Governance, risk & compliance

Illinois Biometric Information Privacy Act (BIPA) 740 ILCS 14; P.A. 103-769 (eff. 2 Aug 2024)

Illinois Biometric Information Privacy Act, 740 ILCS 14, assessed in the Act’s own order.

A private entity that collects a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry (or information based on one) must have a publicly available written policy with a retention schedule and destruction guidelines (s. 15(a)); give written notice, disclose the purpose and length of term, and receive a written release before collecting (s.

15(b)); never sell, lease, trade or otherwise profit from the data (s. 15(c)); disclose it only on the grounds in s.

15(d); and protect it with the reasonable standard of care in its industry, at least as protective as for other confidential and sensitive information (s. 15(e)).

Any person aggrieved may sue: liquidated damages of $1,000 for a negligent violation or $5,000 for an intentional or reckless one, or actual damages if greater, plus attorney fees and costs (s. 20(a)).

The 2024 amendment (P. A.

103-769, in force 2 August 2024) says repeated collection of the same biometric identifier from the same person by the same method is a single violation of s. 15(b), and repeated disclosure of the same data to the same recipient by the same method is a single violation of s.

15(d), so a person recovers once for each (s. 20(b) and (c)); it also added electronic signatures to “written release” (s.

10). Whether the amendment limits claims that arose before 2 August 2024 is a question for the courts: commentary reports a 2026 Seventh Circuit decision applying it to pending cases, but the opinion was not read for this pack, so ask counsel before relying on it.

Exclusions include information captured from a patient in a health care setting, financial institutions subject to the Gramm-Leach-Bliley Act, and contractors or agents of a State agency or local government unit while working for it (ss. 10 and 25); State and local government agencies are not “private entities”.

A private-sector employer that uses a fingerprint time clock, face-scan door reader, or voice analytics is in scope, and so is the vendor that runs it. Read from ilga.

gov on 23 October 2026. General information for compliance work, not legal advice.

How Lavawall® helps you get to Illinois Biometric Information Privacy Act (BIPA) compliance

Most of Illinois Biometric Information Privacy Act (BIPA) comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to Illinois Biometric Information Privacy Act (BIPA), and tracks your posture continuously instead of once a year at audit time.

• Assess your current state against Illinois Biometric Information Privacy Act (BIPA) in the Lavawall GRC module, with the questionnaire and control set built in.
• Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
• Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.

Related

Lavawall® supports Illinois Biometric Information Privacy Act (BIPA) as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.