Illinois BIPA: Your Biometric Privacy Rights Explained

One of the few US laws that lets individuals sue over the misuse of fingerprints, face scans and voiceprints.

By Siddharth ShankarUpdated October 24, 2026

A password can be changed. A fingerprint or face cannot. That is the idea behind Illinois’ Biometric Information Privacy Act, usually called BIPA. This guide summarises the original text of the Act as published by the Illinois General Assembly (Public Act 95-0994, effective October 3, 2008). Laws can be amended, so check the current version on the General Assembly’s website before relying on any detail.

What counts as biometric data

The Act covers biometric identifiers, which it lists as retina or iris scans, fingerprints, voiceprints and scans of hand or face geometry. It also covers biometric information, meaning information based on a biometric identifier and used to identify a person.

The Act excludes several things from the definition, including writing samples, written signatures and photographs, tattoo descriptions and physical descriptions such as height, weight, hair colour or eye colour, and certain medical and scientific samples and images. It also excludes information captured from a patient in a health care setting or used for HIPAA treatment, payment or operations.

Who is covered

The Act applies to private entities. State and local government agencies, courts and their agents are not treated as private entities, and financial institutions subject to the Gramm-Leach-Bliley Act are outside the Act.

Written consent

Before a private entity collects, captures, purchases or otherwise obtains your biometric data, it must:

• tell you in writing that the data is being collected or stored;
• tell you in writing the specific purpose and length of time for its collection, storage and use;
• receive a written release from you or your legally authorised representative.

A written release means informed written consent or, in employment, a release signed as a condition of employment.

Keeping and deleting data

A private entity that holds biometric data must publish a written retention schedule and destruction guidelines. It must permanently destroy the data when the original purpose is satisfied, or within 3 years of your last interaction with it, whichever comes first. A valid warrant or subpoena from a competent court is an exception.

No selling, limited sharing

A private entity holding biometric data may not sell, lease, trade or otherwise profit from it. It may disclose it only with consent, to complete a transaction you requested or authorised, when required by law or under a valid warrant or subpoena. It must protect the data with the reasonable standard of care in its industry, and at least as protectively as other confidential information it holds.

Your right to sue

Unlike many privacy laws, BIPA lets individuals bring claims. Any person aggrieved by a violation may sue in state circuit court, or as a supplemental claim in federal district court. The original text provides liquidated damages of $1,000, or actual damages if greater, for negligent violations, and $5,000, or actual damages if greater, for intentional or reckless violations. A prevailing party may also recover reasonable attorneys’ fees and costs, and other relief such as an injunction.

What to do in practice

1. Read consent forms. If an employer, gym or app asks for a fingerprint or face scan, find out what it says about purpose and how long it keeps the data.
2. Ask for the retention policy. Entities covered by the Act must publish one.
3. Use alternatives where offered, such as a PIN or card instead of a fingerprint.
4. Ask for deletion when you leave a job or stop using a service.
5. Think about the cost of sharing. Because biometrics cannot be reset, be cautious about apps that ask for face or voice data.
6. Know your own jurisdiction. The protections differ elsewhere; Texas, for example, has its own general privacy law, covered in this guide.

Biometrics in the wider world

Biometric data is also at issue in enforcement actions about face databases, such as the Clearview AI findings in Canada, and in state settlements like the Texas Google settlement. In India, you can protect your own biometric data using Aadhaar biometric locking.