Illinois
BIPA Compliance for Employers (2026): Step-by-Step
Independently fact-checked against primary sources (last audited August 14, 2026). · Reviewed by the RecordingLaw editorial team. · Law checked current as of August 14, 2026. · 4 primary sources cited on this page. How we verify our legal content
Most BIPA lawsuits target employers that use fingerprint or face-scan timeclocks without consent. Compliance comes down to seven duties under Section 15: written notice, a written release, a retention policy, timely destruction, no sale, controlled disclosure, and reasonable security.
Jurisdiction scope: This is a general compliance overview of the Illinois Biometric Information Privacy Act (740 ILCS 14) for employers. It is general legal information, not legal advice; consult an attorney licensed in Illinois.
The Seven Steps
- Give written notice first. Before collecting a fingerprint, face scan, or voiceprint, tell the employee in writing that biometric data is being collected and stored, and state the specific purpose and how long it will be kept.
- Get a written release. Obtain the employee's signed consent before the first scan. After the 2024 amendment, an electronic signature satisfies this requirement.
- Publish a retention and destruction policy. Make a written schedule publicly available.
- Destroy data on time. Delete biometric data when its purpose is met or within three years of the employee's last interaction, whichever is first, and keep records that you did.
- Never sell or profit from it. Selling, leasing, or trading biometric data is prohibited outright.
- Control disclosures. Do not share biometric data, including with your timeclock or payroll vendor, unless the employee consented or the law requires it.
- Secure it. Protect biometric data at least as well as your other confidential and sensitive information.
A Quick Self-Check
Use the educational self-assessment below to see which of the seven requirements your current practices may not meet. It does not provide legal advice or a compliance opinion.
BIPA Compliance Self-Check
Answer the seven questions below to see which BIPA requirements your practices may not yet meet. This is an educational self-assessment, not a legal audit or legal advice.
1. Before collecting any biometric data (fingerprints, face or hand geometry, voiceprints), do you give the person a written notice stating that it is being collected and the specific purpose and retention period?
2. Do you obtain a signed (or electronically signed) written release consenting to the collection before the first scan?
3. Do you maintain a publicly available written retention and destruction policy for biometric data?
4. Do you destroy biometric data when its purpose is satisfied, or within 3 years of the person's last interaction, whichever is first?
5. Do you avoid selling, leasing, trading, or otherwise profiting from biometric data?
6. Do you limit sharing biometric data with third parties (including your timeclock or software vendor) to disclosures the person consented to or that the law requires?
7. Do you store and transmit biometric data using at least the reasonable standard of care for your industry?
Why Vendors Matter
A company that builds and operates the biometric timeclock or access system is itself a private entity under BIPA and can be sued directly, and many BIPA suits name both the employer and the technology vendor. What decides the question is control over the data. In G.T. v. Samsung Electronics America, Inc., No. 25-1120 (7th Cir. Aug. 7, 2026), the Seventh Circuit held that the words possession in Section 15(a) and collect, capture, and obtain in Section 15(b) all require the company to have or have obtained some degree of control over the biometric data. Affirming dismissal, the court found the complaint did not plausibly allege that Samsung could access, modify, or use face templates that stayed on the user's own phone. That ruling turned on what that particular complaint failed to allege, and the court assumed without deciding that face templates are biometric identifiers at all, so it does not settle the ordinary workplace case, where the vendor usually enrolls, stores, and administers the biometric database itself. When you evaluate a biometric system, confirm in writing how the vendor handles consent, retention, and security, and who actually holds the data, because their failures can become your liability.
More on BIPA
Frequently Asked Questions
Can an employer require a fingerprint timeclock in Illinois?
Yes, but only after giving written notice of what is collected, the purpose, and the retention term, and obtaining the employee's signed or electronically signed consent, plus following a published retention and destruction policy.
What is the most common BIPA mistake employers make?
