All regulations / US Privacy
Illinois BIPA
Know the rule before it knows you.
Written consent before any fingerprint, face or voice data, with a private right of action.
What it is
BIPA requires informed written consent before collecting biometric identifiers from Illinois residents, a public retention and destruction schedule, and bans selling biometric data. Its private right of action produced some of the largest privacy settlements in the US.
This applies to you if
- You use face recognition, fingerprint, voiceprint or similar features for Illinois users or employees
- You train or offer AI models on biometric data from the US
What it asks of you
- Written notice and release before collection; public retention policy
- Reasonable security; no sale; destruction when the purpose ends
What it costs to ignore
Statutory damages per person (amended in 2024 to count per person rather than per scan), class actions.
Key dates
In force since 2008; amended August 2024.
How we help
Not sure which apply to you? Send us three lines about what you sell and to whom, and we will tell you which rules matter and which do not.
Have a regulatory question?
Send a short description of your situation. We reply within one working day, usually with a view on scope and a fixed fee where possible.