BIPA Compliance: A Guide for Employers and Product Teams

A password can be changed after a breach. A fingerprint cannot. That one difference explains why biometric data gets its own laws, and why a single careless rollout of a timeclock, a door lock, or a face filter can turn into a long and expensive problem.

Illinois was an early mover with the Biometric Information Privacy Act, and its rules reach well beyond the state's borders because they follow the people whose data is collected. Because the risk spans HR, product, legal, and IT, it helps to give someone clear ownership, and a credential such as the Certified Compliance Management Professional certification gives that person a working framework for policy, risk, and monitoring. This guide explains what BIPA requires, where organizations slip, and how to build a program that holds up when someone looks closely.

What is the Biometric Information Privacy Act (BIPA)?

BIPA is an Illinois state law that regulates how private entities collect, use, store, share, and destroy biometric data. Its central idea is that people should know when their most personal and permanent identifiers are being captured, should agree to it in writing, and should be able to trust that the information is protected and eventually deleted.

BIPA is notable for one feature that sets it apart from many privacy laws: it lets individuals sue directly. That private right of action is the reason the law has produced so much litigation, and it is why organizations that touch Illinois residents, employees, or customers pay close attention to it. The law has also been interpreted and amended over time, so confirm how it applies to your practices with counsel and recheck periodically.

What counts as biometric data

The statute speaks of biometric identifiers, such as a scan of the retina or iris, a fingerprint, a voiceprint, or a scan of hand or face geometry. It also covers biometric information, meaning data derived from those identifiers and used to identify a person. A photograph by itself is generally not a biometric identifier, but a scan of face geometry taken from one can be. Some categories of information and some types of organizations are excluded, so the boundaries deserve a careful look for each use case.

Who is affected

BIPA applies to private entities, which includes most businesses, large and small, along with their vendors in many situations. Employers are a frequent focus because fingerprint timeclocks and access systems are common, but retailers, app developers, banks, schools run by private operators, and technology providers all appear in the case law. Operating outside Illinois does not guarantee safety if the people whose data you collect are in it.

Core BIPA requirements

The statute asks for a handful of things. Each one is simple to describe and easy to do poorly.

Written policy and retention schedule

An organization that holds biometric data must have a written policy, available to the public, that explains how long the data will be kept and how it will be destroyed. The policy has to match reality. Data should be destroyed once the original purpose is satisfied or within a defined period after the person's last interaction with the organization, whichever comes first. A policy that nobody follows is a document and not a program.

Informed written consent

Before collecting biometric data, an organization generally must tell the person in writing that it is being collected or stored, explain the specific purpose and how long it will be kept, and obtain a written release. The sequence matters: notice, then consent, then collection. Collecting first and getting a signature later is a classic failure. For employees, the release is often tied to the written release of employment, but the notice still has to be specific.

What a strong notice includes

A strong notice covers a few plain points:

• What biometric data is being collected

• Why it is being collected

• How long it will be kept

• Who may receive it, including vendors

• How the person can ask questions

No selling, and limits on sharing

An organization may not sell, lease, trade, or otherwise profit from a person's biometric data. Disclosure to others is allowed only in narrow situations, such as with the person's consent, to complete a transaction the person requested, or when required by law. That makes vendor relationships a central issue, since sending data to a timeclock provider or a cloud host is a disclosure that needs to fit one of the permitted categories.

Reasonable security

Biometric data must be stored, transmitted, and protected using a reasonable standard of care for the industry, and at least as protectively as the organization handles other sensitive information. A fingerprint template stored with weak controls, or shared widely inside the company, invites trouble.

Common uses that create BIPA risk

Many BIPA problems begin with a tool nobody thought of as a privacy decision. Timeclocks that read fingerprints or faces. Building and device access. Voice authentication in call centers. Photo tagging and face grouping features. Virtual try-on tools and filters that map facial features. Identity checks during onboarding. Each of these can involve capturing a scan of a person's face, hand, or voice. If it matches the statute's categories, the notice, consent, policy, and security duties apply, even when the technology comes from a vendor and the company never sees the raw data.

Vendors and shared responsibility

Using a third-party provider does not move the legal responsibility elsewhere. Lawsuits have named both the organizations that deployed the technology and the vendors that supplied it. Ask vendors what they collect, where it is stored, who can access it, how long it is kept, and how deletion works. Put these answers in the contract. Confirm who obtains consent and who keeps the records. A vendor that cannot answer clearly is a vendor to reconsider.

When selecting providers for biometric timeclocks, access systems, or identity checks, organizations need to assess both the technology and the people who may handle sensitive information. HireValid's background screening solutions can support personnel vetting as part of that process. They complement, but do not replace, reviewing a vendor's biometric data practices, written agreements, consent procedures, and deletion controls under BIPA.

Litigation exposure

BIPA provides for statutory damages per violation, with higher amounts for intentional or reckless conduct, plus attorney fees. Courts have addressed difficult questions about whether harm must be shown and how violations are counted, and the legislature has amended the law in response, so the way exposure is calculated has shifted over time. Group claims are common because one practice can touch many people. Consult counsel about exposure and about how to respond to any demand letter or complaint.

Other biometric privacy laws

Illinois is not alone. Several other states have their own biometric privacy rules, and some comprehensive privacy laws treat biometric data as sensitive information with special handling requirements. Most do not allow private lawsuits the way BIPA does, but they carry their own duties and enforcement. Organizations operating nationally should map every use of biometric technology to the laws of the places where the people they serve are located, not just where the company sits.

