Before enrolling fingerprints or faces in Illinois, set up BIPA notice, written release and destruction

Illinois’ Biometric Information Privacy Act requires written notice, a written release and a public retention and destruction policy before a private entity collects fingerprints, face geometry or other biometric identifiers, and gives people a private right of action with liquidated damages.

Source facts

The Biometric Information Privacy Act’s definitions define a biometric identifier as a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry, and exclude photographs. Under Section 15, a private entity holding biometric identifiers or information must have a written, public policy setting a retention schedule and guidelines for permanent destruction once the initial purpose is satisfied or within 3 years of the individual’s last interaction, whichever occurs first.

Before collecting, the entity must inform the person in writing that biometrics are being collected or stored and of the specific purpose and length of term, and must receive a written release; in employment, that can be a release executed as a condition of employment, and electronic signatures count. It may not sell, lease, trade or otherwise profit from biometric data, and must protect it with the reasonable standard of care in its industry and at least as well as other confidential information.

Under Section 20, anyone aggrieved may sue: liquidated damages are $1,000 for a negligent violation or $5,000 for an intentional or reckless one, or actual damages if greater, plus attorneys’ fees. Following Public Act 103-769, effective August 2, 2024, repeatedly collecting the same identifier from the same person by the same method is a single violation.

Applicability

The Act applies to private entities; it excludes state and local government agencies and, under its construction section, contractors working for a state agency or local unit of government. Other states have their own biometric laws, so multi-state employers need counsel’s review for each.

DSE recommendation

DSE recommends building BIPA notice, written release and template deletion into the enrollment and offboarding workflow before any Illinois biometric reader goes live. Publish the retention policy, block enrollment until the signed release is on file, and configure the access control or time system to delete templates when a person leaves or the purpose ends. Confirm in the vendor contract where templates are stored, who can access them, and that the vendor will not use or disclose them.

Verification

Quarterly, compare enrolled templates with active staff and signed releases, and delete orphaned ones. Keep the published policy, release forms and deletion logs together, and review them with counsel when readers or vendors change.

Official references

Illinois General Assembly — 740 ILCS 14/15, Biometric Information Privacy Act. Illinois General Assembly — 740 ILCS 14/10, Definitions. Illinois General Assembly — 740 ILCS 14/20, Right of action. Reviewed October 18, 2026.