Law / United States / 
Illinois
BIPA Private Right of Action and 2024 Damages Amendment (SB 2979 / P.A. 103-0769)
740 ILCS 14/20, as amended by P.A. 103-0769 (SB 2979), eff.
In force since .
An enforcement supervision rule binding private bodies.
- Obligation class
- Biometric
- Audit expectation
- none
What it requires
- Expect a private right of action for any Biometric Information Privacy Act (BIPA) violation, carrying statutory damages of $1,000 for a negligent violation or $5,000 for an intentional or reckless violation, or actual damages if greater, plus attorneys' fees and litigation costs.
- Treat repeated collection or disclosure of the same biometric identifier from the same person by the same method as a single violation carrying at most one recovery, including for conduct that predates .
These lines are LexLint's reading of the law's text. Also read by: Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186 (recorded ).
If you get it wrong
Criminal exposureNo
Private right of actionYes
Statutory damages
740 ILCS 14/20(a): liquidated damages of $1,000 or actual damages, whichever is greater, for a negligent violation, and $5,000 or actual damages, whichever is greater, for an intentional or reckless violation, plus reasonable attorneys' fees and costs. These are floors, not caps, and they are the Act's only monetary remedy: BIPA states no civil penalty and names no regulator. Since the 2024 amendment (P.A. 103-0769), repeated collection of the same biometric identifier from the same person by the same method is one violation carrying at most one recovery (section 20(b)), and repeated disclosure of it to the same recipient is likewise one violation (section 20(c)), so the figures read per person per collection method, with a disclosure to a different recipient counting separately; the Seventh Circuit applied the amendment retroactively in Clay v. Union Pacific Railroad Co. (2026).
- As of
- Currency
- USD
- Per person reckless
- 5,000
- Per person negligent
- 1,000
Who enforces it
Enforcement body
Exclusively private civil actions under the Section 20 right of action; no regulator or Attorney General enforcement role for a BIPA violation.
Settledness
- As of
- Case link
- https://www.illinoiscourts.gov/Resources/f71510f1-fb2a-43d8-ba14-292c8009dfd9/123186.pdf
- Case citation
- Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186
- Open questions
- Does section 20(b) and (c) apply to a claim pending on , when Public Act 103-0769 says only that it 'takes effect upon becoming law'?
- Which biometric collections use 'the same method of collection' under section 20(b), for example whether a fingerprint scan at a time clock and a fingerprint scan at a door reader are one method or two?
What it makes you log
Logging duty
Section 20 gives a person aggrieved by a violation a right of action in state circuit court or as a supplemental claim in federal court, with liquidated damages of $1,000 for a negligent and $5,000 for an intentional or reckless violation, fees and injunctive relief, and the 2024 amendment limits recovery to one per person for repeated collection or disclosure. It names no record, log or audit and gives no court or regulator a standing right to a record. The amendment text does not state a territorial test.
- Kind
- None
- As of
What this law does
Arms any person aggrieved by a Biometric Information Privacy Act (BIPA) violation with a private right of action in state circuit court or as a supplemental federal claim, recovering the greater of $1,000 or actual damages for a negligent violation and the greater of $5,000 or actual damages for an intentional or reckless violation, plus attorneys' fees, costs, and injunctive relief.
The Illinois Supreme Court held a claim accrues with each scan or disclosure (Cothron v. White Castle, 2023) under one uniform five-year limitations period for every Section 15 claim (Tims v. Black Horse Carriers, 2023); a 2024 amendment then capped recovery at one award per person per collection or disclosure method, responding directly to Cothron's invitation to the legislature to revisit the resulting damages exposure.
The Seventh Circuit held in 2026 that the cap is a remedial change to available damages, not a substantive change to BIPA's liability standard, so it applies retroactively to cases already pending when the amendment took effect (Clay v. Union Pacific Railroad Co., 2026).
How courts have read itPremium data
Our analysis of this law draws on 2 court rulings.
What each ruling held, what it means for an app, and whether it still stands are premium data, in the Plus, Pro and Enterprise plans.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .