What is bipa (illinois biometric information privacy act)?

BIPA is a 2008 Illinois law requiring companies to get written consent before collecting biometric identifiers such as fingerprints or facial scans, and to follow specific retention and disclosure rules, with statutory damages of $1,000 to $5,000 per violation. It generated some of the largest class action exposure of any U.S. privacy statute before Illinois amended it in 2024 to limit damages.

This area of law is changing. The description below reflects the position as of 2026-08-22. Check the sources before relying on it.

The 2024 amendment capped recovery at one violation per person per method of collection, rather than one violation per individual scan — sharply reducing potential damages in cases involving repeated scans, such as workplace fingerprint timeclocks. In April 2026, the Seventh Circuit held in Clay v. Union Pacific Railroad Co. that this amendment applies retroactively to cases already pending when it passed, which significantly lowered exposure in ongoing BIPA litigation; whether other circuits or the amendment's application will be revisited further remains to be seen.

Last reviewed 2026-08-22.