optical Group

Lakeshore Optical Group operates 38 eyewear stores: 22 in Illinois, 10 in Colorado, and 6 in Texas. Since 2019 its store employees have clocked in on fingerprint time clocks supplied and hosted by a vendor called PunchPoint. In 2025 Lakeshore launched a "Try On" feature in its app, built on a vendor called FaceFit, that maps a customer's facial landmarks to show frames in the right size. Lakeshore sells both prescription and nonprescription eyewear. In early 2026 Lakeshore's general counsel decided to put a full biometric program in place after reading about a competitor's lawsuit, and in mid-2026 Lakeshore received a class action complaint from a former Illinois store employee. Each template below shows how Lakeshore used it.

Template 1: Biometric data inventory worksheet

Purpose: Identify every system that creates, stores, or shares biometric data, and capture the facts every later decision depends on. Owner: Privacy lead, with input from IT, HR, facilities, security, product, and procurement. When to use: At program launch, at least annually, and before any new system with a camera, microphone, or biometric sensor is approved.

Drafting commentary.

• Templates are biometric data. BIPA covers "biometric information," meaning any information based on a biometric identifier and used to identify a person, regardless of how it is converted or stored. Record templates and hashes as biometric data.
• On-device versus server. Record precisely where templates live. If they are created and kept only on the user's device and the company never receives them, the company may not "possess" them; see Barnett v. Apple Inc., 225 N.E.3d 602 (Ill. App. Ct. 2022).
• Detection versus identification. Note whether the system identifies people or only detects or measures features. The distinction matters under Zellmer v. Meta Platforms, Inc., 104 F.4th 1117 (9th Cir. 2024), but face templates extracted from photos are covered, as in Rivera v. Google Inc., 238 F. Supp. 3d 1088 (N.D. Ill. 2017).
• Exemptions must be specific. The exemptions are narrower than they look: the government contractor exemption applies only to conduct within the scope of the government contract (Thomas v. Cornerstone Services, Inc., 2026 IL App (3d) 240568; Payton v. Union Pacific Railroad Co., No. 26-1946 (7th Cir. Sept. 30, 2026)), and the health care exclusion does not reach workforce timekeeping (Townsend v. Estates of Hyde Park, 2026 IL App (1st) 250096).

Lakeshore. The worksheet lists the PunchPoint clocks (fingerprint templates on PunchPoint's cloud; about 1,100 Illinois employees enrolled since 2019; no notice or release before 2026) and FaceFit Try On (facial landmark geometry processed on FaceFit's servers for each session; FaceFit's documentation says session data is deleted after 24 hours but "aggregated geometry" is retained to improve the model). It also turns up a third system nobody mentioned: security cameras in four Chicago stores with a dormant face-matching feature. The privacy lead marks that feature "disable pending review."

Template 2: Public biometric retention and destruction policy

Purpose: Satisfy BIPA section 15(a) and the comparable Texas and Colorado requirements with a written policy available to the public. Owner: Legal drafts; web team posts; IT and vendors implement. When to use: Before first collection. Post on the public website and link it from the privacy notice, consent forms, and employee handbook.

[COMPANY NAME] BIOMETRIC DATA RETENTION AND DESTRUCTION POLICY
Effective date: [DATE]    Version: [NUMBER]

1. Scope. This policy applies to biometric identifiers and biometric
   information ("biometric data") that [COMPANY NAME] and its affiliates
   ("we") collect, capture, receive, store, or use, including fingerprint,
   hand geometry, face geometry, iris, and voiceprint data, and any template
   or other information derived from them that is used to identify a person.

2. Purposes. We collect and use biometric data only for these purposes:
   (a) [Employee timekeeping and payroll verification];
   (b) [Customer virtual try-on and frame sizing];
   (c) [OTHER SPECIFIC PURPOSE].
   We do not use biometric data for any other purpose without new notice
   and consent.

3. No sale or profit. We do not sell, lease, trade, or otherwise profit
   from biometric data.

4. Disclosure. We disclose biometric data only (a) to service providers
   that process it on our behalf for the purposes above under written
   contracts that require them to protect it and destroy it in accordance
   with this policy, currently [VENDOR NAMES OR CATEGORIES]; (b) with the
   individual's consent; (c) to complete a financial transaction the
   individual requested or authorized; or (d) as required by law, valid
   warrant, or subpoena.

