Law / United States / 
Illinois
Biometric Information Privacy Act (BIPA), consent duty for scraped-photo facial geometry
740 ILCS 14/1 et seq. (P.A. 95-994, 2008; amended by P.A. 103-769, eff. )
In force since .
A personal data rule binding private bodies.
- Audit expectation
- none
What it requires
- Do not scrape photographs from the open web to derive facial geometry, or collect voiceprints, without first informing the subject in writing and obtaining a written release; the statute's consent duty attaches to your own act of collection regardless of whether the source page was public.
- A written release now includes an electronic signature under the 2024 amendment, so a properly executed electronic consent flow satisfies section 15(b).
- Even where you collect the same biometric identifier from the same person more than once by the same method, you face at most one statutory recovery per person per method under the 2024 amendment, not a per-scan multiplier.
These lines are LexLint's reading of the law's text. Also read by: In re Clearview AI, Inc., Consumer Privacy Litigation, No. 21-cv-0135 (N.D. Ill. ) (recorded ).
In the frameworks
- NIST AI RMF
- MAP 1.6System requirements (e.g., “the system shall respect the privacy of its users”) are elicited from and understood by relevant AI actors. Design decisions take socio-technical implications into account to address AI risks.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
The Act is enforced only through private suits under section 20, so no agency guidance construes it.
- As of
- Case link
- https://www.govinfo.gov/content/pkg/USCOURTS-ilnd-1_21-cv-00135/pdf/USCOURTS-ilnd-1_21-cv-00135-2.pdf
- Case citation
- In re Clearview AI, Inc., Consumer Privacy Litigation, No. 21-cv-0135 (N.D. Ill. )
- Open questions
- Does section 15(b) of the Biometric Information Privacy Act reach a developer that scrapes photographs of Illinois residents and computes face geometry from them outside Illinois, given the court's 'primarily and substantially in Illinois' test for extraterritoriality?
- Which facts decide, at summary judgment, whether alleged BIPA violations occurred 'primarily and substantially' in Illinois when the 'scraping of facial images' took place elsewhere?
What it makes you log
What the log must hold
Consent or opt-out state
Log retention
This is the destruction schedule the entity's written policy must establish; it governs the biometric data itself, and the Act states no period for keeping the written release.
- Unit
- Years
- As of
- Basis
- Purpose bound
- Maximum value
- 3
- Prohibits retaining
- Biometric identifiers and biometric information once the initial purpose for collecting or obtaining them has been satisfied or 3 years after the individual's last interaction with the private entity, whichever occurs first
Logging duty
The Act names no log. The written release and the written retention policy are records the entity needs in order to show it collected and kept biometric data as the Act allows. Section 20 gives a person aggrieved by a violation a right of action, and no section sets an audit or a regulator's access to the record.
- Kind
- Implicit
- As of
- Provision
- 740 ILCS 14/15(a) and (b): a private entity in possession of biometric identifiers or information must develop a written retention and destruction policy and comply with it, and may not collect a biometric identifier without first informing the subject in writing and receiving a written release executed by the subject
- Trigger
- consent_or_optout
- personal_data_processing
What this law does
Section 15(b) requires a private entity, before it may collect, capture, purchase, receive through trade, or otherwise obtain a person's biometric identifier or biometric information, to inform the subject in writing that the data is being collected or stored, inform the subject in writing of the specific purpose and retention period, and obtain a written release.
Section 10 defines biometric identifier as a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry, expressly excluding photographs and physical descriptions on their own; a scan of face geometry derived from a photograph, rather than the photograph itself, is what the statute reaches.
This is precisely the scraping fact pattern behind Biometric Information Privacy Act (BIPA)'s most consequential litigation: Clearview AI scraped several billion photographs from the open web to construct facial-geometry faceprints without notice or consent, settled a state-court suit in May 2022 (ACLU v. Clearview AI) under a nationwide permanent injunction, and reached a roughly $51.75 million equity-stake class settlement in a parallel federal multidistrict litigation in March 2025.
BIPA carries a private right of action (section 20(a)), under which a prevailing party may recover for each violation liquidated damages of $1,000 or actual damages, whichever is greater, for a negligent violation, or $5,000 or actual damages, whichever is greater, for an intentional or reckless one, plus reasonable attorneys' fees and costs.
The 2024 amendment, P.A. 103-769, effective , added section 20(b)-(c) limiting a private entity to at most one recovery per person per method of collection or disclosure, responding to Cothron v. White Castle System, Inc., 2023 IL 128004 (Ill. 2023), which had held a separate claim accrues each time biometric data is scanned or transmitted.
When LexLint raises it
When your app profile says your app crawls the web, processes biometric data, processes voice recordings or trains models.
Back to the example · Lint your app
Page updated .