Law / United States / 
Illinois
Biometric Information Privacy Act (BIPA)
740 ILCS 14/1, 14/5, 14/10, 14/15, 14/25 (P.A. 95-994, eff. , as amended by P.A. 103-0769, eff. )
In force since .
A biometric privacy rule binding private bodies.
- Excludes recording-derived identifiers
- No
- Obligation class
- Biometric, Consent, Retention, Disclosure
- Audit expectation
- none
What it requires
- Obtain a written release, including informed consent or an accepted electronic signature, before collecting or capturing any retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry, after disclosing in writing the specific purpose and length of time the data will be collected, stored, and used.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkCM.AW-P1
- Publish a written, publicly available policy establishing a retention schedule, and permanently destroy biometric identifiers and biometric information within 3 years of the individual's last interaction or when the collection purpose is satisfied, whichever occurs first.NIST Privacy FrameworkCT.PO-P2NIST Privacy FrameworkCT.DM-P5
- Never sell, lease, trade, or otherwise profit from a biometric identifier or biometric information, and disclose it only with consent, for a transaction the subject requested, or as required by law or a valid warrant or subpoena.NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text. Also read by: Cothron v. White Castle System, Inc., 2023 IL 128004 (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- CT.DM-P5Data are destroyed according to policy.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- NIST CSF 2.0
- ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Statutory damages
740 ILCS 14/20(a), the remedy clause for a violation of any section of the Act: liquidated damages of $1,000 or actual damages, whichever is greater, for a negligent violation, and $5,000 or actual damages, whichever is greater, for an intentional or reckless violation, plus reasonable attorneys' fees and costs. These are floors, not caps. Since the 2024 amendment, repeated collection of the same biometric identifier from the same person by the same method is a single violation with at most one recovery (section 20(b)), and likewise repeated disclosure to the same recipient (section 20(c)).
- As of
- Currency
- USD
- Per person reckless
- 5,000
- Per person negligent
- 1,000
Who enforces it
Enforcement body
Exclusively private civil actions under the Section 20 right of action; no regulator or Attorney General enforcement role for a BIPA violation.
Settledness
The Act is enforced only through private suits under section 20, so no agency guidance construes it.
- As of
- Case link
- https://www.illinoiscourts.gov/Resources/e304b011-82d9-4832-9cae-d8205749a2ec/128004.pdf
- Case citation
- Cothron v. White Castle System, Inc., 2023 IL 128004
- Open questions
- Does a scan of face geometry computed from a photograph count as a 'scan of hand or face geometry' in the definition of 'biometric identifier' in 740 ILCS 14/10, when the same definition excludes 'photographs'?
- Does a vendor that processes a business's biometric data on the business's behalf 'collect, capture, purchase, receive through trade, or otherwise obtain' that data under section 15(b), or only the business that deploys the scanner?
What it makes you log
Logging duty
Section 15(a) requires a written, publicly available policy with a retention schedule and destruction guidelines, destruction within three years of the individual's last interaction or when the purpose is met, and compliance with that schedule. A policy states rules and is not a record of processing, and the three-year limit bounds how long the biometric identifiers are held, not how long a record is kept. Section 15(b)(3) requires a written release before collection, which is a condition of collecting and states no record to be kept. The Act requires no log, no audit and no regulator access to a record, and its enforcement is a private right of action. The Act has no territorial clause, so no hook is coded.
- Kind
- None
- As of
What this law does
Requires a private entity to give written notice of the purpose and length of collection, storage and use, and to obtain a written release, before capturing a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry; a 2024 amendment recognizes an electronic signature as a valid release.
Bars selling, leasing, trading, or profiting from biometric data, limits disclosure to consent, a subject-requested transaction, or legal process, and requires a public written retention schedule that destroys the data within 3 years of the individual's last interaction or when the collection purpose is satisfied, whichever is first.
The Act excludes photographs, writing samples, and similar raw items from the definition of biometric identifier, but not an identifier such as a face-geometry scan that is itself enumerated, even when computed from an otherwise excluded item; no controlling appellate holding on that specific application was found.
How courts have read itPremium data
Our analysis of this law draws on 5 court rulings.
What each ruling held, what it means for an app, and whether it still stands are premium data, in the Plus, Pro and Enterprise plans.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .