BIPA Requirements: The Five Duties and the Proof for Each

BIPA gives every Illinois business that scans a fingerprint, face, hand, iris, or voice five duties. All five sit in section 15. Each one comes down to a record you can produce.

I read the statute and the two cases that reset its damages, then wrote down each duty with the proof it takes. The reason to care is enforcement. Texas and Washington leave their biometric laws to the attorney general. BIPA lets the person you scanned sue you directly.

That is why the settlements people know were brought under Illinois law: $650 million in In re Facebook Biometric Information Privacy Litigation, No. 15-cv-03747 (N.D. Cal.), and $92 million in In re TikTok Consumer Privacy Litigation, MDL No. 2948 (N.D. Ill.). This is an explainer, not legal advice. Have Illinois counsel check your setup.

The five duties, in one list

The Biometric Information Privacy Act, 740 ILCS 14, took effect in 2008. It covers biometric identifiers, which the Act defines as "a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry." Section 15 carries the duties:

• 15(a): a written retention and destruction policy, available to the public.
• 15(b): written notice and a signed release from each person, before collection.
• 15(c): no selling, leasing, or otherwise profiting from biometric data.
• 15(d): no disclosure to anyone else without consent or a legal trigger.
• 15(e): protect the data with reasonable care, at least as carefully as your other confidential information.

Everything else in the Act, from definitions to damages, serves those five.

Who BIPA covers, and the exemptions people get wrong

BIPA applies to any "private entity," which the Act defines as "any individual, partnership, corporation, limited liability company, association, or other group, however organized" (740 ILCS 14/10). That means employers with a fingerprint time clock, gyms with a fingerprint entry pad, and retailers running face matching. The same definition leaves out "a State or local government agency" and the Illinois courts.

The exemptions are narrower than people assume:

• Health care, 740 ILCS 14/10. Biometric identifiers "do not include information captured from a patient in a health care setting or information collected, used, or stored for health care treatment, payment, or operations under" HIPAA. That covers patient data. A fingerprint time clock for the hospital's own staff is a separate question for counsel.
• Financial institutions, 740 ILCS 14/25(c). The Act does not apply to "a financial institution or an affiliate of a financial institution" subject to Title V of the Gramm-Leach-Bliley Act. A bank's unaffiliated vendor is not named.
• Government contractors, 740 ILCS 14/25(e). A contractor, subcontractor, or agent of a state agency or local government is outside the Act "when working for that State agency or local unit of government." The same company working for a private client is back in scope.

Being a small business is no exemption. Neither is using a vendor. If the scanner belongs to your timekeeping provider but your employees' fingerprints flow through it for you, you are in scope.

Section 15(a): the public retention and destruction policy

The first duty exists before you scan anyone. Here is the text:

Read it closely and two gaps show. The statute says "made available to the public" and never says where. An internal PDF on a shared drive fails those words; a page on your site meets them.

The three-year clock also runs from the person's "last interaction," a phrase the Act never defines. For an employee, the cautious reading is the last day of work. A former employee whose template is still on the clock two years after leaving is a live 15(a) question.

What you would produce: the dated policy, proof of where it was published, and a destruction log showing templates actually deleted on schedule. A policy with no deletion record is half a defense.

Section 15(b): informed written consent, before collection

This duty generates most of the litigation, because the order of events is fixed. The statute says "first":

A release signed in month three does not reach back to cover month one. The Illinois Supreme Court's own record shows the pattern. Latrina Cothron was a manager at a White Castle in Illinois, employed there since 2004. BIPA took effect in 2008, and "White Castle did not seek her consent to acquire her fingerprint biometric data until 2018, more than a decade after the Act took effect" (Cothron v. White Castle System, Inc., 2023 IL 128004, ¶ 6).

The 2024 amendment added two words to the definition of a release. Since 2008 the Act has defined a written release to include, at work, "a release executed by an employee as a condition of employment." Public Act 103-769 added "electronic signature" to that same definition (740 ILCS 14/10). So an e-signature at onboarding counts.

The Act defines an electronic signature as an electronic "sound, symbol, or process attached to or logically associated with a record," executed or adopted "with the intent to sign the record." Tie each e-signature to the exact notice text it accepted; the log at the end does that.

What you would produce: the notice text, the signed release, and timestamps proving both predate the first scan. The dates are the case.

Sections 15(c) and 15(d): no profit, no disclosure

You cannot sell, lease, trade, or otherwise profit from biometric data, full stop; no consent form makes a sale lawful. You also cannot disclose it without the person's consent unless a narrow trigger applies: completing a transaction the person requested, a legal requirement, or a valid warrant or subpoena.

