Law / United States / 
Illinois
Biometric Information Privacy Act (BIPA)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since 3 October 2008.
A biometric privacy rule binding private bodies.
As of 23 August 2026.
What it requires
- Obtain a written release, including informed consent or an accepted electronic signature, before collecting or capturing any retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry, after disclosing in writing the specific purpose and length of time the data will be collected, stored, and used.
- Publish a written, publicly available policy establishing a retention schedule, and permanently destroy biometric identifiers and biometric information within 3 years of the individual's last interaction or when the collection purpose is satisfied, whichever occurs first.
- Never sell, lease, trade, or otherwise profit from a biometric identifier or biometric information, and disclose it only with consent, for a transaction the subject requested, or as required by law or a valid warrant or subpoena.
If you get it wrong
Criminal exposureNo
Private right of actionYes
Who enforces it
Enforcement body
Exclusively private civil actions under the Section 20 right of action; no regulator or Attorney General enforcement role for a BIPA violation.
What it reaches
Excludes recording-derived identifiersNo
Obligation class
Biometric, Consent, Retention, Disclosure
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Requires a private entity to give written notice of the purpose and length of collection, storage and use, and to obtain a written release, before capturing a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry; a 2024 amendment recognizes an electronic signature as a valid release.
Bars selling, leasing, trading, or profiting from biometric data, limits disclosure to consent, a subject-requested transaction, or legal process, and requires a public written retention schedule that destroys the data within 3 years of the individual's last interaction or when the collection purpose is satisfied, whichever is first.
The Act excludes photographs, writing samples, and similar raw items from the definition of biometric identifier, but not an identifier such as a face-geometry scan that is itself enumerated, even when computed from an otherwise excluded item; no controlling appellate holding on that specific application was found.
When LexLint raises it
processes_biometricsprocesses_voice
Read the law
Illinois Compiled Statutes, official code site (current codified text with per-section source notes)
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.