Illinois's Biometric Information Privacy Act (BIPA) still lets people sue for $1,000 per negligent violation and $5,000 per intentional or reckless violation, but since the Seventh Circuit's April 1, 2026 decision in Clay v. Union Pacific Railroad, repeated scans of the same person by the same method count as one recovery, even in cases that were already pending on August 2, 2024. The ruling cuts damages, not duties: the written policy, written release and no-sale rules are unchanged, and the Illinois Supreme Court has not ruled on retroactivity. New 2026 filings against Apple over iris and retinal data, and nine AI voiceprint class actions, show that plaintiffs are moving beyond time clocks.
BIPA at a glance
BIPA (740 ILCS 14) was enacted in 2008 and took effect on October 3, 2008, according to Vaquill's review of the statute. It covers any "private entity," which excludes government agencies and Illinois courts. It has no small-business exemption.
| Provision | What it requires or allows |
|---|---|
| Section 10, definitions | Biometric identifiers are retina or iris scans, fingerprints, voiceprints and scans of hand or face geometry. Photographs, signatures and writing samples are excluded. |
| Section 15(a), written policy | A public written policy with a retention schedule. Data must be destroyed when its purpose is met or within 3 years of the person's last interaction, whichever comes first. |
| Section 15(b), notice and release | Before collecting, tell the person in writing what is collected, why and for how long, and get a written release. Since August 2, 2024, an electronic signature counts. |
| Section 15(c), no sale | No selling, leasing, trading or otherwise profiting from biometric data. |
| Section 15(d), disclosure | No disclosure without consent, apart from narrow exceptions such as legal process. |
| Section 15(e), security | Store and protect the data with the standard of care in your industry. |
| Section 20, enforcement | Any aggrieved person can sue. A prevailing party recovers $1,000 (negligent) or $5,000 (intentional or reckless), or actual damages if higher, plus attorneys' fees and costs. |
Three Illinois Supreme Court decisions still shape every case:
- Rosenbach v. Six Flags, 2019 IL 123186 (January 25, 2019): a person does not need to allege harm beyond the violation itself to count as "aggrieved."
- Tims v. Black Horse Carriers, 2023 IL 127801 (February 2, 2023): a five-year limitations period applies.
- Cothron v. White Castle, 2023 IL 128004 (February 17, 2023): a claim accrued with every scan or transmission. The legislature responded in 2024, as the next section explains.
The 2024 amendment: one recovery per person
Governor Pritzker signed SB 2979 on August 2, 2024. It became Public Act 103-0769 and added two rules to Section 20. A business that collects the same biometric identifier from the same person using the same method has committed a single violation with at most one recovery. The same applies to repeated disclosure to the same recipient. The amendment also confirmed that an electronic signature satisfies the written release.
The cap has limits that are easy to miss:
- It covers collection (Section 15(b)) and disclosure (Section 15(d)) only. Claims over a missing retention policy, sale of data or weak security sit outside it.
- Everything has to match. A fingerprint clock plus a face-scan door entry are two methods, so they may still stack.
- Sending the same template to three different recipients is three disclosures.
Clay v. Union Pacific: the amendment applies to pending cases
The amendment said nothing about lawsuits already in court. On April 1, 2026, a unanimous Seventh Circuit panel closed that gap in Clay v. Union Pacific Railroad Co., No. 25-2185, 2026 WL 891902 (7th Cir. Apr. 1, 2026). It consolidated three interlocutory appeals from the Northern District of Illinois: Clay (No. 25-2185), Willis v. Universal Intermodal Services (No. 25-2761) and Gregg v. Central Transport (No. 25-2762). It reversed three district court rulings that had treated the amendment as prospective only.
The court held that the amendment is remedial, so Illinois law applies it to cases pending when it was enacted. Two points drove the reasoning:
- The legislature changed Section 20, which sets damages, and left Section 15, which sets the duties, untouched.
- The words "at most, one recovery" confirm that BIPA's $1,000 and $5,000 figures are ceilings, not guaranteed awards.
The stakes were concrete. Reginald Clay alleged about 1,500 fingerprint scans, which at $5,000 each would have meant $7.5 million for one person. The Willis putative class exceeded 2,800 people, which the plaintiffs framed as a claim for billions.
What Clay does not settle
- State courts. The Seventh Circuit predicted how the Illinois Supreme Court would rule. It did not decide the question for Illinois state courts. Shook, Hardy & Bacon reports that several state courts had held the amendment prospective, and we found no Illinois Supreme Court ruling.
- Later-filed cases. Clay concerns suits pending on August 2, 2024. Vaquill notes it does not say what happens to a suit filed afterward over earlier scans.
