Illinois's Biometric Information Privacy Act, 740 ILCS 14, already stood alone among state privacy statutes for its private right of action with statutory damages — $5,000 per negligent violation, $50,000 per reckless or intentional one — and the legislature's 2024 amendment, SB 2979 (Public Act 103-0827, signed August 2, 2024), resolved the Illinois Supreme Court's damage-limiting ruling in Tims v. White Castle in plaintiffs' favor: a single scan suffices to state a claim, and a written release includes an electronic signature. For any fintech whose onboarding captures an Illinois resident's face geometry or fingerprint, the release architecture is now the difference between a compliant funnel and a class-action population.
3G Times publishes information, not legal advice. BIPA exposure turns on specific data practices and should be assessed with Illinois counsel and carriers.
What did the statute always require?
BIPA's structure is deceptively simple and famously unforgiving. Before collecting biometric identifiers, a private entity must inform the subject in writing that a biometric identifier is being collected and stored, state the purpose and length of retention, and receive a written release. Collection requires a publicly available retention-and-destruction schedule. Transmission and storage require reasonable care, with a private right of action waiting on any failure. The word that carried a decade of litigation is "written": Illinois courts read it strictly, and e-signature workflows that satisfied every consumer-protection statute on electronic contracting still drew BIPA motions because the release was a click rather than a signature line. The 2024 amendment closed that gap explicitly.
What changed with one scan and e-signatures?
Two technical shifts with outsized litigation economics. First, accrual: after the supreme court's Tims ruling suggested a single recovery per collection method regardless of scan count, the amendment restored the per-scan claim basis — one fingerprint login by one employee or one selfie-liveness capture by one applicant is a complete claim. Class certification arithmetic follows: a national onboarding funnel that photographs Illinois residents' faces without releases is a class defined by a query. Second, the e-signature paragraph makes compliant releases achievable at digital scale: the informed written consent BIPA always demanded can now unambiguously live in the app — disclosures presented, acknowledgment captured, artifacts retained. The amendment's two halves read together are the legislative settlement: plaintiffs get their accrual rule, defendants get their modern release mechanism.
| BIPA element | Post-2024 reading | Design consequence |
|---|---|---|
| Written release | Includes electronic signature | In-app ceremony with retained artifacts |
| Claim accrual | Single scan states a claim | Release before first capture, always |
| Statutory damages | $5,000 / $50,000 per violation | Class exposure scales with users |
| Retention schedule | Publicly available destruction policy | Published and actually followed |
| Reasonable care | Storage and transmission standards | Encryption and vendor terms |
How does this intersect fraud-prevention onboarding?
The tension is structural: the anti-fraud stack treats the onboarding selfie as routine, while BIPA treats the same photograph's face geometry as a regulated identifier. The compliant design sequences the release first — the BIPA notice and e-signed acknowledgment before the first liveness capture, not in a terms-of-service fold — and governs the downstream artifacts: the liveness vendor processing Illinois faces needs the schedule published, the retention actually enforced, and contracts that survive the exit. Programs also draw the scope map: which flows collect identifiers (face, fingerprint, voice), which merely process documents (a passport photograph without extraction is a different analysis), and where voice-printed service calls sit — because the statute's definitions, not the product team's vocabulary, decide coverage.
Why does insurance dominate the practical calculus?
Because BIPA class settlements taught the market to price the exposure, and carriers responded: coverage became more expensive, more conditioned on the release architecture, and more insistent on the retention-and-destruction schedule actually operating. The underwriting questionnaire is effectively a compliance program outline — consent flow, schedule publication, vendor agreements, destruction discipline — and the honest answers are the same answers the litigation defense needs. Fintechs entering bank partnerships will recognize the pattern: the carrier's questions, the partner bank's diligence, and the statute's elements converge on one file, which is the file to build before the first Illinois selfie rather than after the first demand letter.
What does this mean in practice?
- Sequence the release before the first capture. The amendment gives you e-signatures; the accrual rule gives you no second chance to consent retroactively.
- Publish the retention schedule and live by it. A destruction policy that exists only on the website is an exhibit, not a control.
- Map every biometric surface. Liveness, fingerprint login, voice print — the inventory precedes the risk assessment.
- Read other states' statutes as additions, not substitutes. Texas and Washington offer attorney-general regimes without the private action; Illinois remains the exposure that prices the program.
BIPA's sixteen-year lesson for the biometric economy is that consent architecture is the product. The 2024 amendments made the architecture executable in software — and made the absence of it, one scan at a time, exactly as expensive as the plaintiffs' bar always argued.
The multistate calendar note completes the program design: Illinois's private action remains the exposure ceiling, but the operating file — release ceremony, schedule, destruction discipline — satisfies the attorney-general states as a byproduct. One architecture, fifty maps, and the strictest one already built is the cheapest compliance strategy in American privacy law.
The closing arithmetic for the board: the release ceremony costs one screen and one artifact store; the alternative costs a per-scan population. Illinois juries have taught the market the multiplication table, and the 2024 amendments removed the last two excuses — the claim-limiting reading and the paper-only release — that kept the arithmetic theoretical.
What about voice authentication in call centers?
Voiceprint programs sit squarely in the definitional scope — a voiceprint is a biometric identifier — and the single-scan rule prices every enrolled interaction. The release-first sequencing carries an Illinois wrinkle: enrollments that present the schedule and capture the e-signed acknowledgment before the first sampled utterance are the compliant pattern, and the voiceprint's retention clock needs the same destruction discipline as face geometry.
Frequently asked questions
Do liveness selfies always collect biometric identifiers?
Where the system extracts face geometry — and liveness systems generally do — the identifier analysis applies. A photograph stored without extraction sits differently under the definitions, but the operational presumption for any face-analyzing funnel is coverage until counsel says otherwise.
Can arbitration clauses manage the exposure?
One procedural note on where these cases live: Illinois state court dockets, class-action consolidation, and the settlement-approval pipeline are the procedural geography, and the amendments' clarity has moved fights from accrual questions to release-quality questions — where the facts are the ceremony's artifacts. Defense narratives built on the retained e-signature record are the post-2024 pattern; narratives built on ambiguity have become its casualty, one clear e-signature record at a time.
They route disputes, where they are enforceable — but BIPA experience says the release quality determines whether the class becomes a docket entry or a settlement announcement. Arbitration is the second line; the signed release is the first.
Does vendor processing shift liability?
No — the collecting entity owes the duties, and vendors add their own exposure for possession. Contracts allocate cost, not compliance: the schedule, the release, and the destruction discipline stay with whoever faces the customer.
For more context, read Utah's AI Policy Act: Disclosure Duties When Regulated Professions Use Generative Tools.
For more context, read cftc event contracts ruling.
For more context, read tcpa ai robocall rules.