Law · Illinois, United States
Illinois Biometric Information Privacy Act (BIPA)
The Illinois Biometric Information Privacy Act of 2008 is the strictest biometric law in the United States and the only major one that lets individuals sue. It requires informed written consent before a private entity collects a scan of face geometry, a retention schedule, and a ban on selling biometric data. A 2024 amendment limited damages to one violation per person per method.
Updated November 6, 2026 · 4 min read · reviewed November 6, 2026
-
2008
BIPA enacted
Passed after the collapse of Pay By Touch, a fingerprint-payment vendor that held biometric data of Illinois residents.
-
2019
Rosenbach v. Six Flags
The Illinois Supreme Court holds that a bare statutory violation is enough to sue; no further harm is required.
-
2021
Facebook settlement
Facebook pays $650 million to settle BIPA claims over photo tag suggestions, the largest consumer privacy settlement at the time.
-
2023
Cothron v. White Castle
The Illinois Supreme Court rules that a claim accrues on every scan, exposing defendants to per-scan damages.
-
2024
Public Act 103-769
The legislature responds: damages accrue once per person per method of collection. Effective 2 August 2024.
-
2026
Clay v. Union Pacific
The Seventh Circuit holds the 2024 amendment applies retroactively to pending cases (1 April 2026).
What does BIPA cover?
BIPA regulates biometric identifiers (a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry) and biometric information derived from them. Photographs are excluded from the definition of identifier, but courts have repeatedly held that a face template computed from a photograph is a scan of face geometry. That distinction is the whole case against face search engines: the picture is not biometric data, the number the engine derives from it is.
A private entity must, before collecting biometric data, tell the person in writing what is collected and why, say how long it will be kept, and obtain a written release. It must publish a retention schedule, destroy data within three years of the last interaction, and never sell, lease or trade biometric data. The law applies to private entities, not to state or local government or their contractors.
Who enforces it?
Nobody in government. BIPA has no regulator and no agency rulemaking. Section 20 gives any person aggrieved by a violation a right to sue, and the plaintiffs' bar has used it heavily: more than 2,000 BIPA suits have been filed since 2015 against employers using fingerprint time clocks, retailers, social networks and technology vendors. Rosenbach v. Six Flags settled that a procedural violation alone confers standing in state court.
What are the penalties?
| Conduct | Per violation | Since August 2024 |
|---|---|---|
| Negligent violation | $1,000 or actual damages | Counted once per person per collection method |
| Intentional or reckless violation | $5,000 or actual damages | Counted once per person per collection method |
| Any violation | Reasonable attorney fees and costs, injunctive relief | Unchanged |
What does it mean for face search?
Illinois is where face search engines have been sued and have retreated. Clearview AI's settlement with the ACLU (ACLU v. Clearview) bars it from selling its database to most private entities nationwide and from serving Illinois government users for five years. The Facebook and Google Photos settlements concerned face templates created from users' own uploads. A consumer engine such as PimEyes, FaceCheck.ID or FaceSearch that computes face templates from public photos of Illinois residents without written consent faces the same theory of liability; several engines geo-block Illinois or state that they do not serve it.
| Situation | BIPA position |
|---|---|
| You upload your own photo to search for yourself | You can consent for yourself; the question is whether the engine's notice and release meet section 15(b). |
| You upload a photo of another Illinois resident | The engine processes a third party's face geometry without that person's consent; the user is rarely a private entity under the Act, the engine is. |
| An engine indexes public web photos of Illinois residents | The core BIPA claim against face search engines: collection of face geometry without notice or release. |
What is pending or unsettled?
- Whether Illinois state courts follow the Seventh Circuit on retroactivity of the 2024 amendment. Clay v. Union Pacific binds federal courts only.
- Whether out-of-state engines with no Illinois presence are subject to the Act; courts have split on extraterritorial reach.
- Bills to add further exemptions or a cure period are introduced most sessions; none had passed as of November 2026.
Questions
Does BIPA apply to a photo of my face?
A photograph itself is excluded from the definition of biometric identifier. A face template computed from the photograph is treated by most courts as a scan of face geometry, which is covered.
Can I sue a face search engine under BIPA?
If you are an Illinois resident whose face geometry was collected without notice and written release, section 20 gives a private right of action. Whether a particular engine is reachable in Illinois courts is contested.
What changed in 2024?
Public Act 103-769 limits damages to one violation per person per method of collection, reversing the per-scan accrual in Cothron. The $1,000 and $5,000 figures did not change.
Is BIPA the only US biometric law with a private right of action?
It is the only broad state biometric statute with one. Texas and Washington rely on their attorneys general, though Washington's My Health My Data Act adds a private action through its consumer protection law.
Sources
- 1.Illinois General Assembly, 740 ILCS 14 Biometric Information Privacy Act (checked November 6, 2026)
- 2.Fisher Phillips, Illinois curtails massive damage awards in biometric cases (Public Act 103-769) (checked November 6, 2026)
- 3.Sidley, Seventh Circuit limits potential damages under BIPA, holds 2024 amendment applies retroactively (checked November 6, 2026)
Entry reviewed November 6, 2026. Found an error? Tell us.
Related entries
- Case Rosenbach v. Six Flags Entertainment Corp. Rosenbach v. Six Flags (2019 IL 123186): a procedural BIPA violation is enough to sue, no further harm needed. The ruling behind Illinois biometric class actions.
- Case Cothron v. White Castle System, Inc. Cothron v. White Castle (2023 IL 128004): a BIPA claim accrues on every scan. The per-scan ruling that triggered the 2024 amendment and a USD 9.4 million settlement.
- Case ACLU v Clearview AI (Illinois BIPA settlement) ACLU v Clearview AI: the 2020 BIPA suit, the 2022 settlement banning sales to private companies, and the federal class action whose settlement was vacated in 2026.
- Law Texas Capture or Use of Biometric Identifier Act (CUBI) Texas CUBI (Bus. & Com. Code 503.001): consent before capturing face geometry, Attorney General enforcement at $25,000 per violation, the Meta and Google deals.
- Law Washington biometric law and the My Health My Data Act Washington's two biometric laws: RCW 19.375 (2017, Attorney General only) and the My Health My Data Act (2023, private right of action), and face search.
- Term Biometric data Biometric data defined: identifying data from a face, fingerprint, iris or voice, when a photo becomes biometric data, and the GDPR, BIPA and DPDP rules.
Cite this entry
FaceSearch Wiki editors. "Illinois Biometric Information Privacy Act (BIPA)". FaceSearch Wiki, updated November 6, 2026. https://facesearch.wiki/laws/us-illinois-bipa/