- Judicial discretion. A Cozen O'Connor attorney told Law360 that the next fight is over what "at most" means and how judges should exercise that discretion.
Our Illinois AI law guide summarizes the 2024 amendment in one paragraph. This article goes further on how courts are treating it.
Salinas: staffing agencies are not automatically collectors
On January 30, 2026, the Illinois Appellate Court, Third District, decided Salinas v. Arthur Schuman Midwest, LLC (cited as 2026 IL App (3d) 250239 in coverage we read). Two temporary workers at a cheese plant in Elgin scanned their fingerprints on time clocks the plant leased from a payroll vendor. The staffing agencies had enrolled them and could fix time records, but could not access the fingerprints.
The court held that Section 15(b) "regulates acquisition of biometric data; not proximity to it." Facilitating another entity's collection did not make the agencies collectors, and summary judgment for them stood. The ruling helps intermediaries that never hold the data. It does not help the business that runs the clock or holds the data.
Settlements and cases to watch
Most 2026 settlements are still moving through approval, so treat the amounts below as pending unless noted.
| Case | Amount | Alleged conduct | Status on October 27, 2026 |
|---|---|---|---|
| Deyerler v. HireVue (No. 2026LA00000141) | $3.75M | Voice and face data in AI video interviews, for people interviewed in Illinois from January 27, 2017 to June 25, 2026 | Final approval hearing October 28, 2026. Claim deadline of October 13 has passed. |
| Melzer v. Kenvue (D.N.J. No. 3:22-cv-03149) | $4.7M | Facial geometry from the Neutrogena Skin360 skin-analysis tool | Opt-out deadline November 10, claims November 25, hearing December 17, 2026 |
| Tapia-Rendon v. WorkEasy | $1,685,000, paid over five years | Fingerprint templates from a vendor's cloud time clocks, 21,915 class members | Preliminary approval reported by Bloomberg Law |
| Franchini v. Accu-Time Systems | $1.5M | Fingerprints on a vendor's time clocks, August 29, 2016 to September 15, 2025 | Final approval hearing was set for April 1, 2026. We could not confirm the outcome. |
| Brewer v. JustPlay (Sangamon County, No. 2025LA000230) | $4.5M | Face scans for identity verification in a gaming app | Claim deadline was March 16, 2026. We could not confirm final approval. |
Two patterns stand out. WorkEasy and Accu-Time are vendors that were sued by their clients' employees, so buying a time clock does not move the risk off your books. The Kenvue settlement also requires deleting the collected facial images, building a written consent form and adopting a written retention policy, which is a ready-made list of what plaintiffs expect.
The HireVue hearing is tomorrow. Class counsel may seek up to one-third of the fund, and the estimated payment is about $150 per claimant.
Apple and Face ID eye scans
Mettler v. Apple Inc., No. 1:26-cv-07825 (N.D. Ill.), was filed on Saturday, July 4, 2026. It alleges that Face ID captures iris and retinal scans, that Apple discloses facial geometry but not eye scans, that attention-aware features keep tracking eye position, and that Apple gave no written notice, retention schedule or consent. The complaint also alleges the data trains Apple's algorithms. Apple has said Face ID data stays in the device's Secure Enclave. The allegations are unproven and no class has been certified.
AI voiceprint suits
In mid-May 2026, Illinois journalists, podcasters and voice actors filed nine BIPA class actions in Chicago federal court. They allege that companies including Google, Amazon, Apple, Microsoft, Meta and NVIDIA extracted voiceprints from public audio to train AI voice models without consent. These cases test whether training data can be biometric data. They are at the pleading stage, and we found no ruling.
Is BIPA the only biometric law with a private right of action?
For dedicated state biometric statutes, yes. Texas and Washington have their own, and neither lets individuals sue. The wider picture is less tidy.
- Texas (CUBI): enforced by the Attorney General. Texas obtained a $1.4 billion settlement from Meta, announced July 30, 2024, in a case brought under CUBI and the Deceptive Trade Practices Act.
- Washington (RCW 19.375): says it "may be enforced solely by the attorney general." It covers enrollment of biometric identifiers for a commercial purpose and excludes photographs and audio or video recordings.
- Washington My Health My Data Act: its definition of consumer health data includes biometric data, and a violation is a Consumer Protection Act violation under RCW 19.373.090. Our Washington AI law guide covers how that opens private suits.
- New York City: a 2021 ordinance on biometric data at commercial establishments reportedly includes a private right to sue. We could not read the code text.
- Comprehensive state laws: these treat biometric data as sensitive data, and Colorado added biometric rules effective July 1, 2025, reportedly enforced by state officials only. Our state privacy law tracker lists the 19 states with active laws.
