Defending or Bringing a Biometric Privacy Claim: A Practical Guide

Summary. This guide walks plaintiffs' and defense counsel step by step through a biometric privacy case, from the first client call to settlement approval, with the Illinois Biometric Information Privacy Act as the main focus and other state and local laws covered where they create claims. It begins with decision points for each side and then covers intake and fact capture, preservation (including the tension between a litigation hold and BIPA's destruction duty), mapping claims to the five statutory duties, limitations and accrual, the forum fight over CAFA removal and Article III standing, arbitration and mass arbitration, and the threshold defenses: labor preemption and the health care, financial institution, and government contractor exemptions. Later steps address pleading motions, discovery of time-clock and vendor data, class certification, damages after the 2024 amendment and the Seventh Circuit's 2026 retroactivity ruling in Clay v. Union Pacific, insurance tenders, and settlement approval after the Seventh Circuit vacated the Clearview AI settlement. A timeline and cost table, an extended worked example involving a logistics company with hand-geometry time clocks, common mistakes, an FAQ, and takeaways close the guide.

On the same Monday morning, two phones ring in Chicago.

The first call goes to a plaintiffs' lawyer. The caller, Dolores Reyes, worked for three years as a picker at a distribution center in Joliet. Every shift she put her right hand on a scanner that read the shape of her fingers before the turnstile would let her in. She never signed anything about it. A friend told her that people were getting checks from lawsuits like this. Was that true, and was it worth her time?

The second call goes to a defense lawyer. The caller is the general counsel of the company that runs the distribution center, Prairie Line Logistics. A process server has just handed the front desk a class action complaint filed in the Circuit Court of Cook County on behalf of "all individuals who scanned their hand geometry at any Prairie Line facility in Illinois in the past five years." The general counsel has three questions: how much is this worth, can we get it into federal court or arbitration, and does our insurance cover it?

Both lawyers will spend the next several months making the same decisions from opposite sides. This guide follows both of them, step by step. The doctrine behind each step (what BIPA requires, how the courts got here, and why the 2024 amendment matters) is explained in Biometric Privacy Litigation: BIPA, Rosenbach, Cothron, the 2024 Amendment, and the Laws Following Illinois. The compliance side, for clients who want to avoid the next suit, is in Biometric Data Compliance Checklist: A Practical Checklist, and the forms are in Biometric Privacy Toolkit: Retention Policies, Consent Forms, and Vendor Terms.

The short answer

• Most biometric claims are BIPA claims. Illinois's Biometric Information Privacy Act (740 ILCS 14) is the only biometric statute with a broad private right of action and liquidated damages ($1,000 per negligent violation, $5,000 per intentional or reckless violation, plus fees). Texas and Washington rely on their attorneys general; California allows private suits only for certain data breaches under Cal. Civ. Code § 1798.150; New York City and Portland have narrower ordinances.
• No harm is required in state court; Article III still governs in federal court. Under Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186, a procedural violation makes a person "aggrieved." In federal court, section 15(b) claims have standing under Bryant v. Compass Group USA, Inc., 958 F.3d 617 (7th Cir. 2020); some section 15(a) and 15(c) claims do not, and they are remanded.
• Five years, and accrual on every scan. Tims v. Black Horse Carriers, Inc., 2023 IL 127801 set a five-year limitations period for all BIPA claims; Cothron v. White Castle System, Inc., 2023 IL 128004 held a claim accrues with every scan or transmission.
• But only one recovery per person, per method. The 2024 amendment (Public Act 103-0769) limits recovery for repeated collection or disclosure, and in Clay v. Union Pacific Railroad Co., 171 F.4th 975 (7th Cir. 2026), the Seventh Circuit held that it applies to cases pending when it was enacted.
• Look for the defense that removes the class. Arbitration agreements, collective bargaining agreements, the HIPAA-based health care exclusion, the Gramm-Leach-Bliley financial institution exemption, and the government contractor exemption each remove some or all claimants. Workers' compensation exclusivity does not.
• Insurance is often there. Older CGL policies without biometric exclusions frequently owe a defense under West Bend Mutual Insurance Co. v. Krishna Schaumburg Tan, Inc., 2021 IL 125978 and Citizens Insurance Co. of America v. Wynndalco Enterprises, LLC, 70 F.4th 987 (7th Cir. 2023). Tender to every carrier in the five-year window.
• Settlement requires more than a number. Class settlements must survive Fed. R. Civ. P. 23(e) review, and the Seventh Circuit's July 2026 decision vacating the Clearview AI settlement shows that courts will scrutinize how the money is split among subclasses and who represented each group.

Before you start: decision points

For the plaintiff's lawyer

For defense counsel

For both sides: is this the right claim?

A biometric case is strongest when the technology plainly creates an identification template (a fingerprint or hand-geometry clock, a face-recognition system that matches faces against a database, a voice-authentication system), the collection occurred in Illinois, the defendant had no signed release, and the class is large and well documented. It is weakest when the system only detects or analyzes a face without identifying anyone, the data never left the user's own device (as in Barnett v. Apple Inc., 225 N.E.3d 602 (Ill. App. Ct. 2022)), the people scanned were mostly outside Illinois, or an exemption plainly applies.

Step 1: Intake and fact capture

What to do. Build a factual record of the technology before anyone takes a legal position.

Plaintiff. Interview the client about the device (where it was, what it looked like, what the client had to do), any documents signed, how long the client used it, and whether others did. Ask for pay stubs, offer letters, onboarding packets, and photos of the device if the client still works there. Search for the device model and vendor; many vendors publish technical descriptions stating that they store a template. Confirm that the client is not a member of a union and has not signed an arbitration agreement, or note the issue if they have.

Defendant. Under privilege, have counsel (not the business) run an internal investigation. Identify every biometric system in use in Illinois (time clocks, access control, point-of-sale, loss prevention cameras, call-center voice authentication, identity-verification vendors in apps), the vendor for each, the date each system went live, how templates are created and where they are stored, which entities have access, and what notice and consent documents were used and when. Interview the people who bought and installed the systems. A company sued over time clocks often discovers it also has face-recognition cameras or a voice-authentication vendor that no one connected to BIPA.