Common BIPA mistakes

The mistakes are familiar. Biometric tools are rolled out without legal review. Consent is collected after capture, or buried in general terms. The notice does not say how long the data will be kept. There is no public retention policy, or the policy is never followed. Vendors collect and store data with no oversight. Data is kept long after employees leave. Biometric data is used for a second purpose that was never disclosed. Systems are secured less carefully than other sensitive records. Each can look like a minor oversight. Across a large workforce or customer base, they become the facts in a complaint.

Clear communication: the marketing side of BIPA compliance

Marketing and product teams often introduce biometric features without realizing it. A virtual try-on that maps a face, a loyalty program that verifies customers by voice, a photo feature that groups people by appearance, or a store camera that analyzes faces can all raise BIPA questions.

Teams that borrow habits from a digital marketing course, such as defining the audience, testing how messages land, and measuring whether people understand what they are choosing, can make consent clearer and more honest. Write notices in plain language. Show them before the camera turns on. Test whether people can explain what they agreed to. Offer a non-biometric alternative where possible, since a choice that feels optional builds trust and reduces risk. Treat consent design as part of the user experience, not as a legal footnote.

Building a BIPA compliance program

A reliable program has an owner, written procedures, trained staff, and regular testing. It starts with an inventory of every system that could capture a fingerprint, face, voice, or similar scan, including tools bought by individual teams.

Governance and training

Name a leader with authority to pause a rollout. Write plain procedures for approving biometric tools, drafting notices, collecting consent, setting retention schedules, reviewing vendors, and responding to requests. Add a privacy review to the buying and product process so biometric features are caught early. Train HR, product, marketing, security, and procurement staff with real scenarios, since most problems start with a quick decision to adopt a convenient tool.

Systems and records

The technical side matters as much as the policy. Consent records, retention schedules, deletion tools, and vendor systems must work together. People who understand how these systems connect, a skill built through tech certifications, can find gaps such as templates that remain on a device after an employee leaves or backups that never get purged.

Records also need strong controls. Ideas from deep tech certifications, like secure storage, access permissions, and tamper-evident logs, support a trustworthy trail showing what was collected, what consent was given, and when data was destroyed.

Testing and review

Regular testing lets an organization find weaknesses before a plaintiff does. Look at the following:

• An inventory of biometric tools against approvals and notices

• Consent records, traced to the date of first capture

• Retention schedules and proof of actual deletion

• Vendor contracts, storage locations, and access controls

• Public policy accuracy compared with real practice

Write down what you find and how you fix it. A habit of documented testing shows good faith and makes any later inquiry easier to answer.

Conclusion

The Biometric Information Privacy Act asks organizations to treat fingerprints, faces, and voices as the permanent identifiers they are. Find out where biometric data touches your business, including vendors and features you never thought of that way. Publish a real retention policy, give a specific notice, and get written consent before collecting. Do not profit from the data, limit sharing, secure it carefully, and delete it on schedule. Watch other state laws, and test your program regularly.

Strong BIPA compliance comes from clear ownership, product and marketing teams who ask the biometric question early, connected systems, and regular reviews. Set those up once, and a new timeclock or face filter arrives with its consent and deletion plan already in place.

Frequently asked questions

1. What is the Biometric Information Privacy Act (BIPA)?

It's an Illinois law that regulates how private entities collect, use, store, share, and destroy biometric data.

2. What counts as a biometric identifier?

Examples include a retina or iris scan, fingerprint, voiceprint, and a scan of hand or face geometry.

3. What is biometric information?

Data derived from biometric identifiers and used to identify a person.

4. Is a photograph a biometric identifier?

A photograph by itself generally is not, but a scan of face geometry taken from one can be.

5. Who must comply with BIPA?

Private entities, including most businesses and, in many situations, their vendors, when they handle biometric data of people covered by the law.

6. Does BIPA apply to companies outside Illinois?

It can, if they collect biometric data from people in Illinois. Confirm how it applies with counsel.

7. Does BIPA apply to employers?

Yes. Fingerprint timeclocks, face scans, and access systems are common sources of employer risk.

8. What must a written biometric policy include?

A public explanation of how long biometric data is kept and how it is destroyed.

9. When must biometric data be destroyed?

Generally once the original purpose is satisfied or within a defined period after the person's last interaction, whichever comes first.

10. What notice is required before collection?

Written notice that biometric data is being collected or stored, the specific purpose, and how long it will be kept.

11. Is written consent required?

Yes. A written release is generally required before collection.

12. Can biometric data be sold?

No. Selling, leasing, trading, or otherwise profiting from biometric data is prohibited.

13. When can biometric data be shared?

Only in narrow situations, such as with consent, to complete a requested transaction, or when required by law.

14. What security standard applies?

A reasonable standard of care for the industry, at least as protective as for other sensitive information.

15. Are vendors responsible under BIPA?

They can be. Lawsuits have named both the organizations deploying the technology and the vendors that supplied it.

16. Can individuals sue under BIPA?

Yes. The law provides a private right of action, with statutory damages per violation and attorney fees.

17. Do violations require proof of harm?

Courts and the legislature have addressed this and how violations are counted. Consult counsel about current treatment.

18. Do other states have biometric laws?

Yes. Several states have their own rules, and some comprehensive privacy laws treat biometric data as sensitive.

19. Do marketing features like face filters and virtual try-on raise BIPA issues?

They can, if they scan face geometry. Review them like any other biometric tool.

20. How can organizations stay BIPA compliant?

Inventory biometric tools, publish a retention policy, give specific notices, get written consent first, oversee vendors, secure the data, delete on schedule, and test regularly.