Rolling out a fingerprint or face-scan timeclock without first giving written notice and obtaining written consent. That single gap is behind most BIPA class actions.
Does an electronic signature count as BIPA consent?
Yes. The 2024 amendment (Public Act 103-0769) confirms that an electronic signature satisfies BIPA's written-release requirement.
Is our timeclock vendor liable too?
A vendor that stores or controls the biometric data is a private entity under BIPA and can be sued directly, and many cases name both the employer and the vendor. In G.T. v. Samsung Electronics America, Inc., No. 25-1120 (7th Cir. Aug. 7, 2026), the Seventh Circuit held that Sections 15(a) and 15(b) require some degree of control over the data, so supplying hardware or software that a customer runs entirely on its own may not be enough. Confirm in writing both the vendor's compliance and who actually holds the data.
Affected by a data breach or biometric privacy violation?
If your personal data was exposed in a breach, or your fingerprint or face scan was collected without your consent, you may be eligible to join a claim for compensation. Find out for free, with no obligation.
Updates
Removed a link in the More on BIPA list that pointed back to this same page.
Independently fact-checked against the cited primary sources; governing law re-checked for recent changes
Reviewed and approved by an editor
The Law Behind This Article
This article rests on the statutory provisions below, held in our own legal record and retrieved from the official source. Tap a section to read the operative text.
Illinois Compiled Statutes Chapter 740, Act 14 (Biometric Information Privacy Act)
§ 15Retention; collection; disclosure; destructionIn forcecited in 12 of our articles
(a) A private entity in possession of biometric identifiers or biometric information must develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within 3 years of the individual's last interaction with the private entity, whichever occurs first. Absent a valid warrant or subpoena issued by a court of competent jurisdiction, a private entity in possession of biometric identifiers or biometric information must comply with its established retention schedule and destruction guidelines.
Official text (excerpt) · last checked 2026-08-28 · Read the full text in our law library · Verify at ilga.gov
Cited in 208 court opinions in our collectionLatest citing opinion in our collection: 2026
Opinions citing this section in our collection:
- Cothron v. White Castle System, Inc. (Illinois Supreme Court 2023, 466 Ill. Dec. 85)“…15(d) of the Biometric Information Privacy Act (Act) (740 ILCS 14/15(b), (d) (West 2018)) in an action…”
- Tims v. Black Horse Carriers, Inc. (Illinois Supreme Court 2023, 466 Ill. Dec. 12)“…15(a) of the Biometric Information Privacy Act (Act) (740 ILCS 14/15(a) (West 2018)), providing for the rete…”
- Watson v. Legacy Healthcare Financial Services, LLC (Appellate Court of Illinois 2021, 458 Ill. Dec. 267)“…d, and (4) to obtain his or her written consent. 740 ILCS 14/15(a), (b) (West 2018). The complaint alle…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Also relied on in: BIPA Explained: Illinois Biometric Privacy Act (740 ILCS 14), Do You Have a BIPA Claim? Check Your Eligibility (2026), Illinois Data Privacy Laws: BIPA, Consumer Rights & Penalties (2026)
§ 20Right of actionIn forcecited in 11 of our articles
(a) Any person aggrieved by a violation of this Act shall have a right of action in a State circuit court or as a supplemental claim in federal district court against an offending party. A prevailing party may recover for each violation: (1) against a private entity that negligently violates a provision of this Act, liquidated damages of $1,000 or actual damages, whichever is greater; (2) against a private entity that intentionally or recklessly violates a provision of this Act, liquidated damages of $5,000 or actual damages, whichever is greater; (3) reasonable attorneys' fees and costs, including expert witness fees and other litigation expenses; and (4) other relief, including an injunction, as the State or federal court may deem appropriate.