Why. Every later decision (removal, arbitration, exemptions, damages) depends on these facts, and the defendant's early statements to the court (in a notice of removal or a motion to compel) will be held against it if they turn out to be wrong.

Pitfalls. Defense counsel should not let the business "fix" the problem by deleting data or changing systems before preservation decisions are made (see Step 2). Plaintiff's counsel should not sign up a client whose claim was released in a prior class settlement or who is clearly covered by an arbitration agreement without a plan for that.

Timing and cost. One to three weeks. Plaintiff-side intake is usually done on contingency. Defense-side investigation for a single-facility employer might cost low five figures; for a multistate company with multiple systems, considerably more.

Step 2: Preserve, and resolve the destruction-duty conflict

What to do. Issue a litigation hold covering the biometric systems and their data, the vendor contracts and communications, consent and policy documents, timekeeping and access logs (which prove how many scans occurred and by whom), HR records showing employment dates, location, and union status, and insurance policies. Send a preservation letter to each vendor. Under Fed. R. Civ. P. 37(e), a party that fails to take reasonable steps to preserve electronically stored information risks sanctions, and the duty arises when litigation is reasonably anticipated; see Zubulake v. UBS Warburg LLC, 217 F.R.D. 309 (S.D.N.Y. 2003). The general framework is in Litigation Holds, Spoliation, and Rule 37(e): Preserving Electronic Evidence Before It Costs You the Case.

The conflict. BIPA section 15(a) requires destruction of biometric data when the initial purpose has been satisfied or within three years of the individual's last interaction, whichever comes first, and the only exception in the text is for "a valid warrant or subpoena." A litigation hold that keeps former employees' templates beyond the deadline arguably creates a new 15(a) violation.

How to handle it. Distinguish the biometric templates themselves from the metadata about them. In most cases the evidence that matters is the metadata (enrollment dates, scan logs, the identity of each enrolled person, the existence and location of templates) and the system documentation, not the templates. Preserve those. For the templates, propose a stipulation with plaintiff's counsel (or, absent agreement, seek a court order) that either authorizes destruction after the parties preserve a forensic record of what existed, or authorizes continued retention for the litigation under a protective order. A court order or subpoena gives the defendant a defensible basis for any retention beyond the statutory deadline. Document the decision either way.

Plaintiff's angle. Send your own preservation demand early, specifically identifying the vendor's systems and the scan logs. If the defendant destroys data after suit is filed without an agreement or order, that may support both a spoliation argument and a reckless-violation argument.

Timing. Within days of the complaint or demand letter. The checklist version is in Litigation Hold and Evidence Preservation Checklist: A Practical Checklist, and a biometric-specific hold notice is in the Biometric Privacy Toolkit: Retention Policies, Consent Forms, and Vendor Terms.

Step 3: Map the facts to the five duties

What to do. For each defendant, determine which of BIPA's section 15 duties apply and what the evidence shows.

Why. Recovery after the 2024 amendment is per person and per method for 15(b), and per person and per recipient for 15(d). Each distinct duty breached is a distinct path to recovery, so the number of duties in play, not the number of scans, now drives value.

Pleading tips for plaintiffs. Plead each duty as a separate count. Plead facts about the technology (that the device creates and stores a template) rather than conclusions. For 15(a), plead retention past the deadline if the facts support it, not just failure to publish, to preserve standing in federal court under Fox v. Dakkota Integrated Systems, LLC, 980 F.3d 1146 (7th Cir. 2020). For the reckless tier, plead facts showing knowledge: vendor warnings, industry publicity, prior suits, internal discussions.

Pitfalls for defendants. Do not assume that the vendor, not the employer, is the "collector." Employers have been held to collect through vendor devices on their premises, and the employer's disclosure to the vendor is a 15(d) event. Conversely, vendors should not assume they are safe because they never contracted with the workers; vendors whose systems store templates on vendor servers have faced 15(a), (b), and (d) claims, while vendors that merely sold hardware have succeeded on the "active step" argument recognized in Heard v. Becton, Dickinson & Co., 440 F. Supp. 3d 960 (N.D. Ill. 2020).

Step 4: Limitations and accrual

What to do. Fix the class period and the client's claims within it.

Authority. All BIPA claims are subject to the five-year period in 735 ILCS 5/13-205, not the one-year period in 735 ILCS 5/13-201, under Tims. Under Cothron, a claim accrues with each scan (15(b)) and each transmission (15(d)).

How the amendment interacts with accrual. The 2024 amendment changed section 20 (the remedy), not section 15 (the duties), and the Seventh Circuit in Clay stressed that the legislature left section 15, the provision Cothron interpreted, untouched, and that Cothron decided only how claims accrue under section 15, not what counts as a "violation" for damages under section 20. The practical result is that accrual still runs per scan, so a worker who first scanned outside the limitations period but kept scanning into it has a timely claim, while recovery is limited to one per person per method. Defense counsel should not argue that the amendment revived first-scan accrual; plaintiff's counsel should not argue that per-scan accrual multiplies recovery.

Class definitions. The class period runs five years back from the filing date. Tolling of class members' claims during a pending class action generally follows the American Pipe line of cases, but federal law does not permit stacking successive class actions to extend limitations; see China Agritech, Inc. v. Resh, 584 U.S. 732 (2018). In state court, Illinois applies its own class-tolling rules, which should be researched separately.

Pitfalls. Plaintiffs sometimes plead a class period beginning with the defendant's adoption of the technology, which may be more than five years before filing. Defendants should move to narrow such classes early.

Step 5: Choose and fight over the forum

What to do. Plaintiffs choose a forum; defendants decide whether to remove; both sides litigate whether the case stays.

Plaintiff's choice. Most BIPA class actions are filed in the Circuit Court of Cook County, where there is no Article III standing requirement, judges are experienced with BIPA, and class procedure is governed by 735 ILCS 5/2-801. A plaintiff who wants to stay in state court can plead narrowly (for example, a section 15(a) failure-to-publish claim or a bare 15(c) profit claim, as in Thornley v. Clearview AI, Inc., 984 F.3d 1241 (7th Cir. 2021)), but that tactic can backfire: a complaint that disclaims concrete injury to avoid federal court also gives up the stronger 15(b) theory, and it invites a removal anyway if any claim has standing.

