The Illinois Biometric Information Privacy Act is the most consequential biometric privacy law in the United States, primarily because it provides a private right of action — allowing individuals to sue for statutory damages without proving actual harm. No other US biometric privacy law offers this combination of strong protections and individual enforcement power.
BIPA requires private entities to obtain informed written consent before collecting biometric identifiers (fingerprints, voiceprints, facial geometry, iris scans, retina scans) or biometric information. Entities must establish a publicly available written policy for retention and destruction of biometric data, and must destroy biometric data within 3 years of the last interaction or when the initial purpose for collection has been satisfied, whichever comes first.
BIPA has generated thousands of lawsuits against technology companies and platforms. Major settlements include Facebook/Meta ($650 million, 2021), Google ($100 million, 2022), TikTok ($92 million, 2022), and Snapchat ($35 million, 2022). The Illinois Supreme Court ruled in Rosenbach v. Six Flags (2019) that plaintiffs need not allege actual injury beyond the technical violation itself, making BIPA uniquely powerful among US privacy laws.
ConductAtlas maps governance language to potentially relevant regulatory frameworks. Regulatory applicability and enforceability may vary by jurisdiction, enforcement context, and individual circumstances. This page is informational and does not constitute legal advice. Methodology
Showing 30 of 2220 provisions. View all →
Get alerted when platforms change their policies, including BIPA-relevant provisions.
Subscribe to Monitor, $19/moConductAtlas tracks BIPA-relevant provisions across 36 platforms. Each platform's specific provisions are classified by severity and mapped to BIPA requirements.
ConductAtlas captures policy documents daily, classifies provisions by regulatory framework, and flags changes that affect BIPA obligations. Every change is archived with cryptographic verification.