Illinois BIPA Biometric Privacy Lawsuit Guide: Fingerprint and Face Scan Class Actions in 2026

Can a Fingerprint Scan Really Cost a Company Millions?

Yes, and the bottom line is that the exposure comes from paperwork, not from a hack. Under the Illinois Biometric Information Privacy Act, a business that collects a fingerprint, faceprint, or similar identifier without written notice, a written release, and a public retention policy can be sued by every person it did that to. No breach is required. No stolen data is required. The violation is the missing consent.

My read is that BIPA is best understood as a compliance statute with a damages multiplier attached. The policy story, that you can reset a password but not a face, is real. The litigation story is much more mundane: did the employer hand out a consent form before the first scan, and can it prove it? Plaintiffs’ firms and defense lawyers both work from that checklist.

If you are a current or former Illinois worker, a customer who got a settlement notice, or a business with Illinois employees or shoppers, this guide is meant to help you size up the situation. It is general information. The facts of one case beat every rule of thumb below.

What Does BIPA Actually Require?

Section 15 of the statute holds the duties. Sections (a) and (b) generate most of the lawsuits.

Section	Requirement	Typical claim
15(a)	Publicly available written retention schedule; destroy data when the purpose ends or within 3 years of last interaction, whichever comes first	No written policy exists
15(b)	Before collecting: written notice that biometrics are collected, the specific purpose and length of term, and a written release	Fingerprint enrolled with no signed consent
15(c)	No selling, leasing, or profiting from biometric data	Data monetized or traded
15(d)	No disclosure to third parties without consent	Timeclock vendor receives templates
15(e)	Reasonable security standard	Weak storage or transmission

The covered identifiers are retina or iris scans, fingerprints, voiceprints, and scans of hand or face geometry. Ordinary photographs are not on the list, which is why cases against photo-tagging features turned on whether the software built a face template from the picture.

Exclusions exist. Government bodies and some contractors are out. Financial institutions subject to Gramm-Leach-Bliley are out. Certain health care information under HIPAA is out, and Illinois courts have applied that to situations like hospital staff using fingerprints to open medication cabinets. Read those exclusions narrowly, though. I would not tell a client they are safe because they are in banking or health care.

How Much Are BIPA Damages Per Violation?

The text is simple. Negligent violation: $1,000. Intentional or reckless violation: $5,000. Or actual damages if they are larger. Prevailing plaintiffs can also recover attorney’s fees and costs and ask for an injunction.

The hard part was always counting violations.

Date	Ruling or law	What it did
Jan 2019	Rosenbach v. Six Flags (Ill.)	No actual harm needed to sue
Feb 2023	Cothron v. White Castle (Ill., 4-3)	Each scan can be a separate violation; court noted trial judges have discretion over damages
Feb 2023	Tims v. Black Horse Carriers (Ill.)	Five-year limitations period for all BIPA claims
Aug 2024	SB 2979 amendment	Repeated collection by the same method counts as one violation per person; e-signatures count as a written release

After Cothron, defense lawyers ran calculations in which one employee clocking in twice a day for years produced a six-figure theoretical number. That arithmetic scared employers and, I think, hurt the statute’s credibility. The 2024 amendment cut off the multiplier. Realistic exposure now looks closer to the number of affected people times $1,000 or $5,000, then discounted by litigation risk.

Whether the amendment applies to cases already pending is a question federal courts have answered differently. Some district judges applied it retroactively and others did not. I am not going to give you a scorecard, because it keeps moving. Check the current docket and any appellate decisions in your own case before you let that issue drive a settlement decision.

What Is the BIPA Statute of Limitations?

Five years. The Illinois Supreme Court settled it in Tims in 2023, after a period where defendants argued for one year on some sections.

For a worker, the practical rule is to look back five years from the date you would file and find your first enrollment inside that window. If you enrolled in 2022 and left in 2024, you are likely well within time. If you enrolled in 2019, some early violations may be gone, although the last scans might still count depending on how a court treats accrual after the 2024 amendment.

The takeaway: do not wait for a settlement notice. Write down your enrollment date, your last use date, and which device it was.

Which BIPA Cases Ended in Big Settlements?

These are the best-known public examples. Amounts are as widely reported; check the official settlement sites for current payment terms.

Case	Issue	Reported result
Facebook (Patel v. Facebook)	Face templates from tagged photos	About $650 million, approved 2021
Google Photos	Face grouping	About $100 million, 2022
TikTok	Face and voice data (multidistrict litigation)	About $92 million, 2021
Snap	Lens and filter face scans	About $35 million, 2022
BNSF Railway	Truck driver fingerprints	$228 million jury verdict in 2022; later retrial and a reported $75 million settlement in 2024
Clearview AI	Face database built from public images	Approved 2025; class receives a share of the company’s value rather than straight cash

What matters to a claimant is not the headline number. It is the pool. Tech cases with millions of class members tend to pay individuals tens to a few hundred dollars. Smaller employer cases, where a few hundred workers share a fund, are the ones that sometimes pay four figures each. I would treat any per-person estimate before the claims deadline as a guess.

I Used a Fingerprint Timeclock at Work. What Happens Next?

The typical sequence looks like this.

1. Gather evidence. Hiring packet, handbook acknowledgments, screenshots of the enrollment screen, pay records. The key question is whether you ever signed a biometric consent.
2. Pick the court. Cook County and other Illinois state courts do not require proof of concrete injury. Federal court does.
3. Check for an arbitration clause. A class waiver in your offer letter can push you into individual arbitration.
4. Check union coverage. Collectively bargained employees face a preemption defense.
5. Expect a settlement track. Most BIPA cases settle. Class counsel usually takes a percentage of the fund, so the worker pays nothing up front.

