Illinois Biometric Information Privacy Act (BIPA)

The Illinois Biometric Information Privacy Act (BIPA) is a state law, found at 740 ILCS 14, that regulates how private entities collect, store, share and destroy biometric identifiers such as fingerprints, face geometry scans and voiceprints. It requires a written retention policy and written consent, and it lets people sue for violations. The full text is on the Illinois General Assembly site.

BIPA is not the Illinois Artificial Intelligence Video Interview Act, which is a separate law with its own rules. BIPA also is not limited to technology companies. Employers that collect biometrics from workers fall under it.

What Does BIPA Cover?

BIPA defines a biometric identifier as a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry. Biometric information is any information based on one of those identifiers that is used to identify a person. The definitions leave out writing samples, written signatures and photographs.

The law applies to any private entity, which includes individuals, partnerships, corporations and other groups. The statute sets no minimum company size. It excludes state and local government agencies and courts, and it carves out certain financial institutions, contractors of government agencies and information governed by HIPAA in health care settings.

What Must Employers Do Under BIPA?

Section 15 sets the core duties for any entity that holds biometric data:

• Publish a written policy with a retention schedule and destruction guidelines, destroying data when the original purpose ends or within 3 years of the person's last interaction, whichever comes first
• Before collecting, tell the person in writing that biometrics are being collected, why, and for how long
• Get a written release before collecting, which can be informed written consent, an electronic signature, or an employee's release signed as a condition of employment
• Never sell, lease, trade or otherwise profit from biometric data
• Disclose it only with consent or where the law requires
• Protect it with a reasonable standard of care, at least as strongly as other confidential information

These duties apply before the first scan. Collecting first and asking for consent later does not satisfy the statute.

What Are the Penalties, and What Changed in 2024?

Any person aggrieved by a violation can sue in state court, or bring a supplemental claim in federal court. A prevailing party may recover, for each violation, $1,000 or actual damages, whichever is greater, if the violation was negligent. For an intentional or reckless violation, the amount is $5,000 or actual damages, whichever is greater. The court can also award attorneys' fees, costs and an injunction.

Public Act 103-769, effective August 2, 2024, changed how violations are counted. If an entity collects the same biometric identifier from the same person using the same method more than once, that is a single violation with at most one recovery. A similar rule covers repeated disclosures to the same recipient. Courts have addressed whether this applies to cases filed before the amendment, so check current status.

How Do Time Clocks Create BIPA Risk?

Time clocks are the main HR exposure. A fingerprint reader or a face or hand scanner used to clock in collects exactly the kind of identifier the statute defines. Our biometric time clock entry explains how these devices work and notes the privacy considerations, but it does not name BIPA.

Before an Illinois employee enrolls, give written notice and get a signed release. Post the retention and destruction policy and set a deletion date. Ask any timekeeping vendor how it stores the data, because sharing it with a vendor can count as a disclosure that needs consent.

How Does HR Cloud Fit Into BIPA?

HR Cloud is not a legal compliance product and does not ensure BIPA compliance. Its time tracking page describes clocking in with a button or manual entry, on the web or a mobile device, and an optional IP range restriction. It does not describe fingerprint, face or other biometric clock-in methods.

HR Cloud's e-signature page describes signing and storing documents from any device and tracking when requests were sent, viewed and signed. That could support keeping signed consent forms. HR must still write the notice and policy, decide whether BIPA applies to its workforce, and manage any third-party biometric device it uses.

Discover how our HR solutions streamline onboarding, boost employee engagement, and simplify HR management

Book Your Free Demo

Frequently Asked Questions

Q: Does BIPA apply to employers outside Illinois?

A: The statute states no geographic limit, and courts decide how far it reaches. If you have workers in Illinois, treat BIPA as relevant and ask counsel.

Q: Is a photograph or signature biometric data under BIPA?

A: No. The definitions exclude photographs and written signatures. A scan of hand or face geometry is covered.

Q: Does BIPA apply to government employers?

A: No. The definition of private entity excludes state and local government agencies and courts.

Q: How long can an employer keep biometric data?

A: Only until the original purpose is met or 3 years after the person's last interaction, whichever comes first. The employer must also follow its own published retention schedule.

Q: Can an employer make consent a condition of employment?

A: BIPA's definition of a written release includes, in employment, a release executed by an employee as a condition of employment. The employer must still give the required written notice first.

Q: Can employees sue without a state agency acting first?

A: Yes. BIPA gives any person aggrieved by a violation a right of action in court, so no agency complaint is required.