To file a BIPA claim in Illinois, you must prove the defendant stored or captured biometric data without prior written consent or adequate notice. Draft your complaint in state court, citing the section violated and listing each capture. Attach evidence such as notices, signed forms, and logs. File within five years of each acquisition; every unauthorized event restarts the clock. This set‑up lets you seek statutory damages. Learn how to calculate damages and pursue recovery.
Key Takeaways
- File the claim in Illinois state or federal court, asserting Article III standing under the BIPA statutes.
- Prove the defendant lacked written, pre‑collection consent and notice; each breach constitutes a separate violation.
- Initiate the lawsuit within five years of each accrual date, as set by *Tims v. Black Horse*, with limitations resetting for each capture or transmission.
- Seek damages of $1,000 for negligence or $5,000 for intentional acts, capped by the 2024 amendment limits per person and per method.
- Request discovery of vendor contracts, retention logs, and consent documents, and keep a detailed cost ledger to support a fee‑award.
Spot BIPA Violations Before a Complaint
When you’re collecting biometric data without first providing written notice and obtaining express consent, you trigger a BIPA violation even before any complaint is filed. Notice Signage must be clear, conspicuous, and placed where individuals will see it before a scan. If a company relies on vague door signs like “Fingerprinting for access,” it fails BIPA’s strict standard. Each scan counts as a separate violation, so a single employee’s daily clock‑in can expose your firm to thousands in damages. Consent Forms need to be written and signed prior to collection; silent or implied consent is insufficient. When an app pulls facial geometry from a camera, it must display Consent Forms and exact use statements in the system’s onboarding flow. Failure to provide these materials allows the state to impose statutory damages for the act of collection, even without any reported loss or breach. Under BIPA, the statutory damages may reach 5× statutory amount per violation. Regular audits preempt costly litigation.
File Your BIPA Complaint: Court, Notice, and Timelines
Because BIPA creates a private right of action, you may file in either Illinois state court or federal court, provided Article III standing exists. Before you move forward, conduct a clear Jurisdiction assessment: check that the defendant is a participant in a private contract and that your claim fits BIPA’s statutory damages framework. Next, verify Notice compliance—obtain written consent and publish a retention policy, as missing them triggers a technical violation. Then, file within the five‑year window that begins on each accrual date, per Tims v. Black Horse Carriers. Finally, address the timing of class certification: file early motions to dismiss to establish your complaint’s viability, then push for class status if you represent many aggrieved victims. If you opt for federal court, remember that Article III standing requires proof of injury‑to‑person. The court also scrutinizes factual assertions for whether the defendant collected biometric data under BIPA, influencing dismissal decisions.
Recent lower‑court rulings vacated a $228 million jury award that had relied on the per‑violation rule.
Quantify Your Damages Under BIPA
If you’re evaluating BIPA damages, the first step is to pin down the type of violation—negligent or intentional—because that determines the base dollar ($1,000 vs. $5,000). Once you know the base, apply the Statutory Caps that the 2024 amendment imposes: one recovery per person per collection method, capped at $5,000 for sections 15(b) and 15(d), and a $15,000 ceiling across all sections for a single individual. Retrospective Damage calculations shift from the earlier per‑scan model to a single-violation approach, meaning you’ll count each distinct collection event, not every scan. For former Cothron-style cases, the court will now look for evidence of actual harm; if it’s hard to prove, liquidated damages can still replace it, but never exceed the statutory limit. Track each violation’s date and method; retroactive application covers pending lawsuits, so document everything before filing to preserve those caps. Make sure your claim reflects these limits to avoid liability. The court clarified that each biometric capture or transmission without consent creates a distinct accrual event, restarting the statute of limitations for that incident.
Discover Evidence: Subpoenas, Documents, and Fees in BIPA Cases
Having pinned down the damage base, you now need to substantiate those figures with solid evidence. Build a subpoena strategy that targets third‑party vendors, time‑clock providers, and software companies. Under the recent amendment, under SB 2979 the statute caps all damages stemming from repeated biometric scans at the amount of a single violation. Use state circuit or federal rules to compel records of scans, logs, and consent forms. Watch for motions to quash overbroad requests.
1⃣ Request employee onboarding and retention logs that demonstrate BIPA Section 15(a) compliance.
2⃣ Seek consent documents, including e‑signatures, to prove Section 15(b) fulfillment.
3⃣ Obtain disclosure logs that reveal unauthorized sharing under Section 15(d).
4⃣ Gather vendor contracts to quantify collection practices.