Do not confuse this with a workplace injury claim. If a scan machine is not your problem but an on-the-job injury is, that runs through a separate system, covered in our workers’ compensation additional claim guide. A BIPA claim is a privacy statute claim, and the two do not substitute for each other.

Is Retail Facial Recognition the Bigger Risk?

For businesses, yes. An employer can fix the timeclock problem with a form at onboarding. A shopper walking into a store has no onboarding.

The riskiest setups are loss-prevention cameras that match faces to watchlists, virtual try-on or makeup apps that map facial geometry, kiosks that estimate age from a face scan, and any vendor arrangement where footage or templates leave the store. The legal trigger is a scan of face geometry. A plain security camera that records video is a different thing from software that turns a face into a comparable template.

Relying on your vendor is not a defense. Plaintiffs routinely name both the technology provider and the business that deployed it, and the duty to give notice and obtain consent sits with the party collecting from the person. An indemnity clause in the contract might help you recover later, but it does not stop the suit. Large coordinated cases against platforms, like the one described in our 3M Combat Arms earplug MDL 2885 overview, show how consolidated litigation moves, and BIPA cases against big tech followed a similar arc through class certification and settlement approval.

What Should an Employer Do Before Getting Sued?

If I advised a company, I would start by asking whether it needs biometrics at all. For a 40-person shop, a badge tap costs less than a lawsuit.

Checklist item	What to do	Common mistake
Written notice	Describe what is collected, why, and for how long	One sentence buried in a privacy policy
Written release	Signed or e-signed before first scan; keep records	Verbal consent, missing signatures
Retention policy	Publish it; tie destruction to purpose end or 3 years	Keeping data on former employees forever
Vendor contract	Limit use, require deletion, allocate liability	Vendor reuses templates for its own products
Alternatives	Offer PIN or badge to those who decline	Treating biometrics as mandatory
Insurance	Ask your broker whether BIPA is excluded	Assuming general liability covers it

Insurance deserves its own warning. The Illinois Supreme Court once held that a policy’s personal-injury coverage could trigger a duty to defend a BIPA claim, and carriers responded by adding explicit exclusions. Pull your current policy and look for biometric or statutory-violation exclusions.

The same paper-trail logic drives other fiduciary class actions. The way plan sponsors defend or lose cases comes down to documented process, which is the theme in our ERISA 401(k) excessive fee lawsuit guide. Employers who have already been through that exercise tend to adapt to BIPA faster.

How Is a BIPA Case Different From a Data Breach Case?

This is where people get confused. A breach suit starts when data leaks and then has to prove a concrete injury from the leak: identity theft, costs, a risk that materializes. Federal courts toss many of these at the standing stage.

BIPA flips it. Nothing has to leak. Collecting a fingerprint without a signed release is the violation, and in state court that is enough. That is lower proof for plaintiffs and higher risk for defendants. A company with excellent security can still lose a BIPA case.

There are limits. The conduct must connect to Illinois, so a plaintiff with no Illinois link has a hard time. A company that collected valid written releases will usually beat a 15(b) claim quickly. And the 2024 amendment reduced the damages ceiling.

Product liability class actions run on yet another model. If you want a contrast, our Allergan BIOCELL breast implant BIA-ALCL lawsuit page shows a case where physical injury and causation are the whole fight, which is the opposite of BIPA’s paperwork-first theory.

What Should Settlement Claimants Watch For?

• Verify the notice. Match the case number to the court docket. Fake claim sites exist.
• Never share sensitive login data. A real form asks for your name, contact details, and payment preference.
• Mind every deadline. Claim, opt-out, and objection dates differ. Missing the claim date means no payment.
• Understand the release. Staying in the class gives up your right to sue the same defendant on the same claims.
• Plan for taxes. Ask a professional how your payment is characterized.
• Be patient. Approval hearings, objections, and appeals can push payments out many months.

In practice, one more habit pays off: keep a folder with your offer letter, handbook acknowledgment, and any screenshot of enrolling. Those three items answer most of the questions a claims administrator or lawyer will ask.

For companies in the antitrust arena, where plaintiffs also organize around a common practice instead of individual harm, see our antitrust price-fixing class action attorney guide for a different version of the same group-action mechanics.

Where Is BIPA Headed in 2026?

The 2024 amendment took the sharpest edge off the statute, but it did not close the door. Missing consent, missing policies, and third-party disclosure claims remain. Meanwhile, facial recognition, voice cloning tools, and AI features that process faces and voices keep creating fresh fact patterns.

My view is plain. Damages exposure is more predictable than it was in 2023, and filings will drift toward face and voice technology rather than classic timeclocks. Businesses that treat consent records as routine operations will rarely be the headline. Claimants should confirm one thing first: did I ever sign anything?

Texas and Washington have their own biometric laws, but neither gives private citizens the direct lawsuit that Illinois does. For current text, amendments, and pending cases, rely on the Illinois General Assembly site (ilga.gov), court dockets, and the official settlement pages rather than secondary summaries, this one included.

This article is general information, not legal advice. Statutes, court rulings, and settlement terms change, and outcomes depend on specific facts. Consult an attorney licensed in Illinois before filing, defending, or settling a claim.