Defendant's removal analysis. Under the Class Action Fairness Act, 28 U.S.C. § 1332(d), a class action is removable if there are at least 100 class members, minimal diversity (any class member diverse from any defendant), and more than $5 million in controversy, unless an exception applies. Removal is governed by 28 U.S.C. § 1453 and the 30-day deadline in 28 U.S.C. § 1446(b). A notice of removal need only plausibly allege the amount in controversy, without evidence, under Dart Cherokee Basin Operating Co. v. Owens, 574 U.S. 81 (2014), and a named plaintiff cannot defeat CAFA jurisdiction by stipulating to damages below $5 million on behalf of the class, under Standard Fire Insurance Co. v. Knowles, 568 U.S. 588 (2013). The mechanics are covered in Removing or Remanding a Class Action Under CAFA: A Practical Guide and the templates in CAFA Toolkit: Notices of Removal, Jurisdictional Evidence, and Exception Briefing.

Amount in controversy after the amendment. Before Clay, a defendant could compute the amount in controversy using per-scan figures and easily exceed $5 million for even a small class. After Clay, the realistic calculation is per person: class size times $1,000 or $5,000, times the number of distinct recoverable violations, plus attorney's fees (which count when a statute shifts them). A class of 400 with plausible reckless-tier 15(b) and 15(d) claims (400 x $10,000 = $4 million) may or may not cross the line depending on fees and 15(a) claims. The Clay court itself noted that district courts on remand may need to reconsider subject matter jurisdiction. Defendants removing post-Clay cases should show their math, and plaintiffs should test it.

Exceptions. The home-state and local-controversy exceptions in § 1332(d)(4) often apply to Illinois employers sued by Illinois workers, because more than two-thirds of the class and the principal defendant are Illinois citizens. Corporate citizenship turns on the "nerve center" under Hertz Corp. v. Friend, 559 U.S. 77 (2010). A national company headquartered elsewhere does not get the benefit of the exception even if every class member is from Illinois.

Standing. A removing defendant must establish Article III standing for each claim under Spokeo, Inc. v. Robins, 578 U.S. 330 (2016) and TransUnion LLC v. Ramirez, 594 U.S. 413 (2021). Under the Seventh Circuit cases:

Claims without standing are remanded, not dismissed, under 28 U.S.C. § 1447(c) and Collier v. SP Plus Corp., 889 F.3d 894 (7th Cir. 2018), and a court may award fees for a removal that lacked an objectively reasonable basis. The result can be split litigation: 15(b) claims in federal court, a 15(a) public-policy claim in state court. Both sides should consider whether a stipulated dismissal or amendment avoids the duplication. The standing doctrine is explored in Article III Standing After TransUnion: Concrete Injury, Traceability, and the End of No-Injury Claims, and the motion templates are in Justiciability Toolkit: Standing Allegations, Rule 12(b)(1) Motions, and Mootness Briefing.

Timing and cost. Removal within 30 days of service; remand motion within 30 days of removal for procedural defects (jurisdictional defects can be raised at any time). A contested removal and remand fight typically costs each side tens of thousands of dollars and adds two to six months.

Step 6: Arbitration and mass arbitration

What to do. Defendants: find every arbitration agreement that could cover a class member, and decide early whether to move to compel. Plaintiffs: decide whether arbitration is a threat or an opportunity.

The law. Arbitration agreements are enforceable under 9 U.S.C. § 2, and courts must stay litigation and compel arbitration under §§ 3 and 4. Class waivers in consumer agreements are enforceable under AT&T Mobility LLC v. Concepcion, 563 U.S. 333 (2011) and in employment agreements under Epic Systems Corp. v. Lewis, 584 U.S. 497 (2018). Delegation clauses send arbitrability questions to the arbitrator under Rent-A-Center, West, Inc. v. Jackson, 561 U.S. 63 (2010) and Henry Schein, Inc. v. Archer & White Sales, Inc., 586 U.S. 63 (2019). A defendant that litigates before moving to compel can waive arbitration without any showing of prejudice to the plaintiff, under Morgan v. Sundance, Inc., 596 U.S. 411 (2022), and an appeal from denial of a motion to compel automatically stays the district court proceedings under Coinbase, Inc. v. Bielski, 599 U.S. 736 (2023).

Practical issues for defendants.

• Timing of the agreement. An arbitration agreement signed in 2022 may not cover scans in 2019 unless it reaches pre-existing disputes. Check the language.
• Who signed. A time-clock vendor is not a party to the employer's arbitration agreement. Whether the vendor can invoke it depends on state-law doctrines such as equitable estoppel and third-party beneficiary status.
• Waiver. Move to compel before litigating the merits. Removing and moving to dismiss on the merits before moving to compel invites a Morgan waiver argument.
• Mass arbitration risk. A class waiver plus an arbitration clause that requires the company to pay per-case fees can turn a single class action into thousands of individual arbitrations. Model the cost before moving to compel. See Mass Arbitration Toolkit: Clause Architecture, Batching Protocols, and Response Plans.

Practical issues for plaintiffs. In Wallrich v. Samsung Electronics America, Inc., 106 F.4th 609 (7th Cir. 2024), roughly 50,000 consumers filed BIPA arbitration demands; when Samsung did not pay the AAA's fees and the AAA closed the cases, the Seventh Circuit held that the claimants had not proved the existence of their individual agreements and that the AAA's fee decisions were the AAA's to make. Bernal v. Kohl's Corp., No. 24-2806 (7th Cir. May 1, 2026), a consumer marketing case, extended that reasoning: where the AAA closed cases because the company refused to register its clause, there was nothing for a court to compel. The lesson for claimants' counsel is to build an evidentiary record of each client's assent and to read the arbitral provider's rules about what happens when a business does not pay or register; the lesson for companies is that refusing to pay may end the arbitration but may also reopen the courthouse door, depending on the clause. For the motion itself, see Motion to Compel Arbitration Toolkit: Clauses, Declarations, and Appellate Strategy.

