Illinois’ Biometric Information Privacy Act requires written notice, a written release and a public retention and destruction policy before a private entity collects fingerprints, face geometry or other biometric identifiers, and gives people a private right of action with liquidated damages.
\nThe Biometric Information Privacy Act’s definitions define a biometric identifier as a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry, and exclude photographs. Under Section 15, a private entity holding biometric identifiers or information must have a written, public policy setting a retention schedule and guidelines for permanent destruction once the initial purpose is satisfied or within 3 years of the individual’s last interaction, whichever occurs first.
\nBefore collecting, the entity must inform the person in writing that biometrics are being collected or stored and of the specific purpose and length of term, and must receive a written release; in employment, that can be a release executed as a condition of employment, and electronic signatures count. It may not sell, lease, trade or otherwise profit from biometric data, and must protect it with the reasonable standard of care in its industry and at least as well as other confidential information.
\nUnder Section 20, anyone aggrieved may sue: liquidated damages are $1,000 for a negligent violation or $5,000 for an intentional or reckless one, or actual damages if greater, plus attorneys’ fees. Following Public Act 103-769, effective August 2, 2024, repeatedly collecting the same identifier from the same person by the same method is a single violation.
\nThe Act applies to private entities; it excludes state and local government agencies and, under its construction section, contractors working for a state agency or local unit of government. Other states have their own biometric laws, so multi-state employers need counsel’s review for each.
\nDSE recommends building BIPA notice, written release and template deletion into the enrollment and offboarding workflow before any Illinois biometric reader goes live. Publish the retention policy, block enrollment until the signed release is on file, and configure the access control or time system to delete templates when a person leaves or the purpose ends. Confirm in the vendor contract where templates are stored, who can access them, and that the vendor will not use or disclose them.
\nQuarterly, compare enrolled templates with active staff and signed releases, and delete orphaned ones. Keep the published policy, release forms and deletion logs together, and review them with counsel when readers or vendors change.
\nIllinois General Assembly — 740 ILCS 14/15, Biometric Information Privacy Act. Illinois General Assembly — 740 ILCS 14/10, Definitions. Illinois General Assembly — 740 ILCS 14/20, Right of action. Reviewed October 18, 2026.
", "content_text": "Illinois’ Biometric Information Privacy Act requires written notice, a written release and a public retention and destruction policy before a private entity collects fingerprints, face geometry or other biometric identifiers, and gives people a private right of action with liquidated damages.\nSource facts\nThe Biometric Information Privacy Act’s definitions define a biometric identifier as a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry, and exclude photographs. Under Section 15, a private entity holding biometric identifiers or information must have a written, public policy setting a retention schedule and guidelines for permanent destruction once the initial purpose is satisfied or within 3 years of the individual’s last interaction, whichever occurs first.\nBefore collecting, the entity must inform the person in writing that biometrics are being collected or stored and of the specific purpose and length of term, and must receive a written release; in employment, that can be a release executed as a condition of employment, and electronic signatures count. It may not sell, lease, trade or otherwise profit from biometric data, and must protect it with the reasonable standard of care in its industry and at least as well as other confidential information.\nUnder Section 20, anyone aggrieved may sue: liquidated damages are $1,000 for a negligent violation or $5,000 for an intentional or reckless one, or actual damages if greater, plus attorneys’ fees. Following Public Act 103-769, effective August 2, 2024, repeatedly collecting the same identifier from the same person by the same method is a single violation.\nApplicability\nThe Act applies to private entities; it excludes state and local government agencies and, under its construction section, contractors working for a state agency or local unit of government. Other states have their own biometric laws, so multi-state employers need counsel’s review for each.