Illinois Biometric Information Privacy Act — First-In-Nation Biometric Statute (P.A. 95-994, 2008)
IL · 740 ILCS 14/1 et seq. (P.A. 95-994, 2008; amended P.A. 103-0769, 2024)
Signed October 3, 2008, the Illinois Biometric Information Privacy Act (BIPA) was the first state biometric privacy law in the United States — and remains the most powerful. Its private right of action and statutory damages ($1,000 negligent / $5,000 intentional per violation) have driven over $1.5B in class-action settlements, including the $650M Facebook face-tagging settlement (2021) and the $725M TikTok settlement (2021). 2024 amendment (P.A. 103-0769) limited claims to one accrual per person per collection method. Still in effect 2026.
Technical detail
740 ILCS 14/1 et seq. (P.A. 95-994, Oct. 3, 2008) — first state biometric privacy statute in the U.S. Requires private entities to (1) develop a publicly available written retention/destruction schedule, (2) obtain informed written consent (since 2024 amendment, electronic signatures qualify) before collection of biometric identifiers, (3) destroy biometric data within 3 years of last interaction or when initial collection purpose is satisfied. Private right of action with statutory damages of $1,000 (negligent) / $5,000 (intentional or reckless) per violation, plus attorneys' fees. P.A. 103-0769 (2024) limited recovery to a single accrual per person per collection method. Notable settlements: Patel v. Facebook ($650M, 2021), TikTok ($92M, 2021; $725M with related state claims), Cothron v. White Castle (reaffirmed per-scan accrual prior to 2024 amendment).
Who is protected: Illinois residents subject to biometric collection
Who must comply: Private entities collecting biometric identifiers or information
Key facts
| Jurisdiction | IL |
|---|---|
| Level | State |
| Status | In effect |
| Protection strength | Stronger protection |
| Effective date | 2008-10-03 |
| Enacted | 2008-10-03 |
| Citation | 740 ILCS 14/1 et seq. (P.A. 95-994, 2008; amended P.A. 103-0769, 2024) |
| Enforced by | Private enforcement (no agency action required) |
| Private right of action | Yes — individuals can sue |
| Penalties | $1,000 negligent / $5,000 intentional per violation + attorneys' fees |
| Topics | biometric data · facial recognition · consumer data privacy · consumer protection |
| Last verified | 2026-06-17 |
| Official source | 740 ILCS 14 — Illinois General Assembly ↗ |
More AI rules in IL
- IL Bar AI Standing Committee · In effect
- IL Digital Voice/Likeness Act · In effect
- IL WOPR (AI therapy ban) · In effect
- IL EO 2024-01 · In effect
- IL AI Video Interview Act (2019, first-in-nation) · In effect
- ACLU v. Clearview AI · In effect
Related biometric data rules elsewhere
- Virginia § 15.2-1723.2 (facial recognition by local law enforcement, eff. July 1, 2026) · In effect
- Ban biometric recognition in public accommodations (Ban The Scan) · Proposed / pending
- Limit facial recognition in residential buildings (Ban The Scan) · Proposed / pending
- Texas v. Google · In effect
- Attorney General Ellison releases consumer alert on DHS' digital surveillance an · In effect
- FTC Commercial Surveillance ANPR · Proposed / pending
See something wrong or out of date? Submit a correction — every entry must carry a verifiable official source.