Illinois. Biometric. Act

BIPABiometric Information Privacy Act (740 ILCS 14)

In force

§1Summary

Synopsis

Requires private entities to publish a biometric retention and destruction policy, give written notice and obtain a written release before collecting biometric identifiers, and bars sale of biometric data.

Key themes

biometric identifiers
written release
retention schedule
sale prohibition
private right of action

Unique features

Private right of action with liquidated damages has produced large class actions; 2024 amendment ended per-scan damages accrual.

SaaS relevance

Workforce, identity verification, voice and face-analysis SaaS processing Illinois residents' biometrics face direct class action exposure, including as vendors.

§2Obligations

Extraterritorial: Limited
Breach notification: None
DPO: No
Cross-border transfers: None
Maximum penalty: $1,000 per negligent violation; $5,000 per intentional or reckless violation (per person after 2024 amendment)

§3Dates

Key dates

Adopted 3 October 2008
In force 3 October 2008
SB 2979 signed 2024-08-02: one recovery per person per collection method, and electronic signatures valid for written release.

§4Text and authority

Text

Authoritative text ilga.gov

Authority

Private litigants (courts); Illinois Attorney General

§5Where it applies

Domestic law of: Illinois

§6Sources and verification

Verification

High confidence.

Retroactivity of 2024 amendment litigated in courts.