The Illinois Biometric Information Privacy Act is the most consequential biometric privacy law in the United States, primarily because it provides a private right of action — allowing individuals to sue for statutory damages without proving actual harm. No other US biometric privacy law offers this combination of strong protections and individual enforcement power.
BIPA requires private entities to obtain informed written consent before collecting biometric identifiers (fingerprints, voiceprints, facial geometry, iris scans, retina scans) or biometric information. Entities must establish a publicly available written policy for retention and destruction of biometric data, and must destroy biometric data within 3 years of the last interaction or when the initial purpose for collection has been satisfied, whichever comes first.
BIPA has generated thousands of lawsuits against technology companies and platforms. Major settlements include Facebook/Meta ($650 million, 2021), Google ($100 million, 2022), TikTok ($92 million, 2022), and Snapchat ($35 million, 2022). The Illinois Supreme Court ruled in Rosenbach v. Six Flags (2019) that plaintiffs need not allege actual injury beyond the technical violation itself, making BIPA uniquely powerful among US privacy laws.
ConductAtlas maps governance language to potentially relevant regulatory frameworks. Regulatory applicability and enforceability may vary by jurisdiction, enforcement context, and individual circumstances. This page is informational and does not constitute legal advice. Methodology
Follow unlimited companies, monitor the clauses that matter across every platform, and get the full institutional analysis on what each change obligates you to do.
ConductAtlas captures policy documents daily, classifies provisions by regulatory framework, and flags changes that affect BIPA obligations. Every change is archived with cryptographic verification.