BIPA
Definition
Illinois Biometric Information Privacy Act (740 ILCS 14, 2008). Requires informed written consent before collecting biometric identifiers and prohibits their sale. The most litigated US biometric privacy statute; cited against Clearview AI in Thornley v. Clearview AI.
- Enacted
- 2008 (Illinois)
- Legal code
- 740 ILCS 14
- Damages per violation
- $1,000 to $5,000
- Key requirement
- Written informed consent before collection
Common questions
What does BIPA require from companies collecting biometric data?+
BIPA requires informed written consent before collecting any biometric identifiers like fingerprints or facial patterns. Companies must disclose the stated purpose for collection and are prohibited from selling the data. Violations carry a private right of action.
Why is BIPA considered the most litigated US biometric privacy law?+
BIPA is the most litigated US biometric privacy statute. Its strict consent and disclosure requirements have made it a key legal tool for individuals suing private entities over unauthorized biometric data collection, including cases against Clearview AI such as Thornley v. Clearview AI.
What penalties can individuals seek under BIPA?+
BIPA gives individuals a private right of action to sue, with damages of 1,000 to 5,000 dollars per violation. This means someone could face significant liability for collecting biometric data without proper consent or notice.
Related terms
- Clearview AI
- New York company that built a face-recognition database of approximately 30 billion images scraped from public websites without consent; subject to BIPA...
- Aadhaar
- India's national biometric identity programme, administered by UIDAI. Links a 12-digit UID to 10 fingerprints, iris scans, and a facial photograph for...
- Conformity Assessment
- The process by which a provider of a high-risk AI system (such as a face recognition database for law enforcement) demonstrates compliance...
- DPDP Act 2023
- Digital Personal Data Protection Act 2023. India's general data protection statute, in force in phases from 2024. Applies to IoT-collected personal data...
- EU AI Act 2024
- Regulation (EU) 2024/1689, the first comprehensive AI regulatory framework, which prohibits real-time biometric identification in publicly accessible spaces with three narrow exceptions,...
- GDPR Article 9
- The EU General Data Protection Regulation provision classifying biometric data used for unique identification as a special category requiring explicit consent or...
- GEDmatch
- A consumer genealogy database founded in 2010, used in the Golden State Killer investigation. Changed from opt-out to opt-in for law-enforcement access...
- High-Risk AI System
- An AI system classified under Annex III of the EU AI Act as requiring mandatory technical documentation, risk management, human oversight, transparency,...
- Investigative Genealogy
- A technique that searches consumer ancestry DNA databases using crime-scene SNP profiles to identify candidate relatives of an unknown contributor, then uses...
- Law Enforcement Directive (LED)
- EU Directive 2016/680, which governs the processing of personal data by competent authorities for the purposes of prevention, investigation, prosecution and execution...
- Liveness Detection
- A biometric system component that distinguishes a live biological sample from an artefact-based spoof. Methods include blood-flow detection, ridge flexibility measurement, and...
- NAFRS
- National Automated Facial Recognition System; India's NCRB-administered national facial recognition platform for law enforcement, progressively deployed from 2020 onward.
Explained in these topics
- Biometric Evidence in Court: EU AI Act, DPDP and US StatutesIllinois Biometric Information Privacy Act (2008), prohibiting private-entity collection of biometric identifiers without written notice, stated purpose, and w...
- Major Biometric Casework: Golden State Killer and Clearview AIIllinois Biometric Information Privacy Act (740 ILCS 14, 2008). Requires informed written consent before collecting biometric identifiers and prohibits their s...