BIPA Damages: What a Violation Is Worth (2026)

BIPA allows damages of $1,000 for each negligent violation and $5,000 for each reckless or intentional violation. But a 2024 amendment and the discretionary nature of these awards mean the real-world numbers are far lower, and harder to predict, than those headline figures suggest.

Jurisdiction scope: This explains how damages work under the Illinois Biometric Information Privacy Act (740 ILCS 14). It is general legal information, not legal advice, and does not estimate the value of any individual claim.

What BIPA Damages Are

Section 20 of BIPA lets a person who is aggrieved by a violation recover the greater of liquidated or actual damages: $1,000 for each negligent violation and $5,000 for each intentional or reckless violation, plus reasonable attorney fees and costs and injunctive relief. Because attorney fees are recoverable, even modest claims can be litigated, which is part of why BIPA generates so many class actions.

The figures are a ceiling defined by statute, not a guaranteed payout. The Illinois Supreme Court has made clear that these are discretionary; a trial court may award less, and the word the statute uses is that a prevailing party "may recover."

Why the Per-Scan Math Is Gone

For several years the scariest BIPA numbers came from a single idea. In Cothron v. White Castle (2023 IL 128004), the Illinois Supreme Court held that a separate claim accrues every time a company scans or transmits biometric data without consent. A fingerprint timeclock can scan an employee thousands of times, so multiplying thousands of scans by hundreds of employees by $1,000 to $5,000 produced theoretical exposure in the billions.

The Illinois legislature responded. Effective August 2, 2024, Public Act 103-0769 provides that when a company collects the same biometric identifier from the same person using the same method more than once, it is a single violation entitling the person to a single recovery. That change removes the per-scan multiplication for new claims and resets BIPA exposure to something far more bounded.

Statutory Damages Versus What People Actually Receive

There is a large gap between BIPA's headline numbers and what an individual usually gets. Most BIPA matters are resolved as class actions, and the settlement fund is divided among everyone in the class. In the $650 million Facebook settlement, with a class of roughly 1.5 million people, individual payments came to a few hundred dollars. That pattern is typical. A calculator that multiplies $5,000 by the number of scans does not reflect how BIPA recoveries actually work.

If you are wondering whether your own situation is the kind BIPA covers, our Do You Have a BIPA Claim? checker walks through the basic questions. If you are a business assessing exposure, see the employer compliance guide.

More on BIPA

• BIPA: the full guide
• BIPA statute of limitations
• BIPA compliance for employers
• Do you have a BIPA claim?

Frequently Asked Questions

How much can you get for a BIPA violation?

BIPA allows the greater of liquidated or actual damages: $1,000 per negligent violation and $5,000 per reckless or intentional violation, plus attorney fees. The award is discretionary, and in class settlements individual members usually receive a few hundred dollars rather than the full statutory figure.

Is it $1,000 or $5,000 per scan?

No longer. A 2024 amendment (Public Act 103-0769) made repeated collection of the same data by the same method a single violation with a single recovery, ending the per-scan multiplication that the Cothron decision had allowed.

Are BIPA damages automatic if there is a violation?

No. The Illinois Supreme Court has held that BIPA's statutory damages are discretionary; a court decides whether and how much to award.

Does the 2024 damages cap apply to old violations?

That is unsettled. The federal Seventh Circuit has applied the cap retroactively, but Illinois state courts have not uniformly resolved the question, so retroactivity is still being litigated.