Official text (excerpt) · last checked 2026-08-28 · Read the full text in our law library · Verify at ilga.gov
Cited in 94 court opinions in our collectionLatest citing opinion in our collection: 2026
Opinions citing this section in our collection:
- Rosenbach v. Six Flags Entertainment Corp. (Illinois Supreme Court 2019, 2019 IL 123186)“…Illinois Biometric Information Privacy Act, 740 ILCS 14/20, and may seek statutory liquidated…”
- Cothron v. White Castle System, Inc. (Illinois Supreme Court 2023, 466 Ill. Dec. 85)“…scretionary rather than mandatory under the Act. See 740 ILCS 14/20 (West 2018) (detailing the amounts and…”
- Tims v. Black Horse Carriers, Inc. (Appellate Court of Illinois 2021, 451 Ill. Dec. 879)“…ainment Corp., 2019 IL 123186, ¶ 1 (quoting 740 ILCS 14/20 (West 2016)). ¶ 25 The Act works…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Also relied on in: BIPA Damages: What a Violation Is Worth (2026), BIPA Statute of Limitations: The 5-Year Deadline (2026), Illinois AI Meeting Recording Laws (2026)
§ 10DefinitionsIn forcecited in 4 of our articles
In this Act: "Biometric identifier" means a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry. Biometric identifiers do not include writing samples, written signatures, photographs, human biological samples used for valid scientific testing or screening, demographic data, tattoo descriptions, or physical descriptions such as height, weight, hair color, or eye color. Biometric identifiers do not include donated organs, tissues, or parts as defined in the Illinois Anatomical Gift Act or blood or serum stored on behalf of recipients or potential recipients of living or cadaveric transplants and obtained or stored by a federally designated organ procurement agency. Biometric identifiers do not include biological materials regulated under the Genetic Information Privacy Act. Biometric identifiers do not include information captured from a patient in a health care setting or information collected, used, or stored for health care treatment, payment, or operations under the federal Health Insurance Portability and Accountability Act of 1996.
Official text (excerpt) · last checked 2026-07-29 · Read the full text in our law library · Verify at ilga.gov
Cited in 109 court opinions in our collectionLatest citing opinion in our collection: 2026
Opinions citing this section in our collection:
- West Bend Mutual Insurance Co. v. Krishna Schaumburg Tan, Inc. (Illinois Supreme Court 2021, 451 Ill. Dec. 1)“…ual’s biometric identifier used to identify an individual.” 740 ILCS 14/10 (West 2018). The Act regulates the…”
- Watson v. Legacy Healthcare Financial Services, LLC (Appellate Court of Illinois 2021, 458 Ill. Dec. 267)“…fingerprint” or “scan of hand,” such as what was used here. 740 ILCS 14/10 (West 2018). The same sectio…”
- Mosby v. Ingalls Memorial Hospital (Appellate Court of Illinois 2022, 2022 IL App (1st) 200822)“…Insurance Portability and Accountability Act of 1996,’ 740 ILCS 14/10, when the…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Also relied on in: Illinois Biometric Privacy Laws: Collection, Consent & Penalties (2026), Illinois Smart Glasses Recording Laws: Audio, BIPA & Consent
§ 5Legislative findings; intentIn forcecited in 2 of our articles
The General Assembly finds all of the following: (a) The use of biometrics is growing in the business and security screening sectors and appears to promise streamlined financial transactions and security screenings. (b) Major national corporations have selected the City of Chicago and other locations in this State as pilot testing sites for new applications of biometric-facilitated financial transactions, including finger-scan technologies at grocery stores, gas stations, and school cafeterias. (c) Biometrics are unlike other unique identifiers that are used to access finances or other sensitive information. For example, social security numbers, when compromised, can be changed. Biometrics, however, are biologically unique to the individual; therefore, once compromised, the individual has no recourse, is at heightened risk for identity theft, and is likely to withdraw from biometric-facilitated transactions. (d) An overwhelming majority of members of the public are weary of the use of biometrics when such information is tied to finances and other personal information.
