🇺🇸Illinois Biometric Information Privacy Act

Skin

← Back to laws in United States

Illinois Biometric Information Privacy Act

Illinois Biometric Information Privacy Act

This specialist state privacy law applies to a defined data type, business model or processing activity. It should be layered over any applicable comprehensive state and federal laws.

Current official version

Effective status: October 3, 2008; amended August 2, 2024

Citation: 740 ILCS 14

Source basis: Current 740 ILCS 14 published by the Illinois General Assembly, including Public Act 103-769.

Scope

BIPA applies to private entities possessing, collecting, capturing, purchasing, receiving, using, selling or disclosing biometric identifiers or biometric information, subject to its definitions and exemptions. It expressly covers retina or iris scans, fingerprints, voiceprints and scans of hand or face geometry.

Operational obligations

Maintain a public retention and destruction policy; give written notice of collection, purpose and term; obtain a written release before collection; prohibit profit from biometric data; limit disclosure; use a reasonable standard of care; and destroy data when the initial purpose is satisfied or within three years of the last interaction, whichever occurs first.

State-specific point

Public Act 103-769 permits an electronic signature and limits repeated collection or disclosure using the same method to a single recoverable violation for the specified BIPA provisions. Other proposed 2026 bills are not law unless enacted.

Enforcement

An aggrieved person has a private right of action for liquidated or actual damages, attorneys fees, costs and other relief. Litigation risk makes documented consent and deletion evidence critical.

What this means for you

Inventory the covered data and processing separately, obtain the exact notice, consent or authorization required, control vendors and disclosures, and retain evidence against the current official text.

Other laws in United States
CA-DELETE

California Delete Act and Data Broker Requirements

California Privacy Protection Agency

Open law Read analysis
CPPA

California Privacy Rights Act and California Privacy Protection Agency provisions

California Privacy Protection Agency

Open law Read analysis
CLOUD-ACT

Clarifying Lawful Overseas Use of Data Act (CLOUD Act)

United States Department of Justice

Open law Read analysis
42-CFR-P2

Confidentiality of Substance Use Disorder Patient Records

U.S. Department of Health and Human Services, Office for Civil Rights

Open law Read analysis
CAN-SPAM

Controlling the Assault of Non-Solicited Pornography And Marketing Act

Federal Trade Commission

Open law Read analysis
CPNI

Customer Proprietary Network Information Rules

Federal Communications Commission

Open law Read analysis
DPPA

Drivers Privacy Protection Act

United States Department of Justice and federal courts

Open law Read analysis
ECPA-SCA

Electronic Communications Privacy Act and Stored Communications Act

United States Department of Justice

Open law Read analysis
FERPA

Family Educational Rights and Privacy Act

U.S. Department of Education, Student Privacy Policy Office

Open law Read analysis
GINA

Genetic Information Nondiscrimination Act

U.S. Equal Employment Opportunity Commission and federal health agencies

Open law Read analysis
HITECH

Health Information Technology for Economic and Clinical Health Act

U.S. Department of Health and Human Services, Office for Civil Rights

Open law Read analysis
HIPAA

Health Insurance Portability and Accountability Act of 1996

U.S. Department of Health and Human Services Office for Civil Rights

Open law Read analysis
MT-CDPA

Montana Consumer Data Privacy Act

Montana Attorney General, Office of Consumer Protection

Open law Read analysis
NJDPA

New Jersey Data Privacy Law

New Jersey Attorney General and Division of Consumer Affairs

Open law Read analysis
PRIVACY-ACT

Privacy Act of 1974

U.S. Department of Justice, Office of Privacy and Civil Liberties

Open law Read analysis
RI-DTPPA

Rhode Island Data Transparency and Privacy Protection Act

Rhode Island Attorney General

Open law Read analysis
UCPA

Utah Consumer Privacy Act

Utah Attorney General and Division of Consumer Protection

Open law Read analysis
VT-DPOSA

Vermont Data Privacy and Online Surveillance Act

Vermont Attorney General

Open law Read analysis
VPPA

Video Privacy Protection Act

United States Department of Justice and federal courts

Open law Read analysis