Step 7: Evaluate the threshold defenses

Each of these defenses can remove part or all of a class. Defense counsel should investigate each one in the first sixty days; plaintiff's counsel should define the class to exclude the people they apply to, which avoids losing the whole case to a partial defense.

Labor preemption

Rule. BIPA claims by employees covered by a collective bargaining agreement are preempted when resolving them requires interpreting the agreement, because the union is the employees' representative on matters such as timekeeping methods. For railroad and airline employees the Railway Labor Act, 45 U.S.C. § 151 et seq., sends the dispute to the adjustment board, as in Miller v. Southwest Airlines Co., 926 F.3d 898 (7th Cir. 2019). For other unionized employees, section 301 of the Labor Management Relations Act, 29 U.S.C. § 185, applies, as in Fernandez v. Kerry, Inc., 14 F.4th 644 (7th Cir. 2021) and Walton v. Roosevelt University, 2023 IL 128338.

Defense evidence. The collective bargaining agreement, including its management-rights clause; evidence that the union was informed of or agreed to the biometric system; and HR data identifying bargaining-unit members during the class period.

Plaintiff response. Exclude union members from the class definition, or argue that particular claims (for example, 15(d) disclosure to a vendor or 15(a) retention after the employee left the unit) do not require interpreting the agreement. Courts are divided on these edges.

The health care exclusion

Rule. Section 10 excludes from "biometric identifier" information captured from a patient in a health care setting and information collected, used, or stored for health care treatment, payment, or operations under HIPAA (see 42 U.S.C. § 1320d and 45 C.F.R. Part 164). In Mosby v. Ingalls Memorial Hospital, 2023 IL 129081, the Illinois Supreme Court held that the second clause covers health care workers' biometric data used, for example, to access medication-dispensing cabinets for patient care.

Limits. The exclusion turns on purpose. In Townsend v. Estates of Hyde Park, 2026 IL App (1st) 250096, the appellate court held that a nursing home's hand-scan timekeeping was not "health care operations" and therefore not excluded, warning that the defendant's reading would categorically eliminate BIPA protection for health care workers, contrary to Mosby. In Verity v. Herrin Rehabilitation & Nursing Center, LLC, 2025 IL App (5th) 240785-U, a nonprecedential order, the court reversed a dismissal that rested on a conclusory affidavit about "punch data" because the defendant had not proved how the biometric data was actually used. For consumers, the patient clause has been read narrowly: Marino v. Gunnar Optiks LLC, 2024 IL App (1st) 231826 held that a shopper virtually trying on nonprescription glasses was not a patient in a health care setting, and in Clements v. Gunnar Optiks, LLC, No. 25-1890 (7th Cir. July 10, 2026), the Seventh Circuit vacated a Rule 12(b)(6) dismissal based on the HIPAA clause, noting that whether the defendant's service was health care under HIPAA, and whether the defendant complied with HIPAA, could not be decided from the complaint.

Defense evidence. Declarations, with documents attached, showing exactly what the biometric system does, that it is used for treatment, payment, or operations (dispensing medication, accessing medical records, verifying patient identity), and that the entity is a HIPAA covered entity or business associate. Illinois practice requires affidavits supporting a section 2-619 motion to attach the documents on which they rely.

The financial institution exemption

Rule. Section 25(c) provides that the Act does not apply "in any manner" to a financial institution or affiliate subject to Title V of the Gramm-Leach-Bliley Act, 15 U.S.C. § 6801 et seq. "Financial institution" is defined in 15 U.S.C. § 6809 by reference to financial activities under 12 U.S.C. § 1843(k), which the Federal Reserve has expanded by regulation in 12 C.F.R. Part 225 (Regulation Y).

Reach. In McGoveran v. Amazon Web Services, Inc., No. 24-3215 (3d Cir. May 12, 2026), callers to an insurer's financial-services line alleged that a voice-authentication vendor created voiceprints without consent. The Third Circuit affirmed dismissal of the vendor under the exemption because Regulation Y lists "authenticating the identity of persons conducting financial and nonfinancial transactions" as a financial activity, and the exemption appeared on the face of the complaint. Identity-verification and authentication vendors serving banks, insurers, and payment companies should evaluate this defense first.

The government contractor exemption

Rule. Section 25(e) provides that the Act does not apply to a contractor, subcontractor, or agent of a State agency or local unit of government "when working for that State agency or local unit of government."

Reach. The exemption is not a status-based shield. In Thomas v. Cornerstone Services, Inc., 2026 IL App (3d) 240568, the appellate court held that a contractor need not work exclusively for government, but is exempt only if the violation occurred while acting within the scope of its governmental contract. In Payton v. Union Pacific Railroad Co., No. 26-1946 (7th Cir. Sept. 30, 2026), the Seventh Circuit agreed, rejecting the railroad's argument that its commuter-rail and overpass contracts exempted fingerprinting of truck drivers at its intermodal freight yards. Whether there must also be a "nexus" between the contract and the biometric collection remains open for the Illinois Supreme Court.

Workers' compensation: not a defense

McDonald v. Symphony Bronzeville Park, LLC, 2022 IL 126511 held that the exclusivity provisions of the Workers' Compensation Act, 820 ILCS 305/5(a), do not bar BIPA claims, because the injury is not compensable under that Act. Do not spend time on this argument.

Extraterritoriality and definitional defenses

• Location. Under Avery v. State Farm Mutual Automobile Insurance Co., 216 Ill. 2d 100 (2005), the relevant circumstances must have occurred primarily and substantially in Illinois. This is strongest for out-of-state class members and online services with no Illinois facilities, and is usually decided at summary judgment.
• No identifier. Systems that detect faces without identifying anyone may fall outside the Act; see Zellmer v. Meta Platforms, Inc., 104 F.4th 1117 (9th Cir. 2024). Photo-derived face templates are within it; see Rivera v. Google Inc., 238 F. Supp. 3d 1088 (N.D. Ill. 2017).
• No possession or collection. On-device processing the defendant never receives is not possession (Barnett); a hardware seller that takes no active step may not "collect" (Heard).

