EdLaw
Illinois — Biometric Information Privacy Act (BIPA, 740 ILCS 14)
The most consequential biometric statute in the United States, and the reason Illinois is the largest single US exposure for any product that scans a face, eye, hand, fingerprint or voice. Enacted by P.A. 95-994 (eff. 3 Oct 2008) and amended by P.A. 103-769 (eff. 2 Aug 2024).
What makes BIPA different from every sibling regime is not the duties — notice, written release, a published retention schedule, no sale, reasonable care — but the remedy: a private right of action with liquidated damages and attorneys' fees, available to "any person aggrieved" without proof of actual loss (§20(a)).
Applicability to EdTech
The act binds a "private entity", which expressly excludes a State or local government agency (§10) — so a public school district is not itself a target, while a vendor is. But the carve-out that decides most vendor exposure is §25(e): the act does not apply to "a contractor, subcontractor, or agent of a State agency or local unit of government when working for that State agency or local unit of government". Whether a given supplier to a given district falls inside that exclusion is the load-bearing question, and it is one for counsel on the facts — the corpus records the provision, not its application.
Note the breadth of the trigger: "biometric identifier" covers a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry, and "biometric information" reaches any information based on such an identifier used to identify an individual, "regardless of how it is captured, converted, stored, or shared" (§10). Photographs as such are excluded; geometry derived from them is not obviously so.
Key obligations at a glance
- Publish a written retention schedule and destruction guidelines — §15(a).
- Before collecting: inform the subject in writing that biometrics are being collected or stored, inform them of the specific purpose and length of term, and obtain a written release — §15(b)(1), §15(b)(2), §15(b)(3).
- Never sell, lease, trade or otherwise profit from biometric identifiers or information — §15(c).
- No disclosure or redisclosure without consent or one of the three other enumerated grounds — §15(d).
- Store and transmit using the reasonable standard of care within the industry, and no less protectively than the entity's other confidential and sensitive information — §15(e)(1), §15(e)(2).
Remedies. Liquidated damages of $1,000 for a negligent violation and $5,000 for an intentional or reckless one, or actual damages if greater, plus reasonable attorneys' fees, expert fees and litigation expenses, and injunctive relief — §20(a)(1)–(4).
The 2024 amendment. P.A. 103-769 added §20(b) and §20(c): a private entity that collects, or that discloses, the same biometric identifier from the same person by the same method more than once has committed a single violation, entitling that person to at most one recovery. This is the legislative answer to per-scan damages accumulating on every repeated read, and it materially changes the exposure arithmetic for any device a pupil uses daily.
Carve-outs. HIPAA and the X-Ray Retention Act (§25(b)), GLBA financial institutions (§25(c)), and the government-contractor exclusion (§25(e)).
Contents
| Document | Covers |
|---|---|
| BIOMETRIC-DUTIES.md | the whole act — §§1–99: legislative findings, definitions, retention/collection/disclosure/destruction duties, the private right of action, construction and carve-outs |
Licence
The corpus reproduces 740 ILCS 14 in full verbatim from the Illinois General Assembly's compiled-statutes page (through the Internet Archive's id_ endpoint, which returns the publisher's original bytes), with each section's "(Source: P.A. …)" trailer.
Statute text enacted by a state legislature is outside copyright under the government edicts doctrine. In Georgia v. Public.Resource.Org, Inc., 590 U.S. 255 (2020) (slip opinion, read 2026-10-01), the Supreme Court held: "Under what has been dubbed the government edicts doctrine, officials empowered to speak with the force of law cannot be the authors of—and therefore cannot copyright—the works they create in the course of their official duties." It applied the doctrine to an arm of the legislature as well as to legislators: "Because Georgia’s annotations are authored by an arm of the legislature in the course of its legislative duties, the government edicts doctrine puts them outside the reach of copyright protection."
ilga.gov pages end with the footer "All Rights Reserved" (ilga.gov, read 2026-10-01 through the Internet Archive). The site's Disclaimers page (read the same way, 2026-10-01) sets no terms for reproducing statute text. A site-wide footer of that kind can cover the site, but not the Acts the General Assembly enacts.
Conditions: none attach to the statute text. The corpus nonetheless names the official source in its Sources section and in each fact document's {.meta} provenance lines, and its Meta section describes what it changed (anchors added, nothing reworded).
Related
- Illinois SOPPA — §5 brings biometric information inside "covered information" for K-12 operators
- Illinois PIPA — §5 counts unique biometric data as "personal information" for breach purposes
- Texas CUBI · Washington RCW 19.375 — the sibling regimes, both without a private right of action
- Florida student records — the outright biometric collection ban in the school setting