The operational trap is vendors. Biometric templates routinely sit with a timekeeping provider, a payroll processor, and a cloud host. Disclosure to a vendor is still disclosure. Your notice and release should say where the data goes, and your vendor contracts should carry the same duties you do.

What you would produce: the data-flow map naming every system that touches a template, and contracts showing each recipient is bound.

Section 15(e): the reasonable standard of care

The test in 15(e) is a comparison with how you already treat your other sensitive data. If customer payment data is encrypted and access-logged while fingerprint templates sit on an unencrypted terminal with a shared admin password, the comparison answers itself.

What you would produce: the security controls applied to biometric data specifically, shown to be at least equal to those on your other sensitive data.

What it costs to get wrong, and what changed in 2024

Section 20 sets liquidated damages of $1,000 per negligent violation and $5,000 per intentional or reckless one, or actual damages if greater, plus attorney's fees. For fifteen years the open question was what counted as one violation.

In Cothron v. White Castle System, Inc., 2023 IL 128004 (Feb. 17, 2023), the Illinois Supreme Court held that a claim accrued "with every scan or transmission" made without prior consent. White Castle estimated in that case that class-wide damages for as many as 9,500 current and former employees could exceed $17 billion. The General Assembly answered the next year. Public Act 103-769, effective August 2, 2024, added section 20(b):

The Seventh Circuit then settled whether that reaches older cases. In Clay v. Union Pacific Railroad Co., No. 25-2185 (7th Cir. Apr. 1, 2026), the district courts below had ruled the amendment did not apply to pending cases. The Seventh Circuit reversed: "we hold that this amendment to BIPA Section 20 applies retroactively to cases pending at the time it was enacted" (slip op. at 7).

The opinion notes that Clay "alleges that the Railroad collected his fingerprint scans approximately 1,500 times" (slip op. at 6). Without the amendment, the court added, intentional violations "could net Clay alone $7.5 million in statutory damages." Under section 20(b), those 1,500 scans are one recovery.

Read the ruling the way a claims examiner would. Per-person damages shrank the worst case, and the five duties stayed exactly as written. A workforce of 500 people enrolled without consent is still 500 claims at up to $5,000 each, plus fees, in a class action. Your exposure is now countable, and that cuts both ways: the plaintiff's lawyer deciding whether your case is worth filing can count it too.

Which other states have a BIPA-style law?

Texas used CUBI to reach a $1.4 billion settlement with Meta, announced by the Texas Attorney General on July 30, 2024 as "the largest ever obtained from an action brought by a single State." Colorado's section reaches employers directly: an employer may require biometric consent as a condition of employment only for listed purposes, such as secure access or recording the start and end of the work day (C.R.S. 6-1-1314(6)(a)). The Colorado Attorney General's Colorado Privacy Act resource page (coag.gov) states that "Private citizens are not entitled to file lawsuits or enforce legal rights under the CPA."

Legislatures keep moving; check the biometric law tracker in the resources below before you rely on this table. Building to BIPA's standard generally clears the other states' notice and consent bars; confirm retention and employment rules state by state with counsel.

Requirement by requirement: what you would have to produce

The pattern across all five duties is the same: the statute is written in terms of records you can produce. That is the problem I started Clavira to work on.

The 15(a) and 15(b) rows are dates, one set per person, and their order is the question. Copy this log into a spreadsheet, one row per person enrolled.

BIPA consent and destruction log, one row per person

• Person: name or employee ID.
• Identifier and device: for example, right index fingerprint, north entrance clock.
• Notice version: which notice text they received, by version and date.
• Notice delivered: date, time, and how (paper form, onboarding portal).
• Release signed: date, time, and form (ink or electronic signature), linked to that notice version.
• First scan: date and time of enrollment, from the device or the vendor's records.
• Recipients: each vendor that receives the template, by name.
• Last interaction: the date; for an employee, the cautious reading is the last day worked.
• Destruction due: the earlier of the purpose being satisfied and three years after the last interaction.
• Destroyed: date, systems covered, and who confirmed it.

Two checks run on every row. Notice delivered and release signed must both come before first scan; that is 15(b). Destroyed must fall on or before destruction due; that is 15(a).

Picture that row read eighteen months from now by a former employee's lawyer. If the release sits in your HR system and the first scan sits in the clock vendor's records, your proof depends on two clocks agreeing, and only one of them is yours. Ask your vendor now how you would export enrollment timestamps.

Run the test this week. Pick one employee enrolled on your time clock and ask whether you could fill in that row, with dates, by Friday. If you can, try it for someone who left last year; that row is where 15(a) gets tested. If you cannot, you now know which of the five duties to start with.