Step 8: Pleading-stage motions

What to do. Decide which issues are worth raising before discovery.

In federal court. Motions under Fed. R. Civ. P. 12(b)(1) (standing, for claims the defendant did not itself bring into federal court; a removing defendant cannot easily argue the plaintiff lacks standing for claims it removed), 12(b)(6) (failure to state a claim, including an exemption that appears on the face of the complaint, as in McGoveran), and 12(f) (striking class allegations, rarely granted at this stage).

In Illinois state court. A section 2-615 motion tests the legal sufficiency of the complaint on its face. A section 2-619 motion raises affirmative matter that defeats the claim (an exemption, a release, preemption, limitations) and may be supported by affidavits. Combined motions are filed under section 2-619.1. Illinois courts frequently certify novel BIPA questions for interlocutory appeal, which is how Mosby, Marino, Thomas, and Townsend reached the appellate court.

What tends to work. Exemptions plainly shown by the plaintiff's own allegations; labor preemption with the collective bargaining agreement attached; lack of possession for on-device processing; lack of an active step by a hardware-only vendor; untimely claims of class members who left more than five years before filing.

What tends not to work. Arguments that templates are not biometric data; that the plaintiff was not harmed; that the employer could not have known about BIPA; that workers' compensation is exclusive; that consent was implied by continued use of the device.

Recklessness at the pleading stage. Defendants sometimes move to dismiss or strike the reckless-tier allegations. Courts usually let them proceed if the complaint pleads facts suggesting knowledge (for example, that the defendant was a sophisticated company in an industry where BIPA suits were common). Plaintiffs should plead those facts specifically.

Interlocutory appeal. In federal court, a controlling question of law can be certified under 28 U.S.C. § 1292(b), which is how the retroactivity question reached the Seventh Circuit in Clay and how the government contractor question reached it in Payton.

Step 9: Discovery

What to do. Focus discovery on the questions that determine class size, culpability, and defenses.

Plaintiff's core requests (under Fed. R. Civ. P. 34 and Illinois Supreme Court Rule 214):

• system documentation and vendor specifications showing that the device creates and stores templates;
• contracts with the vendor, including data-processing terms, indemnity, and any BIPA representations;
• enrollment and scan logs identifying every person enrolled in Illinois during the class period, with dates;
• all notices, consent forms, releases, and retention policies, with version dates;
• communications about BIPA compliance (vendor alerts, legal memos that are not privileged, board or management discussions), which bear on recklessness;
• records showing whether and when templates were destroyed;
• insurance policies (discoverable under Rule 26(a)(1)(A)(iv)).

Third-party discovery. Subpoena the vendor under Fed. R. Civ. P. 45 (or the Illinois equivalent) for data flows, storage locations, and the customer's configuration choices. Vendors often have better records of enrollment and storage than the customer.

Depositions. A Rule 30(b)(6) deposition of the defendant on the biometric systems, data flows, and compliance history is usually the most valuable single deposition in the case.

Defense discovery. Collective bargaining agreement coverage, arbitration agreements signed by named plaintiffs, the named plaintiffs' locations, any consent forms they signed for other employers or services, and their awareness of the technology (relevant to class certification and damages discretion).

Protective order. Seek a protective order under Rule 26(c) that treats biometric data and enrollment lists as highly confidential, limits access, and addresses destruction at the end of the case. Ask for an order under Fed. R. Evid. 502(d) so that inadvertent production of privileged compliance memos does not waive privilege. Redact personal identifiers in filings under Fed. R. Civ. P. 5.2. Do not produce actual templates unless an expert genuinely needs them; produce metadata instead.

Step 10: Class certification

What to do. Plaintiffs move for certification; defendants oppose on the grounds that individual issues predominate.

Standards. In federal court, the plaintiff must satisfy Rule 23(a) (numerosity, commonality, typicality, adequacy) and, for damages classes, Rule 23(b)(3) (predominance and superiority). Commonality requires a common question whose answer will drive resolution, under Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338 (2011); damages models must measure damages attributable to the theory of liability, under Comcast Corp. v. Behrend, 569 U.S. 27 (2013); and representative evidence may be used where each member could have relied on it in an individual action, under Tyson Foods, Inc. v. Bouaphakeo, 577 U.S. 442 (2016). Illinois's section 2-801 has similar requirements and is often described as patterned on Rule 23.

Why BIPA classes are often certified. In a typical time-clock case, every class member used the same device, under the same policy (or lack of one), and the same consent was (or was not) obtained. The central questions (did the defendant collect, did it obtain releases, did it disclose to the vendor, was it negligent or reckless) are common. Patel v. Facebook, Inc., 932 F.3d 1264 (9th Cir. 2019) affirmed certification of a consumer class over objections based on extraterritoriality and the size of aggregate damages.

Defense arguments that sometimes succeed.

• Varied consent. If some class members signed releases at different times, or consent was obtained through different app versions, individual inquiries may predominate. Better yet for defendants, the class can be narrowed.
• Union, arbitration, and location subclasses. These typically lead to narrower class definitions rather than denial.
• Damages discretion. After Cothron and Rogers v. BNSF Railway Co. (N.D. Ill. June 30, 2023), damages are discretionary and may be assessed by a jury. Defendants argue that individual circumstances (whether a person knew about the scanning, whether they objected, how long they used it) bear on discretionary damages and defeat predominance. Plaintiffs respond that the amount can be set classwide based on the defendant's conduct. Courts have mostly accepted the plaintiffs' framing, but the argument has more force in consumer cases with varied user experiences.

Rule 23(f). An order granting or denying certification can be appealed by permission under Rule 23(f) within 14 days. Illinois has a parallel route under Supreme Court Rule 306.

For general class-action strategy, see Class Actions Under Rule 23: Certification, Settlement, and Defense Strategy.

Step 11: Damages after the 2024 amendment and Clay

What to do. Build an exposure model both sides can test.

The rules now.

