Illinois biometric privacy: BIPA

BIPA protects people whose biometric identifiers or biometric information are collected, kept or disclosed by a private entity. A biometric identifier is a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry. Biometric information is information based on such an identifier and used to identify an individual.

Photographs, written signatures, physical descriptions and demographic data are excluded. Whether a face template made from a photo counts as a scan of face geometry depends on the facts and on how a court reads these definitions.

The Act does not apply to state or local government agencies, to their contractors when working for them, or to financial institutions subject to Title V of the Gramm-Leach-Bliley Act. Its text does not name Illinois residency as a condition, and whether it reaches conduct outside Illinois is decided by courts on the facts.

• Notice and consent. Before collecting, a private entity must tell you in writing what is being collected, the specific purpose and how long it will be kept, and receive your written release.
• No sale. It may not sell, lease, trade or otherwise profit from your biometric data.
• Limited disclosure. It may not disclose the data without your consent, with narrow exceptions such as a legal requirement, warrant or subpoena.
• Destruction. It must publish a retention schedule and permanently destroy the data when the purpose is satisfied or within 3 years of your last interaction, whichever comes first.

BIPA does not create a right to access or deletion on request in the way the CCPA and GDPR do. It works through duties on the collector and your right to sue.

There is no official form. These steps are practical, not statutory.

1. 1.Ask the company in writing whether it holds your biometric data, and for its public retention policy.
2. 2.Withdraw consent and ask for destruction in writing. Keep copies.
3. 3.Speak to a lawyer licensed in Illinois about whether you have a claim.

The only time limit applies to the collector: destruction within 3 years of your last interaction, or sooner. BIPA sets no deadline for answering an individual's letter and names no regulator to complain to.

Section 20 gives any person aggrieved by a violation a right of action in state court, or as a supplemental claim in federal court. A prevailing party may recover liquidated damages of $1,000 for a negligent violation or $5,000 for an intentional or reckless one, or actual damages if greater, plus attorneys' fees, costs and other relief such as an injunction. In Rosenbach v. Six Flags (2019), the Illinois Supreme Court held that no actual injury beyond the violation of rights under the Act is needed.

Since 2 August 2024, collecting the same biometric data from the same person by the same method more than once is a single violation with at most one recovery. In April 2026 the federal Seventh Circuit held in Clay v. Union Pacific that this limit also applies to cases pending when it was enacted. The Illinois Supreme Court has the final word on state law, so this may change.

In 2020 the ACLU sued Clearview AI under BIPA over its database of faceprints. The 2022 settlement, entered as a consent order, permanently bars Clearview from making that database available to most businesses and other private entities nationwide.

BIPA does not mention AI training or model weights. A court may grant an injunction, but whether an order would reach a trained model depends on the case.

No one can remove a person from a trained AI model on request. What can change is the biometric data a company still stores and what it collects next.