The Illinois Biometric Information Privacy Act (BIPA) is a 2008 state law, codified at 740 ILCS 14, that regulates how private entities collect, use, store, and share biometric identifiers such as fingerprints, face geometry, voiceprints, and iris scans. It requires written notice, a written release, and a public retention policy, and it lets individuals sue directly for violations.

Yes. BIPA covers biometric data collected from people in Illinois through any channel, including websites and apps. Virtual try-on tools, selfie-based identity checks, facial-recognition logins, and voice features can all capture face geometry or voiceprints. If they run before written notice and consent, your company can be liable, even when a third-party vendor supplies the tool.

BIPA covers biometric identifiers, defined as retina or iris scans, fingerprints, voiceprints, and scans of hand or face geometry, and biometric information, meaning any data based on those identifiers that is used to identify a person. Photographs, writing samples, and demographic data are excluded, but courts have treated face-geometry scans taken from photos as covered.

An aggrieved person can recover $1,000 per negligent violation or $5,000 per intentional or reckless violation, or actual damages if greater, plus attorneys’ fees, costs, and injunctive relief. No proof of actual harm is required, and claims can be filed up to five years after the violation. Facebook paid $650 million in 2021 to settle BIPA claims over photo face-tagging.

Senate Bill 2979, signed on August 2, 2024, ended per-scan damages. Collecting the same biometric data from the same person by the same method now counts as a single violation, so each person recovers once. The amendment also confirmed that an electronic signature satisfies the written release requirement. In April 2026, the Seventh Circuit held in Clay v. Union Pacific that the change applies to pending cases.

Yes. In Theriot v. Louis Vuitton (2022), a federal court rejected the retailer’s argument that its virtual try-on vendor was the responsible party and let most of the BIPA claims proceed. In December 2025, the Seventh Circuit affirmed class certification for Illinois users of Amazon’s virtual try-on feature. If a tool on your site captures biometric data, you need proof that consent came first.

Reflectiz monitors your website remotely, with no code changes, and maps every script, pixel, and third-party tool that runs on it. It detects components that capture biometric identifiers, verifies whether written consent came before collection, shows which third parties receive the data, and keeps audit-ready logs of each component’s behavior. A consent banner records what users agreed to. Reflectiz shows what your site actually collected.