5. Retention and destruction. We permanently destroy an individual's
   biometric data at the earliest of:
   (a) when the initial purpose for collecting it has been satisfied, as
       follows:
       - employees and temporary workers: within [30] days after the
         individual's employment or assignment ends;
       - customers using [FEATURE]: [at the end of each session / within
         [X] days after the individual deletes the feature or closes the
         account];
   (b) [one year] after the purpose expires, for individuals in Texas;
   (c) [COLORADO-SPECIFIC DEADLINE], for individuals in Colorado; and
   (d) three years after the individual's last interaction with us.
   Destruction includes copies held by our service providers.

6. Legal holds. If we are required to preserve biometric data by a valid
   warrant, subpoena, or court order, we will retain it only as required
   and destroy it when the requirement ends.

7. Security. We store, transmit, and protect biometric data using the
   reasonable standard of care in our industry and in a manner at least as
   protective as the manner in which we protect our other confidential and
   sensitive information.

8. Questions. Contact [PRIVACY CONTACT, EMAIL, ADDRESS].

Drafting commentary.

• The deadline is "whichever occurs first." BIPA requires destruction when the initial purpose is satisfied or within three years of the last interaction, whichever comes first. Defining the purpose-satisfied trigger concretely (for example, 30 days after separation) is what makes the policy enforceable. Do not write "three years after last interaction" as the only rule.
• Public means public. An intranet posting is not "available to the public." Post on the website. A claim that the policy did not exist may lack Article III standing as pleaded in Bryant v. Compass Group USA, Inc., 958 F.3d 617 (7th Cir. 2020), but state court has no such limit, and a claim that the company kept data past the deadline has standing under Fox v. Dakkota Integrated Systems, LLC, 980 F.3d 1146 (7th Cir. 2020).
• Legal holds. Section 15(a) excepts only a "valid warrant or subpoena." Section 6 of the template refers to court orders as well; where litigation requires retention, obtain an order or stipulation (see Template 7).
• Texas and Colorado. Texas generally requires destruction within a year after the purpose expires (Tex. Bus. & Com. Code § 503.001). Colorado's 2024 amendment to the Colorado Privacy Act (HB 24-1130, effective July 1, 2025) adds its own retention-schedule and deletion requirements; take the deadlines for section 5(c) from the current statute and any Attorney General rules.
• California. If California consumers are covered, cross-reference the sensitive personal information disclosures and the right to limit under Cal. Civ. Code § 1798.121 in the privacy policy. See Privacy Notice Toolkit: Policy Templates, Consent Flows, and Change Management Records.

Lakeshore. Lakeshore sets the employee trigger at 30 days after separation and the Try On trigger at the end of each session, and requires FaceFit to stop retaining "aggregated geometry." It posts the policy on its website footer and in the app's privacy screen, and keeps a dated screenshot.

Template 3: Employee biometric notice and written release

Purpose: Give the section 15(b) written notice and obtain the written release before enrollment, including consent to disclosure to the timekeeping vendor under section 15(d). Owner: HR. When to use: At onboarding, before enrollment; for existing employees, before any further scanning; again whenever the purpose, vendor, or retention period changes.

NOTICE AND CONSENT: BIOMETRIC TIMEKEEPING

[COMPANY NAME] uses [fingerprint / hand-geometry / face] scanning on its
time clocks at [LOCATIONS]. When you enroll, the clock scans your
[finger / hand / face] and creates a mathematical template from it. The
template is used to confirm your identity when you clock in and out.

What we collect: a template derived from a scan of your [BIOMETRIC TYPE]
("biometric data").

Why: to verify your identity for timekeeping and payroll [and building
access]. We do not use it for any other purpose.

How long: we keep your biometric data while you are employed and destroy
it within [30] days after your employment ends, and in any event within
three years after your last interaction with us, as described in our
Biometric Data Retention and Destruction Policy at [URL].

Who receives it: our timekeeping provider, [VENDOR], which stores and
processes the data for us under a contract that prohibits any other use.
We do not sell or profit from your biometric data.

[ALTERNATIVE, IF OFFERED: If you do not wish to use the biometric clock,
you may use [badge / PIN]. Tell [CONTACT].]

RELEASE
I have read this notice. I consent to [COMPANY NAME]'s collection,
storage, and use of my biometric data for the purposes described above,
and to its disclosure to [VENDOR] for those purposes. [I understand that
this consent is a condition of my employment.] [I understand that I may
use the alternative described above instead.]

Name: [EMPLOYEE NAME]    Employee ID: [ID]
Signature (handwritten or electronic): [SIGNATURE]
Date and time signed: [TIMESTAMP]
Work location: [LOCATION]

Drafting commentary.

