BIPA
Illinois' Biometric Information Privacy Act, a 2008 law that lets people sue companies that collect fingerprints, face scans or voiceprints without written consent.
Also called: Illinois Biometric Information Privacy Act, biometric privacy law
Illinois' Biometric Information Privacy Act, a 2008 law that lets people sue companies that collect fingerprints, face scans or voiceprints without written consent.
What it means
BIPA is the Illinois Biometric Information Privacy Act, enacted in 2008. It covers biometric identifiers: retina or iris scans, fingerprints, voiceprints, and scans of hand or face geometry. Before a private company collects one, it must tell you in writing what it is collecting, why, and for how long. It must also get your signed written release.
What sets BIPA apart is that you can sue. A person whose rights were violated can recover $1,000 for a negligent violation or $5,000 for an intentional or reckless one. Actual damages count if they are higher. A prevailing party can also recover attorneys' fees. The Illinois Supreme Court has held that you do not have to show any harm beyond the violation itself.
In 2024 Illinois changed the law. Repeated collection of the same biometric from the same person by the same method now counts as one violation, with at most one recovery. In April 2026 a federal appeals court held that this change applies to cases already pending.
What it means for you
BIPA is why Illinois residents sometimes get more than other people in privacy settlements. Class definitions turn on whether you lived in, or were in, Illinois when a company scanned your face, finger or voice. Some settlements pay Illinois members a larger share. Common triggers are a workplace fingerprint clock, a photo-tagging or filter feature, and a face-scan app. Check the dates and location in the class definition. Final payments depend on the fund size and the number of claims, not on the $1,000 figure.
Example
Say a hypothetical gym has members scan a fingerprint at the front desk but never gives written notice, a retention policy or a consent form. A member in Illinois could bring a BIPA claim, and others in the same position could join a class action. If the gym settles, the notice might offer an equal share of a fund to Illinois members who used the scanner during a set period. People outside Illinois might get a smaller share or none, depending on the class definition.
FAQ
The law sets $1,000 for a negligent violation and $5,000 for an intentional or reckless one. Settlements pay far less per person, because the fund is shared and fees and costs come out first. Your payment depends on the specific settlement.
BIPA is an Illinois law, so claims usually depend on where the scan happened or where you lived. Some settlements cover users nationwide and pay Illinois residents more, so read the class definition.
Related terms
- Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186 (Illinois Supreme Court)
- Clay v. Union Pacific Railroad Co., No. 25-2185 (7th Cir. Apr. 1, 2026)
Updated Oct 18, 2026. Plain-English definitions for general information — not legal or tax advice.