BIPA Damages: What a Violation Is Worth (2026)

BIPA allows damages of $1,000 for each negligent violation and $5,000 for each reckless or intentional violation. But a 2024 amendment and the discretionary nature of these awards mean the real-world numbers are far lower, and harder to predict, than those headline figures suggest.

Jurisdiction scope: This explains how damages work under the Illinois Biometric Information Privacy Act (740 ILCS 14). It is general legal information, not legal advice, and does not estimate the value of any individual claim.

What BIPA Damages Are

Section 20 of BIPA lets a person who is aggrieved by a violation recover the greater of liquidated or actual damages: $1,000 for each negligent violation and $5,000 for each intentional or reckless violation, plus reasonable attorney fees and costs and injunctive relief. Because attorney fees are recoverable, even modest claims can be litigated, which is part of why BIPA generates so many class actions.

The figures are a ceiling defined by statute, not a guaranteed payout. The Illinois Supreme Court has made clear that these are discretionary; a trial court may award less, and the word the statute uses is that a prevailing party "may recover."

Why the Per-Scan Math Is Gone

For several years the scariest BIPA numbers came from a single idea. In Cothron v. White Castle (2023 IL 128004), the Illinois Supreme Court held that a separate claim accrues every time a company scans or transmits biometric data without consent. A fingerprint timeclock can scan an employee thousands of times, so multiplying thousands of scans by hundreds of employees by $1,000 to $5,000 produced theoretical exposure in the billions.

The Illinois legislature responded. Effective August 2, 2024, Public Act 103-0769 provides that when a company collects the same biometric identifier from the same person using the same method more than once, it is a single violation entitling the person to a single recovery. That change removes the per-scan multiplication for new claims and resets BIPA exposure to something far more bounded.

Statutory Damages Versus What People Actually Receive

There is a large gap between BIPA's headline numbers and what an individual usually gets. Most BIPA matters are resolved as class actions, and the settlement fund is divided among everyone in the class. In the $650 million Facebook settlement, with a class of roughly 1.5 million people, individual payments came to a few hundred dollars. That pattern is typical. A calculator that multiplies $5,000 by the number of scans does not reflect how BIPA recoveries actually work.

If you are wondering whether your own situation is the kind BIPA covers, our Do You Have a BIPA Claim? checker walks through the basic questions. If you are a business assessing exposure, see the employer compliance guide.

More on BIPA

• BIPA: the full guide
• BIPA damages
• BIPA statute of limitations
• BIPA compliance for employers
• Do you have a BIPA claim?