• Three disclosures and a release. Section 15(b) requires informing the subject in writing (1) that biometric data is being collected or stored and (2) of the specific purpose and length of term, and (3) receiving a written release. The template covers each in plain words.
• Condition of employment. BIPA defines a written release in the employment context to include a release executed as a condition of employment, so the employer may require enrollment. Colorado's amendment restricts requiring employee biometric consent as a condition of employment except for specified purposes such as timekeeping and security; check before using the bracketed condition sentence in Colorado.
• Electronic signatures. Public Act 103-0769 (2024) confirmed that an electronic signature satisfies the written-release requirement; the general federal rule on electronic signatures is 15 U.S.C. § 7001. Keep the timestamp and audit trail.
• Disclosure. Include the vendor. A release that covers only collection leaves a section 15(d) claim for disclosure to the vendor.
• Timing. A release signed after the first scan does not cure earlier violations. Under Cothron v. White Castle System, Inc., 2023 IL 128004, each scan was a separate violation; the 2024 amendment limits recovery to one per person per method, and Clay v. Union Pacific Railroad Co., 171 F.4th 975 (7th Cir. 2026) applies that limit to pending cases in federal court, but accrual still runs per scan.
• Unions. For bargaining-unit employees, give the union notice and document its position; that record supports labor preemption under Fernandez v. Kerry, Inc., 14 F.4th 644 (7th Cir. 2021) and Walton v. Roosevelt University, 2023 IL 128338.

Lakeshore. Lakeshore loads the form into its HR portal, blocks enrollment on the clocks until the portal records a signature, and requires every current Illinois employee to sign before their next shift. It translates the form into Spanish and Polish.

Template 4: Consumer biometric notice and consent

Purpose: Obtain informed written consent from customers before capturing biometric data in an app, website, kiosk, or store. Owner: Product and legal. When to use: On the screen immediately before first capture, and again on material change. For walk-in in-store systems in New York City, also post signage.

[SCREEN TITLE: Before you use [FEATURE NAME]]

[FEATURE NAME] uses your device's camera to [scan your face / read your
fingerprint / analyze your voice] and create a [map of your facial
geometry / template] so that [PURPOSE, e.g., we can show how frames will
fit your face].

- What we collect: [facial geometry measurements derived from your camera
  image] ("biometric data").
- Why: only to [PURPOSE]. We do not use it to identify you for any other
  purpose, for advertising, or to train [our / our vendors'] models.
- How long: we delete it [at the end of your session / within [X] days].
  See our Biometric Data Policy: [LINK].
- Who processes it: our service provider [VENDOR], under a contract that
  prohibits any other use. We do not sell it.
- Your choice: you can [use the size guide / visit a store] instead.

[ ] I have read this notice and I consent to [COMPANY NAME] and [VENDOR]
    collecting and using my biometric data as described.
    [Unchecked box; the "Continue" button stays disabled until checked.]

[If the user is under 18: "A parent or guardian must provide consent."
Route to the parental consent flow.]

[Record: user ID, notice version, timestamp, IP/device ID, action taken.]

Drafting commentary.

• Separate, specific, affirmative. A general terms-of-use checkbox is a weak basis for "informed written consent." Use a dedicated notice and an unchecked box (or typed name) that the user must actively select, and store a record of the version shown. Consent flows of this kind are discussed in Privacy Policies, Notices, and Consent: Drafting Disclosures That Are True and Survive the FTC.
• Minors. The leading BIPA case, Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186, involved a 14-year-old. Route minors to a parent or guardian.
• Virtual try-on and the health care exclusion. Do not rely on the HIPAA exclusion for try-on features. Illinois courts have held that a shopper trying on nonprescription glasses is not a "patient in a health care setting" (Marino v. Gunnar Optiks LLC, 2024 IL App (1st) 231826), and the Seventh Circuit refused to dismiss on the HIPAA clause where the complaint did not show the service was health care or that the defendant complied with HIPAA (Clements v. Gunnar Optiks, LLC, No. 25-1890 (7th Cir. July 10, 2026)).
• The FTC. Truthful notice matters beyond BIPA. Saying data is deleted when it is retained, or that it is not used for training when it is, is a deceptive practice under 15 U.S.C. § 45.
• California. Processing biometric data to identify a consumer is sensitive personal information under Cal. Civ. Code § 1798.140. Use of sensitive personal information beyond what is necessary to provide the requested service triggers the right to limit.
• New York City. Retail, food, and entertainment establishments must post a clear sign at customer entrances when they collect biometric identifier information. Sample sign: "Biometric identifier information collected at this location. [COMPANY] collects [face geometry] for [PURPOSE]. Details: [URL]."

