IL BIPA (2008, first-in-nation biometric law)
Illinois Biometric Information Privacy Act — First-In-Nation Biometric Statute (P.A. 95-994, 2008)
IL · 740 ILCS 14/1 et seq. (P.A. 95-994, 2008; amended P.A. 103-0769, 2024)
- Status
- In effect
- Took effect
- October 3, 2008
- Applies to
- Private entities collecting biometric identifiers or information
- Enforced by
- Private enforcement (no agency action required)
Signed October 3, 2008, the Illinois Biometric Information Privacy Act (BIPA) was the first state biometric privacy law in the United States — and remains the most powerful. Its private right of action and statutory damages ($1,000 negligent / $5,000 intentional per violation) have driven major class-action settlements, including the $650M Facebook face-tagging settlement (2021) and TikTok's $92M consumer-privacy MDL settlement that included BIPA claims (final approval July 28, 2022). 2024 amendment (P.A. 103-0769) limited claims to one accrual per person per collection method. Still in effect 2026.
Who is protected: Illinois residents subject to biometric collection
Legal detail
740 ILCS 14/1 et seq. (P.A. 95-994, Oct. 3, 2008) — first state biometric privacy statute in the U.S. Requires private entities to (1) develop a publicly available written retention/destruction schedule, (2) obtain informed written consent (since 2024 amendment, electronic signatures qualify) before collection of biometric identifiers, (3) destroy biometric data within 3 years of last interaction or when initial collection purpose is satisfied. Private right of action with statutory damages of $1,000 (negligent) / $5,000 (intentional or reckless) per violation, plus attorneys' fees. P.A. 103-0769 (2024) limited recovery to a single accrual per person per collection method. Notable settlements: Patel v. Facebook ($650M, 2021), In re TikTok, Inc. Consumer Privacy Litig., MDL No. 2948 (N.D. Ill.) ($92M settlement fund incl. BIPA claims; final approval July 28, 2022), Cothron v. White Castle (reaffirmed per-scan accrual prior to 2024 amendment).
Key facts
| Jurisdiction | IL |
|---|---|
| Level | State |
| Strength | Stronger |
| Enacted | October 3, 2008 |
| Citation | 740 ILCS 14/1 et seq. (P.A. 95-994, 2008; amended P.A. 103-0769, 2024) |
| Private right of action | Yes, individuals can sue |
| Penalties | $1,000 negligent / $5,000 intentional per violation + attorneys' fees |
| Topics | biometric data · facial recognition · consumer data privacy · consumer protection |
| Statute | 740 ILCS 14 — Illinois General Assembly |
More AI rules in IL
- IL Bar AI Standing Committee · In effect
- IL Digital Voice/Likeness Act · In effect
- IL WOPR (AI therapy ban) · In effect
- IL EO 2024-01 · In effect
- IL AI Video Interview Act (2019, first-in-nation) · In effect
- ACLU v. Clearview AI · In effect
Related biometric data rules elsewhere
- Virginia § 15.2-1723.2 (facial recognition by local law enforcement, eff. July 1, 2026) · In effect
- Bristol VA PD facial recognition program (first VA local agency) · In effect
- Dallas PD Clearview AI facial recognition policy · In effect
- Ban biometric recognition in public accommodations (Ban The Scan) · Proposed / pending
- Limit facial recognition in residential buildings (Ban The Scan) · Proposed / pending
- Texas v. Google · In effect
See something wrong or out of date? Submit a correction. Every entry must carry a verifiable source.