What Clay held. In Clay v. Union Pacific Railroad Co., consolidated with Gregg v. Central Transport LLC and a third case, district courts had held that the amendment did not apply to pending cases. On interlocutory review, the Seventh Circuit reversed, predicting that the Illinois Supreme Court would treat the amendment as a change to remedies, which Illinois treats as procedural, and therefore as applicable to pending cases. The court reasoned that because liquidated damages under section 20 were already discretionary, plaintiffs had never been guaranteed any particular award, so limiting them to "at most, one recovery" altered no substantive right; and it emphasized that the amendment changed section 20 (damages), not section 15 (liability). Clay binds federal courts in the Seventh Circuit; Illinois state courts are not bound by it, though it is persuasive. Plaintiffs in state court may still argue that the amendment is prospective until the Illinois appellate courts or Supreme Court decide the question. No Illinois appellate court had decided the retroactivity question when this guide was last updated, so check for one before briefing the issue in state court.

Building the model.

1. Count persons, not scans: the number of people enrolled in Illinois during the five-year class period, less union members, arbitration signers (if arbitration will be compelled), people who signed releases before their first scan, and people outside Illinois.
2. Identify distinct methods (a fingerprint clock and a face-recognition kiosk are two methods) and distinct recipients for disclosures (the time-clock vendor, a payroll provider, a cloud host).
3. Add 15(a) claims where the defendant retained data past the deadline or never had a policy, recognizing that courts have not settled whether 15(a) claims are also limited to one per person.
4. Apply both the negligent and reckless figures and estimate the probability of each based on the knowledge evidence.
5. Apply a discretionary discount range; Rogers suggests juries will award substantial amounts when recklessness is proved, but no rule fixes the discount.
6. Add plaintiffs' fees (if the case is litigated to judgment) and defense costs.

Cothron-era cases filed before the amendment. For cases in federal court within the Seventh Circuit, the per-scan theory is gone. In state court, plaintiffs may still press it, but should expect the same argument to prevail eventually.

Step 12: Insurance

What to do. Defendants tender to every insurer that issued a policy during the class period (and sometimes before it, for continuing conduct) within the notice deadlines; plaintiffs identify the coverage that will fund a settlement.

Coverage sources.

• CGL "personal and advertising injury." Covers "publication of material that violates a person's right of privacy." Under West Bend, disclosure of biometric data to a single vendor is a publication, and BIPA protects privacy. The standard "violation of statutes" exclusion naming the TCPA and CAN-SPAM did not apply.
• Catch-all exclusions. Under Wynndalco, the broader catch-all ("any federal, state or local statute... that addresses, prohibits, or limits the printing, dissemination, disposal, collecting, recording, sending, transmitting, communicating or distribution of material or information") was ambiguous and did not defeat the duty to defend. Results vary under different wording.
• Umbrella and excess. Under Thermoflex Waukegan, LLC v. Mitsui Sumitomo Insurance USA, Inc., 102 F.4th 438 (7th Cir. 2024), an umbrella insurer owed a defense once underlying coverage was exhausted.
• Employment practices liability. Some EPL policies cover invasion-of-privacy claims by employees; many now exclude biometric claims.
• Cyber. Cyber policies may cover privacy liability, particularly for breach-related claims, but frequently exclude statutory damages or "wrongful collection."
• Biometric exclusions. Newer policies often contain express biometric exclusions. Check the policy year.

Procedure. Insurers often defend under a reservation of rights and file declaratory judgment actions under 28 U.S.C. § 2201 (or the Illinois equivalent). Illinois law requires an insurer that believes a claim is not covered to defend under a reservation or seek a declaratory judgment; an insurer that does neither and is later found to owe coverage may be estopped from raising coverage defenses. Policyholders should insist on independent counsel where the reservation of rights creates a conflict (for example, where the insurer disputes coverage for intentional conduct but the plaintiff alleges recklessness).

For templates, see Insurance Coverage Toolkit: Placing, Tendering, and Litigating Claims and, for the policy landscape, Business Insurance and Coverage Disputes: CGL, E&O, Cyber, and D&O.

Step 13: Settlement and approval

What to do. Negotiate a settlement that the court will approve and that actually resolves the exposure.

Structure. A typical BIPA class settlement includes a common fund (or a claims-made structure), a per-person payment (often with a higher amount for claimants in the strongest category), injunctive or practice relief (adoption of a retention policy, destruction of templates, obtaining consent going forward), attorney's fees from the fund, service awards to named plaintiffs, and a release limited to biometric claims. Defendants should insist that the release covers the vendor (or coordinate with the vendor's separate settlement) and covers all Illinois facilities.

Approval. In federal court, Rule 23(e) requires a hearing and a finding that the settlement is fair, reasonable, and adequate, considering adequacy of representation, arm's-length negotiation, the adequacy of relief, and equitable treatment of class members relative to each other. Settlement classes must still meet Rule 23(a) and (b), under Amchem Products, Inc. v. Windsor, 521 U.S. 591 (1997). CAFA requires notice to appropriate federal and state officials under 28 U.S.C. § 1715, and the court cannot grant final approval until 90 days after that notice. Class notice in (b)(3) classes must be the best notice practicable, under Eisen v. Carlisle & Jacquelin, 417 U.S. 156 (1974).

The Clearview lesson. In In re Clearview AI, Inc. Consumer Privacy Litigation (Weissman appeal), No. 25-1673 (7th Cir. July 13, 2026), the Seventh Circuit vacated approval of the Clearview settlement. It found nothing inherently wrong with the absence of injunctive relief or with monetary relief in the form of an equity stake in the defendant. But the settlement gave members of several state subclasses (including Illinois residents) far greater benefits than members of the nationwide class, and no representative of the disfavored nationwide class had endorsed that allocation; representatives of the favored subclasses could not also represent the nationwide class on that issue. The court also directed the district court, on remand, to consider the replacement of the original class representatives, who had refused to agree to the settlement, in deciding whether the representatives had protected the class rather than counsel's interest in settling. The practical rule: if a settlement allocates different benefits to different groups (Illinois versus other states, BIPA versus other claims, employees versus consumers), each group needs its own representative and, ideally, its own counsel in the allocation negotiation.

Timing and cost. Preliminary approval, notice, and final approval typically take four to eight months. Administration costs depend on class size and notice method.