Lakeshore. Lakeshore adds the notice screen before the camera opens in Try On, offers the printable size guide as an alternative, and requires FaceFit to confirm in writing that no Try On data is retained or used for training.

Template 5: Vendor biometric addendum

Purpose: Flow down BIPA and other biometric obligations to any vendor that receives, stores, or processes biometric data, and allocate responsibility and risk. Owner: Procurement and legal. When to use: Before the vendor receives any biometric data; at renewal of existing contracts; when a vendor adds a biometric feature.

BIOMETRIC DATA ADDENDUM

This Addendum supplements the [AGREEMENT NAME] dated [DATE] between
[CUSTOMER] ("Customer") and [VENDOR] ("Vendor").

1. Definitions. "Biometric Data" means biometric identifiers and biometric
   information as defined in 740 ILCS 14/10 and any similar term under
   other applicable law, including templates and other derived data.

2. Processing. Vendor shall process Biometric Data only on Customer's
   documented instructions and only to provide [SERVICES]. Vendor shall
   not use Biometric Data for its own purposes, including product
   improvement, analytics, or training or testing of any model.

3. No sale or profit. Vendor shall not sell, lease, trade, license, or
   otherwise profit from Biometric Data.

4. Disclosure. Vendor shall not disclose Biometric Data to any third party
   except (a) approved subprocessors listed in Schedule [X], bound by
   written terms at least as protective as this Addendum, or (b) as
   required by law, warrant, or subpoena, after prompt notice to Customer
   where legally permitted.

5. Consent responsibilities. [Customer / Vendor] shall present the notice
   and obtain the written release required by applicable law before any
   collection through [the Customer's enrollment process / Vendor's
   interface]. Vendor's systems shall not permit enrollment of an
   individual until [Customer's system confirms a recorded release].

6. Retention and destruction. Vendor shall (a) implement the retention
   schedule in Customer's Biometric Data Retention and Destruction Policy;
   (b) permanently destroy Biometric Data of an individual within [10]
   days after Customer's instruction; (c) destroy all Biometric Data
   within [30] days after termination; and (d) deliver a certificate of
   destruction in the form of Schedule [Y] [quarterly and] on completion.
   Vendor shall not retain Biometric Data in backups beyond [PERIOD].

7. Legal holds. If Customer instructs Vendor to preserve Biometric Data
   for litigation, Vendor shall preserve it as instructed and shall not
   destroy it until Customer confirms in writing that the hold has been
   released.

8. Security. Vendor shall store, transmit, and protect Biometric Data
   using the reasonable standard of care in Vendor's industry and at least
   as protectively as Vendor protects its other confidential and sensitive
   information, including encryption in transit and at rest and role-based
   access controls.

9. Incidents and claims. Vendor shall notify Customer within [48] hours
   after discovering any unauthorized access to Biometric Data, and within
   [5] business days after receiving any demand, complaint, subpoena, or
   regulatory inquiry concerning Biometric Data.

10. Representations. Vendor represents that its systems, as configured for
    Customer, [store templates only in [REGION] / do not transmit templates
    off the device], and that its documentation describing its biometric
    processing is accurate.

11. Indemnity. Each party shall indemnify the other against third-party
    claims to the extent arising from its breach of this Addendum,
    including, for Vendor, any use or disclosure of Biometric Data not
    authorized by Customer, and, for the party responsible under Section 5,
    any failure to provide notice or obtain releases. [Cap: NOT SUBJECT TO /
    SUBJECT TO $[AMOUNT]].

12. Insurance. Vendor shall maintain [cyber / technology E&O] insurance of
    at least $[AMOUNT] that does not exclude claims under biometric privacy
    laws, and shall provide certificates on request.

13. Audit. Vendor shall provide [annual third-party assessment reports]
    and respond to reasonable written questionnaires.

14. Order of precedence. This Addendum controls over any conflicting term
    of the Agreement.

Drafting commentary.