Cite fee schedules for copying, ESI production, and expert analysis. Courts award reasonable fees under Section 20 when discovery succeeds, and cap damages per the 2024 amendments at $1,000 or $5,000. Immediately move to compel if the vendor resists, and document all costs for the prevailing‑party award.
Cite copying, ESI, expert fee schedules; Section 20 grants reasonable fees, 2024 caps at $1,000/$5,000; compel vendor, document all costs.
Initiate discovery within the 30‑day disclosure window, and follow up with a written request no later than 45 days post‑conference. Expect production deadlines of 30 days, and plan for depositions 4–6 months into the case. Engage a biometric analyst; their estimates bolster your fee schedule claim. Maintain a detailed ledger of all costs—subpoena fees, copying, expert fees—to support the prevailing‑party award.
Resolve & Comply: Settlements, Litigations, and Future Safeguards
Key settlements across tech, automotive, and consumer sectors now illustrate the economic stakes and regulatory trajectory under BIPA. You’ll see how a $47.5 million Motorola FaceSearch deal, alongside Lightricks’ $4.5 million, Neutrogena’s $4.7 million, and smaller $1.7 million settlements, sharpen the risk profile. Each agreement includes strict compliance audit clauses, ensuring you monitor consent and data‑handling practices. Settlement negotiation must factor in liquidated damages – $1,000 for negligence, $5,000 for intentional acts – and the 2024 amendment that limits repeated collections to a single violation. Upcoming litigations, such as the Microsoft Teams class action, signal that unmet disclosure standards can trigger class‑action exposure. Future safeguards, spurred by Seventh Circuit rulings, will likely roll back damages caps and lock in single‑violation counting. Staying ahead means preparing a robust compliance audit, securing written notices, and preparing for accelerated negotiation if breaches surface. Furthermore, proactively documenting your consent protocols demonstrates responsibility and may reduce settlement costs considerably.
The $12 million settlement concluded by Speedway in September 2025 illustrates the high financial stakes when fingerprint data is collected without proper consent Speedway settlement.
Frequently Asked Questions
Can I File a BIPA Claim Against a Company Outside Illinois?
Yes, you can file a BIPA claim against a firm outside Illinois. If that firm collected, used, or stored Illinois residents’ biometric data while in Illinois, courts treat it as a cross‑state claim. An interstate filing is allowed when the violation’s nexus lies in Illinois—like a scanner in a workplace, app used by Illinois customers, or data transferred involving Illinois stakeholders. Provide evidence of Illinois connection, and the suit can proceed.
Is BIPA Enforcement Limited to Private Companies Only?
Did you know your local police could be held accountable for biometric misuse?
You may wonder if BIPA applies to public entities or government bodies.
BIPA targets private companies, but it doesn’t automatically exempt government bodies.
State agencies must still follow the act’s notice and consent rules.
Violations by public entities can trigger lawsuits, yet private claims dominate enforcement.
Do I Have to Personally Sign the Consent to Make a Complaint?
Consent necessity means you gotta have proper notice and agreement before biometric data is collected. Signature requirement is only needed to validate that notice, not to file a complaint. In practice, you can file a BIPA claim using representative documentation, such as an official consent form or a court‑drafted affidavit, without personally signing the consent itself. This approach aligns with statutory intent, ensuring you stay compliant while protecting your rights.
Can Biometric Data Obtained by an Employee Be Used for Business Purposes?
Imagine a guarded garden where every flower must display a sign before being plucked. You, the employer, can only harvest employee‑derived biometrics if you first secure Employee Consent and then restrict your use to the disclosed business purpose. Data Retention must end within three years and be destroyed once the original aim is satisfied. Failure to obey, and you’ll face statutory penalties and it escalates swiftly to distant courts.
What Damages Can I Recover for Non-Consensual Fingerprint Scanning?
You’ll recover statutory damages up to $5,000 for reckless or intentional violations, or $1,000 for negligent cases, per person, regardless of how often your fingerprint is scanned. Additionally, you might claim compensatory recovery for any actual harm you’ve suffered beyond the statutory amount. Recent amendments cap claims to one recovery per individual per BIPA subsection, eliminating per‑scan multiples. This change guarantees all claims settle within one statutory window, simplifying litigation.
Conclusion
You stand at the precipice of justice, ready to launch your BIPA complaint like a well‑aimed arrow. By tightening timelines, sharpening damages, and unearthing evidence, you forge a case as sturdy as steel. Resolve disputes, settle walls, or advance to litigation with confidence. Each step fortifies your data‑privacy fortress, turning silicon footprints into safeguards that echo for future generations. While the law’s compass guides your ship, your diligence steers it toward undisputed victory in today.
Lawyer
