Guides
Biometric privacy (BIPA) lawsuits and insurance
How BIPA biometric class actions work, what the 2024 amendment and 2026 Seventh Circuit ruling changed, and whether your liability policies will defend them.
BIPA, the Illinois Biometric Information Privacy Act (740 ILCS 14), lets individuals sue a business that collects fingerprints, face scans, voiceprints or similar data without a written policy, advance written notice and a written release. Damages are $1,000 per negligent violation or $5,000 per intentional or reckless one, plus attorneys' fees. Whether your insurance responds depends on the form and the policy year: Illinois courts have found a duty to defend under some general liability policies and denied it under others, and the exclusion wording is usually the deciding fact.
What BIPA requires
The statute applies to any private entity that holds a "biometric identifier" (a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry) or information based on one. The core duties in Section 15 are:
- 15(a): a written, publicly available policy with a retention schedule, and destruction when the purpose is met or within three years of the person's last interaction, whichever comes first.
- 15(b): before collecting, tell the person in writing that biometrics are being collected, state the purpose and length of term, and get a written release.
- 15(c): do not sell, lease, trade or otherwise profit from the data.
- 15(d): do not disclose it without consent, unless a narrow exception applies.
- 15(e): protect it with the reasonable standard of care in your industry, at least as carefully as your other confidential information.
Since the 2024 amendment, a "written release" can be an electronic signature, and in employment a release signed as a condition of employment. Health care information under HIPAA and financial institutions covered by Gramm-Leach-Bliley sit outside the Act (740 ILCS 14/10 and 14/25).
Why these suits are so common
Four Illinois Supreme Court decisions made BIPA litigation easy to bring.
- Rosenbach v. Six Flags (2019) held that a person is "aggrieved" by a violation alone, with no further injury needed.
- McDonald v. Symphony Bronzeville Park (2022) held that the Workers' Compensation Act's exclusivity does not bar an employee's BIPA damages claim, so employers cannot send these claims to the comp system.
- Tims v. Black Horse Carriers (2023) applied a five-year limitations period to all BIPA claims, so a suit can reach back five years.
- Cothron v. White Castle (2023) held that a claim accrues with every scan or transmission, which suggested damages could multiply with each fingerprint timeclock punch.
The typical defendant is an employer with a fingerprint or hand-scan timeclock, but retailers, gyms, schools and the vendors that make the software are sued too. Illinois is where the private lawsuits are. Illinois employers with workers there, and national employers with any Illinois site, carry the exposure.
What the 2024 amendment and the 2026 Seventh Circuit decision changed
Cothron produced the fear of per-scan damages. In response, Public Act 103-0769 (signed August 2, 2024) added subsections 20(b) and 20(c). A business that collects the same biometric identifier from the same person using the same method of collection more than once has committed a single violation of Section 15(b), with at most one recovery. The same one-recovery rule applies to repeated disclosures of the same data to the same recipient under Section 15(d).
The amendment did not say whether it applies to suits already filed. On April 1, 2026, the Seventh Circuit held in Clay v. Union Pacific Railroad Co. (No. 25-2185 and consolidated cases) that it does, reversing three federal district court rulings, as reported by Duane Morris. The court treated the change as limiting the remedy, not adding or removing duties. It is a federal ruling on Illinois law, so state courts are not bound by it, and the amendment speaks only to Sections 15(b) and 15(d). Plaintiffs can still plead violations of other subsections, such as the retention policy in 15(a).
A hypothetical: the 120-employee manufacturer
Say a 120-employee Illinois manufacturer has used a fingerprint timeclock for four years without a written release or a public retention policy. This is an illustration, not a prediction.
| Measure | Result |
|---|---|
| One recovery per employee at $1,000 (negligent) | $120,000 |
| One recovery per employee at $5,000 (intentional or reckless) | $600,000 |
| Plaintiffs' fees and costs | Added by statute (740 ILCS 14/20(a)(3)) |
| Possible extra counts | Separate subsections (15(a), 15(d)) pleaded in addition |
Before the amendment, plaintiffs argued each daily punch was its own violation, which is how a settlement demand on a small employer could reach seven figures. The practical effect of Clay is to anchor that arithmetic to people, not scans. Defense costs and settlement leverage still run through fee-shifting.