• Profit and training. Section 15(c) prohibits profiting from biometric data. A vendor clause permitting use of customer data to "improve services" or train models is a direct conflict. Section 2 closes it.
• Possession and collection. A vendor that hosts templates possesses them and has its own section 15(a) duties; a vendor whose system collects data may face section 15(b) claims, while a hardware seller that takes no active step may not, as in Heard v. Becton, Dickinson & Co., 440 F. Supp. 3d 960 (N.D. Ill. 2020). Section 5 allocates who obtains consent, which should drive the indemnity in Section 11.
• Financial-services vendors. An identity-authentication vendor serving financial institutions may itself fall within the Gramm-Leach-Bliley "financial institution" definition incorporated by BIPA (see 15 U.S.C. § 6809 and McGoveran v. Amazon Web Services, Inc., No. 24-3215 (3d Cir. May 12, 2026)). That may protect the vendor from BIPA but not the non-financial customer using the same service; keep the consent obligations in place.
• Insurance. Many vendors carry policies with biometric exclusions. Section 12 asks for coverage without one; expect negotiation.
• For general vendor diligence, see Building a Vendor and Third-Party Risk Management Program; for AI vendors, AI Confidentiality Toolkit: Acceptable Use Policies, Vendor Term Reviews, and Incident Playbooks.

Lakeshore. PunchPoint's standard indemnity excluded "customer's failure to obtain end-user consents." Because Lakeshore now runs the consent process (Section 5 assigns it to Customer), Lakeshore accepts that exclusion for consent failures but obtains indemnity for PunchPoint's unauthorized retention and use. FaceFit agrees to Section 2 only after Lakeshore pays a modest fee increase to compensate for losing training data.

Template 6: Biometric destruction certificate and log

Purpose: Prove that biometric data was destroyed on schedule. Owner: IT (internal systems); vendor (hosted systems). When to use: Each scheduled destruction run; on individual deletion requests; at contract termination.

CERTIFICATE OF DESTRUCTION OF BIOMETRIC DATA

Certifying entity: [COMPANY / VENDOR]    System: [SYSTEM NAME]
Period covered: [DATE] to [DATE]
Population: [e.g., employees separated between DATE and DATE]
Number of individuals whose Biometric Data was destroyed: [NUMBER]
Locations of data destroyed: [production / backups / test / devices]
Method: [cryptographic erasure / secure deletion standard / device wipe]
Exceptions (data retained under legal hold, with matter reference and
authority): [NONE / DESCRIBE]
Date completed: [DATE]

I certify that the information above is accurate.
Name/title: [NAME, TITLE]    Signature: [SIGNATURE]    Date: [DATE]

Drafting commentary. A published policy that is not followed supports a concrete retention injury under Fox. The certificate and log are the evidence that the schedule was followed. Keep them with the policy versions for at least the limitations period (five years under Tims and 735 ILCS 5/13-205). Record exceptions for legal holds explicitly, with the authority (order, subpoena, or stipulation) for each.

Lakeshore. PunchPoint's first certificate, delivered in March 2026, shows destruction of templates for 640 former Illinois employees, some of whom left in 2019. That certificate later becomes an exhibit in the litigation, both as proof of remediation and as evidence of how long data had been kept.

Template 7: Biometric litigation hold notice and preservation stipulation

Purpose: Preserve the evidence a biometric claim will turn on, while managing the conflict between a litigation hold and BIPA's destruction duty. Owner: Litigation counsel; distributed to HR, IT, facilities, security, product, and the vendor. When to use: As soon as litigation is reasonably anticipated: on receipt of a demand letter, complaint, regulatory inquiry, or credible threat.

PRIVILEGED AND CONFIDENTIAL: LEGAL HOLD NOTICE
Matter: [CAPTION OR "Potential biometric privacy claim"]
Date: [DATE]    From: [COUNSEL]    To: [RECIPIENTS]

[COMPANY] has received [a complaint / demand] alleging that it collected,
retained, or disclosed biometric data without the notice and consent
required by law. You must preserve the materials below until counsel tells
you in writing that this hold is released. This hold overrides normal
deletion schedules, EXCEPT as described in paragraph 3.

1. Preserve:
   (a) documents describing each biometric system at [LOCATIONS]: vendor
       specifications, configuration settings, implementation records;
   (b) contracts, addenda, and communications with [VENDORS] concerning
       biometric data, consent, retention, or legal compliance;
   (c) every version of any biometric notice, consent form, release, and
       retention policy, with dates of use and posting;
   (d) signed releases and consent records with timestamps;
   (e) enrollment records, scan and punch logs, and access logs showing
       who was enrolled and when they scanned;
   (f) records of destruction of biometric data, including certificates;
   (g) HR records showing each worker's dates of employment, work
       location, union status, and arbitration agreement;
   (h) communications discussing biometric privacy laws or compliance;
   (i) insurance policies in effect from [DATE] to present.

2. Do not alter or disable any biometric system, change its retention
   settings, or delete any of the materials above without written approval
   from counsel.

