Illinois
Biometric Information Privacy Act (740 ILCS 14)
BIPA is the law every other state measures itself against. Passed in 2008, it requires informed written consent before any private entity collects a biometric identifier, including a scan of face geometry, and it is the only major biometric statute enforced by the people it protects: any Illinois resident can sue directly, without waiting for a regulator. That combination produced the largest biometric settlements in history and made Illinois the one state face-search operators genuinely fear.
Key Provisions
- Written informed consent required before collecting any biometric identifier, including face geometry
- Companies must publish a retention schedule and destroy biometric data when the purpose ends, or within 3 years of the last interaction
- Selling or profiting from biometric data is prohibited outright
- Private right of action: individuals sue directly, no regulator needed
- A 2024 amendment (SB 2979) limits damages to one recovery per collection method, softening per-scan accrual
Penalties & Enforcement Record
$1,000 per negligent violation, $5,000 per intentional or reckless violation. Settlements under BIPA include Facebook ($650M), Google ($100M) and Clearview AI, which accepted a nationwide ban on selling its faceprint database to most private businesses.
What this means for your face
If you live in Illinois, a face-search engine holding a faceprint of you without written consent is already breaking state law. Our removal requests cite BIPA directly, and the private right of action gives them teeth no other state can match.
Get Protected