BIPA

The Illinois Biometric Information Privacy Act has governed biometric identifiers since 2008: fingerprints, retina or iris scans, voiceprints, and scans of hand or face geometry. Before collecting any of them, a private entity must tell the person in writing what is being collected, why, and for how long, and obtain a written release. It must publish a retention schedule and destruction policy, and it may not sell or otherwise profit from the data. What sets BIPA apart is its private right of action: $1,000 per negligent violation and $5,000 per intentional or reckless one, plus attorneys' fees. A 2024 amendment limited recovery to one violation per person rather than one per scan, but the exposure remains large for any website, app, or kiosk using face or voice recognition, virtual try-on, or identity verification, often through a third-party SDK nobody inventoried.