3. Biometric templates themselves. Illinois law requires destruction of
   biometric data on a schedule. Counsel will seek an agreement or court
   order addressing whether templates are retained or destroyed during the
   litigation. Until then, [preserve templates as they exist / continue
   destruction under the policy, AFTER IT exports the metadata in 1(e) and
   (f)], as counsel directs. Do not make that decision yourself.

4. Questions: [COUNSEL CONTACT]. Confirm receipt by [DATE].

STIPULATION REGARDING BIOMETRIC DATA (excerpt for proposed order)

The parties stipulate, and the Court orders, as follows:
1. Within [14] days, Defendant shall cause [VENDOR] to export and preserve
   the following metadata for all individuals enrolled in [SYSTEM] in
   Illinois from [DATE] to present: name or unique identifier, enrollment
   date, date of last scan, location, and whether a template currently
   exists, together with a sworn certification of the export.
2. After the export and certification, Defendant [and VENDOR] may destroy
   biometric templates in accordance with Defendant's retention policy
   [or: shall retain biometric templates of the following individuals
   pending further order: ___], and such destruction or retention pursuant
   to this Order shall not be asserted by any party as a violation of
   740 ILCS 14/15(a) or as spoliation.
3. Biometric data and enrollment lists produced in discovery are
   designated HIGHLY CONFIDENTIAL under the Protective Order.

Drafting commentary.

• Duty to preserve. The duty arises when litigation is reasonably anticipated; failure to take reasonable steps to preserve electronically stored information can lead to sanctions under Fed. R. Civ. P. 37(e). See Zubulake v. UBS Warburg LLC, 217 F.R.D. 309 (S.D.N.Y. 2003) and, for the general framework, Litigation Holds, Spoliation, and Rule 37(e): Preserving Electronic Evidence Before It Costs You the Case.
• The conflict. Section 15(a) excepts only a valid warrant or subpoena from the destruction schedule. A court-ordered stipulation resolves the conflict in both directions: it authorizes destruction after metadata is preserved, or authorizes retention under order. The metadata, not the templates, is almost always the evidence that matters.
• Protective order. Seek a protective order under Fed. R. Civ. P. 26(c) and an order under Fed. R. Evid. 502(d) so that producing compliance documents does not waive privilege over legal advice.
• Vendor. Send the vendor a separate preservation letter citing the addendum's legal-hold clause (Template 5, Section 7).

Lakeshore. On receipt of the complaint, Lakeshore's counsel sends the hold and a vendor letter the same day, pauses PunchPoint's automated deletion, and within two weeks negotiates the stipulation with plaintiff's counsel, which the court enters. Deletion resumes after the export.

Template 8: Insurance tender letter

Purpose: Give prompt notice of a biometric claim to every potentially responsive insurer and request a defense. Owner: Risk manager, with coverage counsel. When to use: Within the notice period of each policy; as a rule, within days of receiving a demand or complaint.

[DATE]
VIA EMAIL AND CERTIFIED MAIL
[INSURER] Claims Department
[ADDRESS / CLAIMS EMAIL]

Re: Notice of Claim and Tender of Defense
    Insured: [COMPANY]    Policy No(s).: [NUMBERS]    Policy periods: [DATES]
    Matter: [CAPTION], No. [NUMBER], [COURT]

[COMPANY] gives notice of, and tenders the defense of, the enclosed
[complaint / demand], which alleges that [COMPANY] collected, retained,
and disclosed individuals' biometric data in violation of the Illinois
Biometric Information Privacy Act, 740 ILCS 14, during a period beginning
[DATE]. The complaint alleges, among other things, that [COMPANY]
disclosed biometric data to a third-party vendor.

[COMPANY] requests that [INSURER] acknowledge this tender and confirm that
it will defend [COMPANY] under the [personal and advertising injury /
employment practices / privacy liability] coverage of the above policies.
Please direct all communications to [CONTACT]. [COMPANY] reserves all
rights under the policies and applicable law, and nothing in this letter
waives any right or is an admission of liability.

Enclosures: [complaint / demand]; [policy schedule]
[NAME, TITLE]

Drafting commentary.