Official text (excerpt) · last checked 2026-07-29 · Read the full text in our law library · Verify at ilga.gov
Cited in 91 court opinions in our collectionLatest citing opinion in our collection: 2026
Opinions citing this section in our collection:
- Cothron v. White Castle System, Inc. (Illinois Supreme Court 2023, 466 Ill. Dec. 85)“…he legislative findings in the Act confirm this. See 740 ILCS 14/5(c) (West 2018) (“[S]ocial security numb…”
- Tims v. Black Horse Carriers, Inc. (Illinois Supreme Court 2023, 466 Ill. Dec. 12)“…struction of biometric identifiers and information.” 740 ILCS 14/5(g) (West 2018). The Act defines “biomet…”
- Watson v. Legacy Healthcare Financial Services, LLC (Appellate Court of Illinois 2021, 458 Ill. Dec. 267)“…section entitled “[l]egislative findings” and “intent.” 740 ILCS 14/5 (West 2018); Sekura v. Krish…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
§ 25ConstructionIn forcecited in 3 of our articles
(a) Nothing in this Act shall be construed to impact the admission or discovery of biometric identifiers and biometric information in any action of any kind in any court, or before any tribunal, board, agency, or person. (b) Nothing in this Act shall be construed to conflict with the X-Ray Retention Act, the federal Health Insurance Portability and Accountability Act of 1996 and the rules promulgated under either Act. (c) Nothing in this Act shall be deemed to apply in any manner to a financial institution or an affiliate of a financial institution that is subject to Title V of the federal Gramm-Leach-Bliley Act of 1999 and the rules promulgated thereunder. (d) Nothing in this Act shall be construed to conflict with the Private Detective, Private Alarm, Private Security, Fingerprint Vendor, and Locksmith Act of 2004 and the rules promulgated thereunder. (e) Nothing in this Act shall be construed to apply to a contractor, subcontractor, or agent of a State agency or local unit of government when working for that State agency or local unit of government.
Official text (excerpt) · last checked 2026-07-29 · Read the full text in our law library · Verify at ilga.gov
Cited in 28 court opinions in our collectionLatest citing opinion in our collection: 2026
Opinions citing this section in our collection:
- Mosby v. Ingalls Memorial Hospital (Appellate Court of Illinois 2022, 2022 IL App (1st) 200822)“…titutions reflected in section 25(c) of the Act (740 ILCS 14/25(c) (West 2018)). ¶ 19 Northwe…”
- Thomas v. Cornerstone Services, LLC (Appellate Court of Illinois 2026, 2026 IL App (3d) 240568)“…f its contractual relationship with the government. 740 ILCS 14/25(e) (West 2024). We therefore answer the…”
- Enriquez v. Navy Pier, Inc (Appellate Court of Illinois 2022, 2022 IL App (1st) 211414-U)“…orking for that State agency or local unit of government.” 740 ILCS 14/25(e) (West 2020). Thus, an entity is exem…”
Identified automatically from the court opinions citing this section — not a ranking of which case controls.
Search our full record of US law — 2.1 million sections, every state + federal →
Sources and References
- Illinois Biometric Information Privacy Act, 740 ILCS 14(ilga.gov).gov
- 740 ILCS 14/20 - Right of Action and Damages(ilga.gov).gov
- Public Act 103-0769 (SB 2979) - 2024 BIPA Amendment(ilga.gov).gov
- Cothron v. White Castle System, Inc., 2023 IL 128004(courtlistener.com)
- Tims v. Black Horse Carriers, Inc., 2023 IL 127801(courtlistener.com)
- 740 ILCS 14/15 - Retention; collection; disclosure; destruction(ilga.gov)
- 740 ILCS 14/10 - Definitions ("written release" includes electronic signature)(ilga.gov)
- G.T. v. Samsung Electronics America, Inc., No. 25-1120 (7th Cir. Aug. 7, 2026) (published opinion, Lee, J.)(media.ca7.uscourts.gov).gov