Illinois still concentrates the litigation, because a biometric violation there can be a class action with fee shifting. If you need the plain definitions behind these terms, see our PII vs personal data vs sensitive data guide.
What BIPA does not cover
- Health care information. Information captured from a patient in a health care setting, or collected for treatment, payment or operations under HIPAA, is excluded. In Mosby v. Ingalls Memorial Hospital, 2023 IL 129081, the Illinois Supreme Court applied that exclusion to health care workers' finger scans used for those purposes.
- Financial institutions. Section 25 exempts institutions subject to Title V of the Gramm-Leach-Bliley Act.
- Government work. Section 25 exempts contractors working for a state or local agency. Courts are split on whether that is a pure timing test, and a Seventh Circuit appeal on the point was argued in February 2026, according to a Seyfarth practice guide.
- BIPA is not the Illinois AI employment law. HB 3773 covers AI in employment decisions and is a separate statute. Our Illinois AI law guide covers it. BIPA applies whether or not AI is involved.
For a narrower look at headsets and smart glasses, read our VR and AR biometric consent guide. For facial data in consumer apps, see our TikTok Shop facial data analysis.
What to do now
- Map every biometric touchpoint for Illinois residents. Include time clocks, door access, video interview tools, face filters and voice features, and the vendors behind them.
- Publish a retention and destruction policy, then follow it. Section 15(a) is a separate duty from consent, and the 2024 cap does not reach it.
- Get the release before the first scan. A signature collected after collection does not cure the earlier scan. Electronic signatures are valid.
- Check what each vendor holds. WorkEasy and Accu-Time show that vendors get sued, and Salinas shows that holding the data is what matters.
- Do not treat Clay as a reason to relax. It limits recovery per person, but a class of thousands still carries real exposure, and the question is open in state court.
- Watch the new theories. Eye tracking, attention features and voice AI are where 2026 suits are focused.
Our AI governance guide covers how to register AI systems and vendors that process biometric data.
Compliance checklist
▢ Inventory of biometric systems, owners and Illinois data subjects
▢ Public written policy with retention schedule and destruction rules
▢ Written notice naming the data, purpose and length of term
▢ Written release, including electronic signature, obtained before the first scan
▢ Employee time clocks covered, with the release collected at onboarding
▢ Video interview, facial recognition and voice tools reviewed with vendors in writing
▢ Vendor contracts with consent, retention, deletion and indemnity terms
▢ No sale or profit from biometric data, and consent before any disclosure
▢ Security measures at least as strong as for other sensitive data
▢ Destruction logs kept, and data deleted within 3 years of last interaction
FAQ
Is BIPA the same as Illinois's AI employment law?
No. BIPA (2008) regulates biometric identifiers whether or not AI is used. Illinois HB 3773 is a separate 2024 law on AI in employment decisions.
Can individuals sue directly under BIPA?
Yes. Section 20 gives any aggrieved person a right of action, and the Illinois Supreme Court held in Rosenbach that no harm beyond the violation is needed. Texas and Washington's dedicated biometric laws are enforced by their attorneys general.
Did Clay v. Union Pacific end BIPA damages?
No. It limits recovery to one per person for repeat collection or disclosure by the same method and applies that limit to cases pending on August 2, 2024. The $1,000 and $5,000 statutory amounts remain, and duties under Section 15 are unchanged.
Has the Illinois Supreme Court said the 2024 amendment is retroactive?
Not in any ruling we found. Clay is a federal appeals court prediction of Illinois law, and Illinois state courts are not bound by it.
How long do plaintiffs have to sue under BIPA?
Five years, under Tims v. Black Horse Carriers (2023). The limit applies to claims under the whole of Section 15.
Does BIPA apply to consumer products like Face ID?
It can. Mettler v. Apple, filed July 4, 2026, alleges Face ID captures iris and retinal scans without written consent. The claims are allegations, and no court has ruled on them.
Do staffing agencies face BIPA liability for client time clocks?
Not automatically. Salinas held that Section 15(b) reaches entities that acquire biometric data, not those that only enroll workers. The decision is from one appellate district and does not protect the business that runs the clock.
What is the status of the HireVue settlement?
HireVue agreed to pay $3.75 million, and the final approval hearing is set for October 28, 2026. The exclusion deadline of September 28 and the claim deadline of October 13 have passed.
Secure Privacy's Vendor Management module keeps a centralized register of vendors and processors and tracks their contracts and data processing agreements, which helps when a time clock or interview tool holds biometric data for you. This is general information, not legal advice.