Where other states stand
BIPA is unusual in giving individuals a private right of action. Texas has the Capture or Use of Biometric Identifier Act, which only the attorney general enforces, with civil penalties of up to $25,000 per violation. In July 2024 the Texas attorney general announced a $1.4 billion settlement with Meta, the first action and settlement under that law, according to the Texas AG's release. Washington has a biometric identifiers statute enforced by its attorney general, and a growing number of state comprehensive privacy laws classify biometric data as sensitive. state privacy laws and what they mean for business insurance covers the patchwork.
Where insurance fits
Biometric claims fall between lines. Commercial general liability, employment practices, cyber, D&O and technology E&O can each be asked to respond, and each has an argument against.
| Policy | Argument for coverage | Common insurer defenses |
|---|---|---|
| General liability (Coverage B) | In West Bend v. Krishna Schaumburg Tan (Ill. 2021), the Illinois Supreme Court held that sending biometric data to a vendor was "publication" within personal and advertising injury, and that BIPA claims allege a privacy violation | Access or disclosure of personal information exclusion; statutory-violation exclusion; employment-related practices exclusion |
| EPLI | Employee is the claimant | Many forms exclude statutory privacy violations or list covered wrongful acts that do not reach BIPA-type claims |
| Cyber | Privacy liability grant | Wrongful-collection exclusions; some grants require a security failure |
| D&O / tech E&O | Possible for a vendor or board-level claim | Privacy and data exclusions; professional-services wording |
The access-or-disclosure exclusion is where insurers have recently done best. In Thermoflex Waukegan v. Mitsui Sumitomo (7th Cir. May 17, 2024), the court held that the exclusion in a primary policy barred a handprint-timeclock BIPA claim. The same decision held that the statutory-violation, data-breach and employment-related-practices provisions did not bar coverage, and found a duty to defend under an umbrella policy that lacked the access exclusion. Illinois federal courts continued to apply the exclusion in 2025 and 2026 decisions, according to a Hunton Andrews Kurth summary, though other courts have gone the other way and the exclusion is not in every policy. Whether the statutory-violation exclusion applies also split the courts. Read CGL exclusions: what a general liability policy does not cover, personal and advertising injury coverage and common cyber insurance exclusions with your exact forms, and note that policy language varies by carrier and by year.
Two procedural points matter. An Illinois insurer can refuse to defend only if it is clear and free from doubt that an exclusion bars every claim, so a reservation of rights letter is common and the the insurer's duty to defend: what triggers it and when it ends analysis turns on the complaint. And an insurer that waits to cite an exclusion can run into waiver arguments, so keep every denial and reservation letter.
What to do now
- Inventory. List every system that scans a finger, face, hand, iris or voice: timeclocks, door access, kiosks, video-interview software, virtual try-on tools, fraud-check vendors.
- Paper it. Publish a retention and destruction policy, give written notice, and collect a written or electronic release before the first scan.
- Review vendors. Get indemnity and insurance from the timeclock or software provider, and check whether they hold the data.
- Pull every policy year. Request the forms for the last five years, since the limitations period is five years and exclusions differ year to year.
- Ask your broker whether the GL policy carries an access-or-disclosure endorsement, how EPLI and cyber treat statutory privacy claims, and whether a defense sublimit applies.
- Tender early. Send the complaint to every potentially responsive carrier (tendering a claim to another party's insurer).
Key takeaways
- BIPA pays $1,000 or $5,000 per violation plus attorneys' fees, with no actual harm required and a five-year lookback.
- The 2024 amendment limits recovery to one per person per method for collection and disclosure claims, and the Seventh Circuit held in April 2026 that it applies to pending cases.
- Coverage is unsettled and turns on exclusion wording, policy year and forum; the access-or-disclosure exclusion is the one insurers have used most successfully.
- Tender to every carrier, keep reservation letters, and fix consent and retention paperwork now.