For release drafting, see Drafting a Settlement Agreement and Release: A Practical Guide, and for valuation and negotiation, Planning and Running a Litigation Settlement Negotiation: A Practical Guide.

Step 14: Trial, if it comes to that

Very few BIPA cases have been tried. The lessons of Rogers v. BNSF are the best guide. The plaintiff's case at trial is short: the device, the absence of releases, the number of people, and evidence of knowledge. The defense case is about culpability: what the defendant knew, what it relied on (vendor assurances, industry practice), how quickly it fixed the problem, and why a discretionary award should be modest. After Clay, the per-person cap makes a verdict calculable, which may make trial more attractive to defendants with strong culpability evidence and less attractive to plaintiffs with small classes. Expect the jury to be instructed on the negligent and reckless standards and on its discretion to award less than the full liquidated amount.

Claims under other laws

For the multistate compliance picture, see State Consumer Privacy Laws: The CCPA, the CPRA, and the Multi-State Patchwork. Data-breach claims involving biometric data are covered in Data Breach Response and Notification: The Fifty-State Patchwork, Regulators, and Litigation.

Timeline and cost

The ranges below are rough planning figures for a single-defendant employment class action in Illinois with a few hundred to a few thousand class members. Consumer cases against platforms run longer and cost more. Actual figures depend heavily on the court, counsel, and how many issues are contested.

Worked example: Reyes v. Prairie Line Logistics

Return to the two phone calls. The facts, which both sides eventually learn:

• Prairie Line Logistics is a Delaware corporation headquartered in Indianapolis. It runs two distribution centers in Illinois (Joliet and Rockford) and one in Gary, Indiana.
• In June 2018 it installed hand-geometry scanners at turnstiles and time clocks in all three facilities, supplied and hosted by a vendor called TimeVault. Templates are stored on TimeVault's cloud servers in Ohio.
• About 2,400 people used the scanners in Illinois between January 2020 and January 2025. About 900 of them were in a Teamsters bargaining unit at Rockford. Since March 2022, new hires sign an arbitration agreement with a class waiver that covers "all claims arising out of employment, whether arising before or after this agreement."
• Prairie Line adopted a BIPA consent form and posted a retention policy on its intranet (not its public website) in October 2023, after TimeVault sent customers a compliance bulletin. TimeVault had sent a similar bulletin in 2019, which the facilities manager forwarded to HR with the note "do we need this?" No one answered.
• Prairie Line's CGL policies for 2018 through 2021 contain the narrow "violation of statutes" exclusion; its 2022 and later policies contain an express biometric exclusion.

Reyes's lawyer files in Cook County in January 2025 on behalf of a class of all individuals who scanned in Illinois since January 2020, pleading counts under 15(a) (no public policy; retention of former workers' templates past three years), 15(b), and 15(d) (disclosure to TimeVault), with the reckless tier based on the 2019 bulletin.

Step 1 to 2 (defense). Defense counsel's investigation finds the 2019 email within a week. Counsel issues a hold, sends a preservation letter to TimeVault, and negotiates a stipulation with Reyes's counsel: TimeVault will export enrollment and scan metadata and certify the number of templates held for former employees, after which it will destroy those templates under a court order. That ends ongoing 15(a) retention exposure without destroying evidence.

Step 3 to 4. The class period runs from January 2020. About 300 people who stopped working before then are out. Under Cothron, workers hired before 2020 who kept scanning have timely claims.

Step 5. Prairie Line is an Indiana citizen (nerve center in Indianapolis), so minimal diversity exists and the home-state and local-controversy exceptions do not apply. When the case was filed in January 2025, the per-scan theory made the amount in controversy easily exceed $5 million, and Prairie Line removed under CAFA. Reyes moved to remand the 15(a) public-policy claim for lack of standing; the court remanded that portion under Bryant but kept the 15(a) retention claim (under Fox), the 15(b) claim, and the 15(d) claim.

Step 6. Prairie Line moves to compel arbitration as to the roughly 700 non-union Illinois workers hired after March 2022, before filing any merits motion, to avoid Morgan waiver. Reyes's counsel argues the agreement does not cover pre-agreement scans by workers rehired after a break. The court compels arbitration for the 700 and excludes them from the class. Reyes's counsel considers filing 700 individual arbitrations but concludes, after Wallrich, that proving each agreement and managing the fees is not worth it for these claimants, most of whom used the scanners for less than three years.

Step 7. The 900 Rockford bargaining-unit workers are preempted under Fernandez and Walton; Reyes amends to exclude them. No exemption applies to Prairie Line, which is not a health care provider, financial institution, or government contractor. The class now stands at about 500.

Step 11. After Clay in April 2026, the per-person rule applies. Exposure is about 500 x ($1,000 + $1,000) = $1 million at the negligent tier for 15(b) and 15(d), or 500 x ($5,000 + $5,000) = $5 million at the reckless tier, plus 15(a) retention claims for former employees and fees. The district court asks the parties to address whether the amount in controversy still supports jurisdiction; because jurisdiction is measured at the time of removal and the original allegations plausibly exceeded $5 million, the court keeps the case, but notes the question.

Step 12. Prairie Line tenders to the 2018 to 2021 CGL carrier, which accepts the defense under a reservation of rights, citing West Bend. The 2022 carrier denies under the biometric exclusion. TimeVault's contract has a mutual indemnity clause that excludes "customer's failure to obtain end-user consents," so TimeVault contributes only toward the 15(d) exposure tied to its own hosting.

Step 13. The parties mediate in summer 2026. The 2019 email makes the reckless tier a real risk, but Prairie Line's 2023 remediation and the court's discretion over damages give the defense room. The case settles for a common fund in the range suggested by reported employment settlements, with higher payments for workers employed before October 2023 and practice commitments (a public retention policy, destruction of former workers' templates, annual audits). Because the settlement treats one group differently, the parties ensure that the subgroup receiving less has its own named representative, heeding the Clearview decision. Defense counsel coordinates CAFA notice and obtains final approval in early 2027.

Common mistakes

Plaintiffs.