\nDSE recommendation\nDSE recommends building BIPA notice, written release and template deletion into the enrollment and offboarding workflow before any Illinois biometric reader goes live. Publish the retention policy, block enrollment until the signed release is on file, and configure the access control or time system to delete templates when a person leaves or the purpose ends. Confirm in the vendor contract where templates are stored, who can access them, and that the vendor will not use or disclose them.\nVerification\nQuarterly, compare enrolled templates with active staff and signed releases, and delete orphaned ones. Keep the published policy, release forms and deletion logs together, and review them with counsel when readers or vendors change.\nOfficial references\nIllinois General Assembly — 740 ILCS 14/15, Biometric Information Privacy Act. Illinois General Assembly — 740 ILCS 14/10, Definitions. Illinois General Assembly — 740 ILCS 14/20, Right of action. Reviewed October 18, 2026.", "content_markdown": "Illinois’ Biometric Information Privacy Act requires written notice, a written release and a public retention and destruction policy before a private entity collects fingerprints, face geometry or other biometric identifiers, and gives people a private right of action with liquidated damages.\n\n## Source facts\n\nThe [Biometric Information Privacy Act’s definitions](https://www.ilga.gov/Documents/legislation/ilcs/documents/074000140K10.htm) define a biometric identifier as a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry, and exclude photographs. Under [Section 15](https://www.ilga.gov/Documents/legislation/ilcs/documents/074000140K15.htm), a private entity holding biometric identifiers or information must have a written, public policy setting a retention schedule and guidelines for permanent destruction once the initial purpose is satisfied or within 3 years of the individual’s last interaction, whichever occurs first.\n\nBefore collecting, the entity must inform the person in writing that biometrics are being collected or stored and of the specific purpose and length of term, and must receive a written release; in employment, that can be a release executed as a condition of employment, and electronic signatures count. It may not sell, lease, trade or otherwise profit from biometric data, and must protect it with the reasonable standard of care in its industry and at least as well as other confidential information.\n\nUnder [Section 20](https://www.ilga.gov/Documents/legislation/ilcs/documents/074000140K20.htm), anyone aggrieved may sue: liquidated damages are $1,000 for a negligent violation or $5,000 for an intentional or reckless one, or actual damages if greater, plus attorneys’ fees. Following Public Act 103-769, effective August 2, 2024, repeatedly collecting the same identifier from the same person by the same method is a single violation.\n\n## Applicability\n\nThe Act applies to private entities; it excludes state and local government agencies and, under its construction section, contractors working for a state agency or local unit of government. Other states have their own biometric laws, so multi-state employers need counsel’s review for each.\n\n## DSE recommendation\n\nDSE recommends building BIPA notice, written release and template deletion into the enrollment and offboarding workflow before any Illinois biometric reader goes live. Publish the retention policy, block enrollment until the signed release is on file, and configure the access control or time system to delete templates when a person leaves or the purpose ends. Confirm in the vendor contract where templates are stored, who can access them, and that the vendor will not use or disclose them.\n\n## Verification\n\nQuarterly, compare enrolled templates with active staff and signed releases, and delete orphaned ones. Keep the published policy, release forms and deletion logs together, and review them with counsel when readers or vendors change.\n\n## Official references\n\n[Illinois General Assembly — 740 ILCS 14/15, Biometric Information Privacy Act](https://www.ilga.gov/Documents/legislation/ilcs/documents/074000140K15.htm). [Illinois General Assembly — 740 ILCS 14/10, Definitions](https://www.ilga.gov/Documents/legislation/ilcs/documents/074000140K10.htm). [Illinois General Assembly — 740 ILCS 14/20, Right of action](https://www.ilga.gov/Documents/legislation/ilcs/documents/074000140K20.htm). Reviewed October 18, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/illinois-bipa-biometric-access-control-time-clock-consent-retention/", "url": "https://update.dsesecurity.com/updates/illinois-bipa-biometric-access-control-time-clock-consent-retention/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-18" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/illinois-bipa-biometric-access-control-time-clock-consent-retention/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Before enrolling fingerprints or faces in Illinois, set up BIPA notice, written release and