• Tender to every policy year. With a five-year look-back and allegations of conduct over years, occurrence-based policies from several years may respond. Tender to each, plus umbrella and excess carriers.
• Coverage authority. Under West Bend Mutual Insurance Co. v. Krishna Schaumburg Tan, Inc., 2021 IL 125978, disclosure of biometric data to a vendor can be a "publication" of material violating a right of privacy, triggering CGL personal and advertising injury coverage. Under Citizens Insurance Co. of America v. Wynndalco Enterprises, LLC, 70 F.4th 987 (7th Cir. 2023), a broad catch-all exclusion was ambiguous and did not defeat the duty to defend; and under Thermoflex Waukegan, LLC v. Mitsui Sumitomo Insurance USA, Inc., 102 F.4th 438 (7th Cir. 2024), an umbrella insurer owed a defense once underlying coverage was exhausted. Highlight the disclosure allegations, which connect the claim to "publication."
• Do not characterize the facts. Describe the allegations, not the company's view of them, and avoid statements that could support an intentional-acts exclusion.
• For more tender forms, see Insurance Coverage Toolkit: Placing, Tendering, and Litigating Claims.

Lakeshore. Lakeshore tenders to its 2020 to 2022 CGL carrier (no biometric exclusion), its 2023 to 2026 carriers (biometric exclusion), its umbrella carrier, and its EPL carrier. The 2020 to 2022 carrier defends under a reservation of rights.

Template 9: Litigation response memo outline

Purpose: Organize the first 30 days of a biometric claim so that the decisions that cannot be revisited (removal, arbitration, preservation, insurance notice) are made deliberately. Owner: Defense counsel, for the general counsel and insurers. When to use: Within the first two weeks after service; update at 30 days.

PRIVILEGED AND CONFIDENTIAL: ATTORNEY WORK PRODUCT
BIOMETRIC CLAIM RESPONSE MEMORANDUM
Matter: [CAPTION]    Served: [DATE]    Removal deadline: [DATE + 30]

I. Summary and recommendations (one page)
   - Exposure range (negligent / reckless), likely forum, key defenses,
     recommended next steps and decisions needed by [DATE].

II. Facts
   A. Systems at issue (from Template 1): device, vendor, data flow, dates.
   B. Notices, releases, and policies: versions and dates (Templates 2-4).
   C. Population: enrolled persons in Illinois within 5 years of filing;
      breakdown by union status, arbitration agreement, release date,
      location.
   D. Knowledge evidence: vendor bulletins, prior internal discussion,
      industry suits (bearing on negligent vs. reckless).

III. Claims mapped to 740 ILCS 14/15(a)-(e)
   - For each count: elements, evidence, weaknesses.

IV. Limitations and accrual
   - 5-year period (Tims); per-scan accrual (Cothron); class period.

V. Forum
   A. CAFA removal: class size, minimal diversity, amount in controversy
      computed per person after the 2024 amendment and Clay; exceptions
      (home-state, local controversy); citizenship (nerve center).
   B. Article III standing by claim (Bryant, Fox, Thornley); risk of
      partial remand and fees under 28 U.S.C. 1447(c).
   C. Recommendation.

VI. Arbitration
   A. Agreements by population; coverage of pre-agreement claims;
      delegation clause; vendor's ability to invoke.
   B. Waiver risk (Morgan v. Sundance): sequencing.
   C. Mass arbitration cost model; provider rules on fees.

VII. Threshold defenses
   A. Labor preemption (RLA / LMRA 301; Miller, Fernandez, Walton).
   B. Health care exclusion (Mosby; limits per Townsend, Marino, Clements).
   C. Financial institution exemption (GLBA; McGoveran).
   D. Government contractor exemption (Thomas; Payton).
   E. Extraterritoriality (Avery); possession/collection (Barnett, Heard);
      definitional (Zellmer, Rivera).
   F. Defenses not to pursue (workers' compensation: McDonald).

VIII. Damages model
   - Persons x distinct methods (15(b)) and recipients (15(d)) x
     $1,000 / $5,000; 15(a) claims; discretion (Cothron, Rogers); fees.
   - Retroactivity: Clay (binding in federal courts in the Seventh
     Circuit); status in Illinois state courts.

IX. Insurance and indemnity
   - Policies tendered (Template 8); carrier responses; vendor indemnity
     (Template 5, Section 11).

X. Preservation (Template 7) and remediation
   - Hold issued; stipulation status; ongoing collection stopped or
     remediated (new releases, policy posted).

XI. Resolution strategy
   - Early mediation vs. motion practice; settlement structure; allocation
     and subclass representation (Clearview appeal, 7th Cir. 2026);
     CAFA notice (28 U.S.C. 1715).

XII. Budget and timeline

Drafting commentary.

