The Illinois Biometric Information Privacy Act, commonly known as BIPA, has become one of the most influential privacy laws in the United States. Enacted in 2008, the law regulates how private companies collect, store, and use biometric identifiers such as fingerprints, facial scans, and iris scans.
In recent years, BIPA has generated some of the largest privacy related settlements in the country, with several cases resulting in payouts totaling hundreds of millions of dollars. For plaintiffs’ attorneys, the law continues to represent one of the most significant developments in biometric privacy litigation.
What Makes BIPA Different
Unlike many privacy laws, BIPA does not require plaintiffs to prove that they suffered actual financial harm or identity theft.
Instead, plaintiffs generally need to show that a company collected, captured, stored, or disclosed biometric information without complying with the law’s notice and consent requirements.
Before collecting biometric identifiers, companies are generally required to inform individuals in writing, explain the purpose and duration of the collection, and obtain written consent. Failure to follow these requirements can expose businesses to significant liability.
This framework has made BIPA a powerful statute for class action litigation.
Significant Statutory Damages
One of the reasons BIPA cases can produce substantial settlements is the law’s statutory damages provision.
The statute allows for damages of $1,000 for each negligent violation and $5,000 for each reckless or intentional violation. Because biometric data may be collected repeatedly over time, potential damages can increase quickly when large groups of employees or consumers are involved.
In Cothron v. White Castle System, Inc., the Illinois Supreme Court ruled that a separate claim may accrue each time biometric data is collected or transmitted without complying with BIPA. Although the Illinois legislature later amended the law to clarify that multiple collections from the same individual generally count as a single recoverable violation going forward, the decision highlighted the significant exposure companies can face under the statute.
Industries Facing Litigation
BIPA litigation extends well beyond technology companies.
Employers that use fingerprint time clocks have faced numerous lawsuits alleging that employees were not provided the required disclosures or written consent before biometric information was collected.
Retailers and entertainment venues using facial recognition technology have also been sued under the law, as have mobile applications that collect facial geometry for photo editing, identity verification, or image filtering.
As biometric technology becomes more common across industries, compliance has become an increasingly important consideration for businesses operating in Illinois.
Lessons for Businesses and Attorneys
BIPA demonstrates how privacy laws can create substantial legal exposure even when there is no allegation that personal information was stolen or misused.
For businesses, the law underscores the importance of implementing clear biometric privacy policies and obtaining proper consent before collecting biometric information.
For plaintiffs’ attorneys, BIPA continues to serve as an example of how statutory privacy protections can drive significant class action litigation and shape broader discussions around consumer data rights.
Follow RapidFunds for More Legal News and Insights
Stay informed on emerging privacy laws, class action litigation, and developments affecting plaintiffs’ attorneys by following RapidFunds on LinkedIn.
If your firm is litigating complex privacy or class action matters that may involve extended timelines before attorney fees are distributed, contact RapidFunds to learn how post settlement funding can provide financial flexibility while your cases move toward resolution.