destruction", "item": "https://update.dsesecurity.com/updates/illinois-bipa-biometric-access-control-time-clock-consent-retention/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/illinois-bipa-biometric-access-control-time-clock-consent-retention/#article", "identifier": "https://update.dsesecurity.com/updates/illinois-bipa-biometric-access-control-time-clock-consent-retention/", "url": "https://update.dsesecurity.com/updates/illinois-bipa-biometric-access-control-time-clock-consent-retention/", "headline": "Before enrolling fingerprints or faces in Illinois, set up BIPA notice, written release and destruction", "description": "Illinois’ Biometric Information Privacy Act requires written notice, a written release and a public retention and destruction policy before a private…", "abstract": "Illinois’ Biometric Information Privacy Act requires written notice, a written release and a public retention and destruction policy before a private entity collects fingerprints, face geometry or other biometric identifiers, and gives people a private right of action with liquidated damages.", "articleBody": "Illinois’ Biometric Information Privacy Act requires written notice, a written release and a public retention and destruction policy before a private entity collects fingerprints, face geometry or other biometric identifiers, and gives people a private right of action with liquidated damages.\nSource facts\nThe Biometric Information Privacy Act’s definitions define a biometric identifier as a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry, and exclude photographs. Under Section 15, a private entity holding biometric identifiers or information must have a written, public policy setting a retention schedule and guidelines for permanent destruction once the initial purpose is satisfied or within 3 years of the individual’s last interaction, whichever occurs first.\nBefore collecting, the entity must inform the person in writing that biometrics are being collected or stored and of the specific purpose and length of term, and must receive a written release; in employment, that can be a release executed as a condition of employment, and electronic signatures count. It may not sell, lease, trade or otherwise profit from biometric data, and must protect it with the reasonable standard of care in its industry and at least as well as other confidential information.\nUnder Section 20, anyone aggrieved may sue: liquidated damages are $1,000 for a negligent violation or $5,000 for an intentional or reckless one, or actual damages if greater, plus attorneys’ fees. Following Public Act 103-769, effective August 2, 2024, repeatedly collecting the same identifier from the same person by the same method is a single violation.\nApplicability\nThe Act applies to private entities; it excludes state and local government agencies and, under its construction section, contractors working for a state agency or local unit of government. Other states have their own biometric laws, so multi-state employers need counsel’s review for each.\nDSE recommendation\nDSE recommends building BIPA notice, written release and template deletion into the enrollment and offboarding workflow before any Illinois biometric reader goes live. Publish the retention policy, block enrollment until the signed release is on file, and configure the access control or time system to delete templates when a person leaves or the purpose ends. Confirm in the vendor contract where templates are stored, who can access them, and that the vendor will not use or disclose them.\nVerification\nQuarterly, compare enrolled templates with active staff and signed releases, and delete orphaned ones. Keep the published policy, release forms and deletion logs together, and review them with counsel when readers or vendors change.\nOfficial references\nIllinois General Assembly — 740 ILCS 14/15, Biometric Information Privacy Act. Illinois General Assembly — 740 ILCS 14/10, Definitions. Illinois General Assembly — 740 ILCS 14/20, Right of action. Reviewed October 18, 2026.", "datePublished": "2026-10-18T21:00:38+00:00", "dateModified": "2026-10-18T22:22:07+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/illinois-bipa-biometric-access-control-time-clock-consent-retention/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/illinois-bipa-biometric-access-control-time-clock-consent-retention/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/physical-security-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/physical-security-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Before enrolling fingerprints or faces in Illinois, set up BIPA notice, written release and destruction" }, "articleSection": [ "Access Control", "Cybersecurity" ], "keywords": [ "Access Control", "Cybersecurity", "Explainer", "Important priority" ], "genre": "Explainer", "about": [ { "@type": "Thing", "name": "Access Control", "url": "https://update.dsesecurity.com/topic/access-control/" }, { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" } ], "wordCount": 434, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Illinois General Assembly — 740 ILCS 14/15, Biometric Information Privacy Act", "url": "https://www.ilga.gov/Documents/legislation/ilcs/documents/074000140K15.htm" } } ] } }