Illinois Biometric Information Privacy Act (BIPA)

In forceIllinois BIPA

Summary

BIPA requires informed written consent before collecting biometric identifiers (face, fingerprint, voice, iris) from people in Illinois, and a public policy with retention and destruction schedules. It is the most litigated biometric law in the US because any affected person can claim statutory damages.

Who it applies to

Private businesses that collect, use or store biometric data of people in Illinois, including employees and customers.

Penalties

Statutory damages of $1,000 per negligent violation and $5,000 per intentional or reckless violation, plus fees; since 2024 they accrue per person rather than per scan.

Official name: Biometric Information Privacy Act (740 ILCS 14)
Official reference: 740 ILCS 14; enmendada por SB 2979 (2024)
Regulator: Courts (private right of action)
Official source: Check the sourceHow we verify sources

Key dates

October 3, 2008Effective date
August 2, 2024Amendment limiting accrual of damages

Obligations and dates

Obligations table
Obligation	Article or citation	Status	Date	Who it applies to	Verification
Written consent before collecting biometric data	740 ILCS 14/15(b)	In force	Already applicable	Applies if you collect face, fingerprint, voice or other biometric identifiers from people in Illinois.	Pending confirmation in the official source (last checked: November 4, 2026)
Public biometric retention and destruction policy	740 ILCS 14/15(a), (e)	In force	Already applicable	Applies to anyone holding biometric data of people in Illinois.	Pending confirmation in the official source (last checked: November 4, 2026)

Public biometric retention and destruction policy

740 ILCS 14/15(a), (e)In force

Already applicable

When it relates: Applies to anyone holding biometric data of people in Illinois.
What the rule provides: Publish a policy with retention and destruction schedules.
Destroy the data when the purpose is fulfilled or three years after the last interaction, whichever comes first.
Protect them at least as well as other confidential data.
Typical evidence: Published policy and destruction records
Related base documents: Public Biometric Data Retention and Destruction Policy
Supporting documents: Data Governance Guidelines for AI
AI Security Baseline
Verification: Pending confirmation in the official source (last checked: November 4, 2026)ilga.gov refused the connection on Nov 4, 2026, so the official text is still unchecked. The public policy, the three-year limit and the standard of care still have to be confirmed in 740 ILCS 14/15(a) and (e); content based on general knowledge of the law.