Illinois BIPA at work: biometric time clocks, face and voice tools, and what employers must do

Many workplace systems now use the body as a password: fingerprint time clocks, face scans to unlock tablets or check identity, and voice tools that recognize a speaker. In Illinois, the Biometric Information Privacy Act (BIPA, 740 ILCS 14) sets strict rules for any private entity, including an employer, that collects these identifiers, and it gives the people affected a right to sue (740 ILCS 14). This page explains what it requires at work.

The short answer: before collecting a worker's fingerprint, face geometry, voiceprint, or retina or iris scan, a private employer in Illinois must tell the worker in writing what is collected, for what specific purpose and for how long, and get a written release, which in employment can be a release signed as a condition of employment. It must also publish a retention and destruction policy, may not sell or profit from the data, and may disclose it only in limited cases (740 ILCS 14/10, 14/15). A person aggrieved by a violation can recover $1,000 per negligent violation or $5,000 per intentional or reckless violation, or actual damages if greater (740 ILCS 14/20).

What counts as biometric data

• Biometric identifier: a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry. Excluded are writing samples, signatures, photographs, physical descriptions, and information captured from a patient in a health care setting, among others (14/10).
• Biometric information: any information, however captured, converted, stored or shared, based on a person's biometric identifier and used to identify them (14/10). So a template or code derived from a fingerprint is covered, not just the raw scan.
• Who must comply: a "private entity", meaning any individual, partnership, corporation, LLC, association or other group. State and local government agencies are not private entities, and the act does not apply to a contractor or agent of a state agency or local government when working for it (14/10, 14/25(e)).

What employers must do

• Written public policy: a retention schedule and guidelines for permanently destroying the data when the initial purpose is satisfied or within 3 years of the person's last interaction with the entity, whichever comes first, and then follow it (14/15(a)).
• Before collecting: inform the person in writing that biometric data is being collected or stored, and of the specific purpose and length of term; and receive a written release (14/15(b)). A written release means informed written consent, an electronic signature, or, in employment, a release executed by an employee as a condition of employment (14/10).
• No selling or profiting: the data may not be sold, leased, traded or otherwise used for profit (14/15(c)).
• Disclosure limits: only with the person's consent, to complete a financial transaction they requested, when required by law, or under a valid warrant or subpoena (14/15(d)). Sending scans to a time clock vendor or payroll provider is a disclosure to check against this list.
• Security: store, transmit and protect the data with the reasonable standard of care in the industry, and at least as well as other confidential information such as Social Security or account numbers (14/15(e)).

Damages and the 2024 change

• Right of action: any person aggrieved by a violation may sue in state court or as a supplemental claim in federal court, and recover per violation $1,000 (negligent) or $5,000 (intentional or reckless) or actual damages if greater, plus attorneys' fees, costs and an injunction (14/20(a)).
• Repeat scans count once: section 20, as amended by Public Act 103-0769 (effective 2 August 2024), says collecting the same biometric data from the same person by the same method more than once without complying is a single violation with at most one recovery, and repeated disclosure of the same data of the same person to the same recipient is also a single violation (14/20(b)-(c)). For a worker who clocks in by fingerprint every day, that limits recovery to one per person for that collection method, not one per scan.
• Electronic signatures: section 10, as last amended by the same 2024 act, includes an electronic signature in the definition of written release (14/10).

What this means in practice

• Employers: list every device and app that reads fingerprints, faces, hands, eyes or voices, including AI tools for identity checks, video interviews and call recording. Publish the retention policy, give written notice with purpose and term, collect a signed release before the first scan, check vendor contracts against the disclosure limits, and destroy data on schedule.
• Workers and applicants: before using a biometric clock or scan, you should receive a written notice and be asked to sign a release. Keep copies, and ask for the employer's published retention policy.

For Illinois rules on AI in hiring and video interviews, see Illinois AI hiring laws, and for the ban on demanding social media passwords, see the Illinois social media password law. For Maryland's consent rule on facial recognition in interviews, see facial recognition in job interviews in Maryland. For the Texas rules, which have no private lawsuit, see Texas biometric law at work. For Washington, whose narrower law also has no private lawsuit, see Washington biometric law at work, and for workplace surveillance more widely, see US employee monitoring laws. For all four state biometric laws side by side, see biometric privacy laws at work compared.

This page covers Illinois and is general information based on the statute text as published by the Illinois General Assembly when checked on 3 November 2026, not legal advice.