• Pleading a class period longer than five years, inviting an early motion that narrows the class and costs credibility.
• Disclaiming injury to stay in state court and then losing the strongest claims.
• Ignoring union membership and arbitration agreements in the class definition, so the class shrinks in stages.
• Counting scans after Clay in federal court.
• Failing to pursue recklessness evidence, which is now the main way to increase per-person value.
• Overlooking the vendor as a defendant or as a source of discovery.

Defendants.

• Deleting templates or changing systems before making preservation decisions.
• Removing without analyzing standing claim by claim, leading to a remand fight and a fee award.
• Litigating the merits before moving to compel arbitration, risking waiver under Morgan.
• Relying on workers' compensation exclusivity after McDonald or on the health care exclusion for timekeeping after Townsend.
• Treating the government contractor exemption as a status defense after Thomas and Payton.
• Failing to tender to older insurers, or tendering late.
• Settling without addressing the vendor, leaving indemnity and contribution claims unresolved.
• Ignoring allocation conflicts in the settlement after the Clearview decision.

Frequently asked questions

How much is a BIPA claim worth to an individual after the amendment? At most one liquidated recovery per method of collection ($1,000 if negligent, $5,000 if reckless or intentional), plus a separate recovery for disclosures to each distinct recipient and potential claims under sections 15(a), (c), and (e). In a class settlement, reported individual payments have usually been well below the statutory figures because they reflect litigation risk and fees.

Does Clay apply in Illinois state court? Not as binding precedent. Clay is a Seventh Circuit prediction of Illinois law. Illinois courts usually find Seventh Circuit reasoning persuasive, and defendants in state court will cite it, but until an Illinois appellate court or the Illinois Supreme Court rules, plaintiffs can argue for a different result.

Can a defendant remove a BIPA case and then argue the plaintiff lacks standing? It can try, but it bears the burden of establishing federal jurisdiction when it removes, and a court that finds no standing will remand rather than dismiss. Defendants usually remove only the claims they believe have standing and accept remand of the rest.

If our employees signed a consent form after they were already enrolled, are we protected? Only going forward. Section 15(b) requires a release before collection. A later consent stops future violations and, after the amendment, may limit the practical value of the claim, but it does not erase the original violation.

Our vendor says it handles BIPA compliance. Are we covered? Not by that statement. The employer or business that deploys the system usually collects the data and discloses it to the vendor. Contract terms can allocate costs, but they do not shift statutory liability to the vendor.

Can a health care employer avoid BIPA for timekeeping? Generally no. Mosby exempts worker data used for treatment, payment, or operations, but Townsend held that hand-scan timekeeping at a nursing home is not health care operations.

Can BIPA claims be brought in mass arbitration? Yes, if the claimants have arbitration agreements, but claimants must be able to prove each agreement, and the arbitral provider's fee and registration rules may end the proceedings without a merits ruling (Wallrich, Bernal).

What if the company is in bankruptcy or cannot pay? The Clearview litigation shows creative structures (equity stakes, conduct relief), but also that courts will scrutinize them. Insurance and vendor indemnities become the main sources of recovery.

Takeaways

1. Start with facts: the device, the data flow, the dates, the documents, and the people. Every later decision depends on them.
2. Preserve metadata and resolve the 15(a) destruction conflict by stipulation or court order.
3. Map the claims to the five duties; after the amendment, the number of distinct violations per person, not the number of scans, drives value.
4. Analyze removal claim by claim for Article III standing and for CAFA's thresholds measured per person.
5. Move to compel arbitration early, and model mass-arbitration costs before doing so.
6. Labor preemption and the financial institution exemption can remove large groups; the health care and government contractor exemptions are narrower than defendants hoped.
7. Under Clay, the amendment applies to pending federal cases; recklessness evidence is now the main lever on value.
8. Tender to every insurer in the five-year window, and settle with attention to allocation and representation.

This document is general information, not legal advice for any particular situation. BIPA case law is developing quickly; check for later decisions, including any Illinois Supreme Court ruling on the questions the 2026 decisions left open.

Related Documents

Related Articles

• Biometric Privacy Litigation: BIPA, Rosenbach, Cothron, the 2024 Amendment, and the Laws Following Illinois: the doctrine and history behind each step.
• Article III Standing After TransUnion: Concrete Injury, Traceability, and the End of No-Injury Claims: standing in removed BIPA cases.
• Mass Arbitration: How Thousands of Individual Claims Became a Strategic Problem: the strategy behind Wallrich and Bernal.
• Litigation Holds, Spoliation, and Rule 37(e): Preserving Electronic Evidence Before It Costs You the Case: preservation duties and sanctions.
• Business Insurance and Coverage Disputes: CGL, E&O, Cyber, and D&O: coverage for privacy claims.
• Class Actions Under Rule 23: Certification, Settlement, and Defense Strategy: certification and approval standards.

Related Guides

• Removing or Remanding a Class Action Under CAFA: A Practical Guide: the removal fight in detail.
• Planning and Running a Litigation Settlement Negotiation: A Practical Guide: preparing for mediation.
• Drafting a Settlement Agreement and Release: A Practical Guide: release scope and vendor coverage.
• Employee Monitoring and Workplace Privacy: A Practical Guide: the broader workplace privacy context.

Related Checklists

• Biometric Data Compliance Checklist: A Practical Checklist: the compliance program that prevents the next case.
• CAFA Removal and Remand Checklist: A Practical Checklist: removal deadlines and evidence.
• Litigation Hold and Evidence Preservation Checklist: A Practical Checklist: hold steps.

Related Toolkits

• Biometric Privacy Toolkit: Retention Policies, Consent Forms, and Vendor Terms: hold notice, response memo outline, and compliance documents.
• CAFA Toolkit: Notices of Removal, Jurisdictional Evidence, and Exception Briefing: removal templates.
• Motion to Compel Arbitration Toolkit: Clauses, Declarations, and Appellate Strategy: arbitration motion templates.
• Insurance Coverage Toolkit: Placing, Tendering, and Litigating Claims: tender letters.
• Mass Arbitration Toolkit: Clause Architecture, Batching Protocols, and Response Plans: responding to mass filings.