The Illinois BIPA Guide: Suing Employers and Retailers for Illegal Biometric Data Collection
In Illinois, companies cannot collect your fingerprints, facial scans, or voiceprints without strict written consent. If they violate the Biometric Information Privacy Act (BIPA), you may be entitled to recover statutory damages of $1,000 to $5,000 per person under state law.
In the digital age, your biometric data-such as your fingerprint, retina scan, facial geometry, or voiceprint-is your most sensitive personal information. Unlike a password, you cannot change your fingerprint if it gets stolen. Recognizing this danger, the state enacted one of the strongest privacy laws in the country. If a company collects your biometrics without following the exact rules, you have the right to sue. To explore your options, you can consult a qualified attorney from our United States lawyer directory.
What is the Biometric Information Privacy Act?
Under the 740 ILCS 14/§ 15, private entities are strictly prohibited from collecting, capturing, or obtaining your biometric data unless they do three things: inform you in writing that the data is being collected, state the specific purpose and length of term for which it will be kept, and receive your explicit written release. A violation occurs if a company skips even one of these steps.
Warehouse Workers and Fingerprint Timeclocks
Many large warehouses in Joliet, Aurora, and Chicago require employees to clock in and out using a fingerprint scanner. While convenient for the employer, it is highly regulated. If your employer started making you scan your finger without first having you sign a BIPA-compliant consent form, they broke the law. Because these companies employ thousands of workers, these situations often lead to massive class-action lawsuits.
Retail Shoppers and Facial Recognition
Some major retailers use facial recognition technology on their security cameras to identify known shoplifters or track customer demographics. However, if a store in the state scans your facial geometry as you walk through the doors without clearly informing you and obtaining written consent, they are violating your privacy. The landmark decision in Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186 (IL Supreme Court 2019) established that you do not need to prove you suffered actual harm (like identity theft) to sue; simply proving the company failed to get your consent is enough.
Remote Workers Subjected to Voice Printing
With the rise of work-from-home arrangements, some companies use software that tracks eye movements to ensure you are looking at your screen, or software that analyzes your voiceprint for identity verification. If you work from your home in Peoria or Springfield and your employer uses these technologies without a written release, they are likely liable for statutory damages.
The Lawsuit Process and Timelines
Filing a BIPA claim usually involves starting a civil lawsuit, often filed as a class action since multiple employees or customers are typically affected by the same corporate policy.
Step 1: Gathering Evidence
You need to document how and when your biometrics were collected. If it was a timeclock, write down when the system was implemented. If you never signed a consent form, note that fact.
Step 2: Filing the Complaint
Your attorney will draft a lawsuit and typically file it in a state or federal court. When filing locally, such as in the Cook County Circuit Court, Chicago or the Will County Circuit Court, Joliet, the attorney will submit the standard civil coversheet, such as Form CCL 0520, Illinois, Cook County Circuit Court, Civil Action Cover Sheet, along with the detailed complaint.
Step 3: Class Certification and Settlement
Because BIPA damages can accumulate quickly, companies often try to settle these claims to avoid trial. If the court certifies the class, meaning they allow you to represent all other affected employees or customers, the settlement amounts can be substantial.
How Much Can You Recover?
BIPA provides for statutory damages under 740 ILCS 14/§ 20 to hold companies accountable. Under legislative amendments (Senate Bill 2979), repeated biometric collections from the same individual using the same method constitute a single violation, limiting recovery to one award per person rather than accruing per scan:
- Negligent Violations: Up to $1,000 per person if the company was careless in obtaining consent.
- Reckless or Intentional Violations: Up to $5,000 per person if the company knowingly ignored the law.
- Attorney Fees: The law allows a winning plaintiff to recover their attorney fees and court costs from the defendant.
How Long Does the Process Take?
BIPA claims can take anywhere from 1 to 3 years to resolve, especially if they are brought as class-action lawsuits. The courts often take several months just to rule on preliminary motions to dismiss.
Frequently Asked Questions (FAQ)
Do I have to prove my identity was stolen to win a BIPA lawsuit?
No. State courts have clearly ruled that a violation of your privacy rights is enough to claim statutory damages, without needing to prove actual financial harm.
What is the statute of limitations for filing a BIPA claim?
Generally, BIPA claims are subject to a five-year statute of limitations, meaning you have up to five years from the date of the illegal biometric scan to file your lawsuit.
Can a company fire me for refusing a fingerprint scan?
While employment in this state is 'at-will', firing an employee for demanding compliance with the law could potentially lead to a separate claim for retaliatory discharge.
Are photographs considered biometric data?
Standard photographs are explicitly excluded under BIPA. However, if a company uses software to scan the photograph and extract facial geometry, that scanned data is protected.
How are BIPA attorneys paid?
Most BIPA attorneys work on a contingency fee basis, meaning they do not charge you upfront and only get paid if they win or settle your case.
No reviews yet. Be the first to share your experience!