Illinois Biometric Information Privacy Act, AI Provisions

Applies To

Overview

The Illinois Biometric Information Privacy Act (BIPA), enacted in 2008 as 740 ILCS 14, predates the modern AI era but has become one of the most consequential US privacy statutes for enterprise AI deployments due to its broad definition of biometric data, its private right of action, and its statutory damages structure. BIPA defines 'biometric identifier' to include retina or iris scans, fingerprints, voiceprints, scans of hand or face geometry, and any biometric data derived therefrom. 'Biometric information' is defined separately to include any information based on a biometric identifier used to identify an individual. These definitions directly implicate AI systems performing facial recognition, emotion detection, speaker identification (recognizing who is talking), gait analysis (identifying people by how they walk), and related tasks that draw conclusions from biometric data. BIPA imposes four primary obligations on private entities: (1) a written policy and retention schedule must be publicly available; (2) informed written consent must be obtained prior to collection or possession of biometric data; (3) a prohibition on profiting from biometric data; and (4) restrictions on disclosure to third parties absent consent, legal requirement, or completion of a financial transaction for which the biometric data was provided. The statute provides statutory damages of $1,000 per negligent violation and $5,000 per intentional or reckless violation, plus attorneys' fees, without requiring proof of actual harm, a structure that has generated class action litigation exceeding billions of dollars in aggregate settlements. The Illinois Supreme Court's 2023 decision in Cothron v. White Castle System, Inc. held that a separate claim accrued each time biometric data was collected or transmitted without authorization. Public Act 103-0769, effective 2 August 2024, reversed that going forward. Collecting the same biometric from the same person by the same method more than once is now a single violation, with at most one recovery. The same rule applies to repeated disclosures to the same recipient, and electronic signatures now count as a written release. For AI governance purposes, BIPA intersects with enterprise deployments of facial recognition for physical access control, workforce monitoring AI tools, customer-facing biometric authentication (verifying identity by face, voice, or fingerprint), AI-powered emotion analytics, and systems that detect synthetic media or deepfakes (AI-generated fake images, audio, or video) by processing real biometric inputs. Covered entities must assess whether their AI vendor agreements include adequate data processing terms, whether consent workflows satisfy BIPA's written informed consent standard, and whether biometric retention and destruction schedules are put into practice.

Key Requirements

• •Publish a publicly available written policy establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information
• •Obtain a written release (informed written consent) from individuals before collecting or otherwise obtaining biometric identifiers or information
• •Inform individuals in writing of the specific purpose and length of time for which biometric data is being collected, stored, and used prior to collection
• •Prohibition on selling, leasing, trading, or otherwise profiting from biometric data
• •Prohibition on disclosing biometric data to third parties without written consent, unless disclosure completes a financial transaction requested by the individual, is required by law, or is required by valid warrant or subpoena
• •Permanent destruction of biometric data when the initial purpose for collection is fulfilled or within three years of the individual's last interaction with the covered entity, whichever occurs first
• •Storage, transmission, and protection of biometric data using a reasonable standard of care within the industry, and in a manner at least as protective as confidential and sensitive information

What Your Organization Must Do

• →Inventory every AI system that processes face, voice, iris, fingerprint or gait data of Illinois residents or workers.
• →Publish a written retention and destruction policy for biometric identifiers, and make it publicly available.
• →Collect written informed consent before any biometric capture, stating the purpose and the retention period.
• →Operationalize destruction when the purpose ends or within three years of last interaction, whichever comes first.
• →Review AI vendor contracts for destruction timelines, disclosure limits and a bar on profiting from biometric data.
• →Reassess damages exposure under the 2 August 2024 amendment treating repeated same-method collection as one violation.

Playbook Guidance

Step-by-step implementation guidance for compliance teams.

Frequently Asked Questions

Does Illinois BIPA apply to out-of-state companies that process biometric data of Illinois residents or employees?

Yes. BIPA applies to any private entity that collects, stores, uses, or discloses biometric data of Illinois residents or employees, regardless of where the company is headquartered. A vendor whose platform processes facial geometry or voiceprints of Illinois workers is exposed even if the vendor has no physical presence in Illinois.

What are the statutory damages under BIPA for AI systems that collect biometric data without consent?

BIPA provides $1,000 per negligent violation and $5,000 per intentional or reckless violation, or actual damages if greater, plus attorneys' fees. Since 2 August 2024, repeated collection of the same biometric from the same person by the same method counts as one violation with one recovery.

How did the Cothron v. White Castle ruling change BIPA exposure for AI systems that repeatedly scan biometrics?

In 2023 the Illinois Supreme Court held that each unauthorized scan or transmission was a separate claim. Public Act 103-0769, effective 2 August 2024, overrode that going forward, so repeated scans of one person by one method are one violation.

Does BIPA require written consent before an AI facial recognition or voiceprint system captures data, or can consent be obtained after the fact?

Consent must come before collection. The entity must tell the person in writing that biometric data is being collected, why, and for how long, and get a written release. Disclosure to third parties is covered separately and needs its own consent.

What BIPA obligations apply specifically to AI vendors and SaaS providers processing biometric data on behalf of Illinois clients?

Vendors that possess or process biometric data on behalf of clients are subject to BIPA's prohibition on profiting from that data, third-party disclosure restrictions, and security standards at least as protective as those applied to confidential information. Data processing agreements should explicitly address destruction timelines, disclosure limits, and the prohibition on biometric data monetization.

How does BIPA's biometric data destruction requirement apply to AI systems with ongoing or indefinite data retention?

BIPA requires permanent destruction of biometric identifiers and information when the original collection purpose is fulfilled or within three years of the individual's last interaction with the entity, whichever comes first. AI systems with indefinite or rolling retention schedules are non-compliant unless a documented destruction protocol is operationalized and enforced.