• Removal math. The amount in controversy under 28 U.S.C. § 1332(d) is now computed per person after the 2024 amendment. In Clay v. Union Pacific Railroad Co., the Seventh Circuit held that the amendment applies to pending cases and noted that district courts might need to revisit jurisdiction on remand. A notice of removal need only plausibly allege the amount, under Dart Cherokee Basin Operating Co. v. Owens, 574 U.S. 81 (2014), but the math should be defensible. Templates for the notice itself are in CAFA Toolkit: Notices of Removal, Jurisdictional Evidence, and Exception Briefing.
• Standing. Map each claim: section 15(b) claims have standing under Bryant; some 15(a) and bare 15(c) claims do not, under Thornley v. Clearview AI, Inc., 984 F.3d 1241 (7th Cir. 2021); claims without standing are remanded, see 28 U.S.C. § 1447(c).
• Arbitration sequencing. Move to compel before litigating the merits to avoid waiver under Morgan v. Sundance, Inc., 596 U.S. 411 (2022). Model mass-arbitration costs in light of Wallrich v. Samsung Electronics America, Inc., 106 F.4th 609 (7th Cir. 2024). See Mass Arbitration Toolkit: Clause Architecture, Batching Protocols, and Response Plans.
• Labor preemption. Cite the Railway Labor Act (45 U.S.C. § 151) or section 301 (29 U.S.C. § 185) as applicable, with Miller v. Southwest Airlines Co., 926 F.3d 898 (7th Cir. 2019).
• Settlement. The Seventh Circuit's July 2026 decision vacating approval of the Clearview settlement (In re Clearview AI, Inc. Consumer Privacy Litigation, No. 25-1673 (7th Cir. July 13, 2026)) requires attention to how benefits are allocated among subclasses and who represents each group. Release and approval mechanics are covered in Class Action Defense Toolkit: From Complaint Through Settlement Approval and valuation in Settlement Negotiation Toolkit: Case Valuation Worksheets, Concession Plans, and Offer Letters.

Lakeshore. The memo shows about 1,100 Illinois store employees enrolled since 2019, of whom about 820 fall within five years of filing; none are unionized; arbitration agreements cover 300 hired since 2023. Lakeshore is a Michigan corporation headquartered in Detroit, so the home-state exception does not apply. Per-person exposure after Clay for the remaining 520 is about $1.04 million at the negligent tier for 15(b) and 15(d) combined, or $5.2 million at the reckless tier, plus 15(a) claims and fees. The memo recommends removal (the reckless-tier figure plus fees plausibly exceeds $5 million), an early motion to compel arbitration for the 300, and mediation after the arbitration ruling. It also flags that the Try On feature created consumer exposure for the period before the 2026 consent screen, and recommends a separate assessment of that population.

Using the toolkit across jurisdictions

For the multistate privacy program these documents plug into, see Privacy and Data Protection Toolkit: Building and Running a Privacy Program, and for AI systems that may use biometric data, AI Governance Toolkit: Inventory, Risk Classification, and Controls.

This document is general information, not legal advice for any particular situation. Adapt each template to the specific system, workforce, and jurisdictions involved, and confirm current law before use.

Related Documents

Related Articles

• Biometric Privacy Litigation: BIPA, Rosenbach, Cothron, the 2024 Amendment, and the Laws Following Illinois: the cases behind each template.
• Privacy Policies, Notices, and Consent: Drafting Disclosures That Are True and Survive the FTC: consent design and FTC deception risk.
• Litigation Holds, Spoliation, and Rule 37(e): Preserving Electronic Evidence Before It Costs You the Case: the preservation duty behind Template 7.

Related Guides

• Defending or Bringing a Biometric Privacy Claim: A Practical Guide: the step-by-step litigation process Templates 7 to 9 support.
• Building a Generative AI Use Policy That Protects Trade Secrets: A Practical Guide: policy drafting for AI tools that may process biometric inputs.

Related Checklists

• Biometric Data Compliance Checklist: A Practical Checklist: the program these templates implement.
• Vendor Cybersecurity Diligence Checklist: A Practical Checklist: security diligence for biometric vendors.

Related Toolkits

• Privacy Notice Toolkit: Policy Templates, Consent Flows, and Change Management Records: aligning biometric notices with the privacy policy.
• AI Confidentiality Toolkit: Acceptable Use Policies, Vendor Term Reviews, and Incident Playbooks: vendor term reviews for AI services.
• Insurance Coverage Toolkit: Placing, Tendering, and Litigating Claims: more tender and coverage templates.
• Class Action Defense Toolkit: From Complaint Through Settlement Approval: class action templates.