BIPA and the Door Reader: What Illinois Actually Requires Before an Employee's First Scan

If you buy security systems in Illinois and you are worried about biometric privacy law, you are probably worried about the wrong product.

The Biometric Information Privacy Act, 740 ILCS 14, is the only state biometric law in the country that lets a private individual sue you directly. Almost every landmark case under it has been about a fingerprint at a door or a time clock. Almost none has been about a security camera. If you are weighing a camera refresh against an access control upgrade, the legal exposure sits on the access control side, and it is worth understanding before you sign rather than after.

We are a security integrator and not a law firm. Nothing here tells you whether your deployment is compliant, and nothing here is a substitute for your own counsel. What follows is what the statute says.

The Reassuring Part, and It Is True

A photograph is not a biometric identifier under BIPA.

The statute defines a biometric identifier as a retina or iris scan, a fingerprint, a voiceprint, or a scan of hand or face geometry. It then says expressly that biometric identifiers do NOT include writing samples, written signatures, photographs, demographic data, tattoo descriptions, or physical descriptions such as height, weight, hair colour, or eye colour (740 ILCS 14/10, law.justia.com/codes/illinois/chapter-740/act-740-ilcs-14/, retrieved 2026-08-13).

An ordinary camera recording people in a corridor is producing photographs and video. Absent a system that maps face geometry, that footage is not creating BIPA identifiers. A still image in a personnel file is not a biometric identifier either.

This matters because the fear runs ahead of the statute. Buyers hear biometric privacy law and picture their camera estate. The trigger is not the camera. The trigger is a system that converts a body part into a template used to identify a person, which is precisely what a fingerprint reader, a hand-geometry reader, or a face-matching entry system does.

The Four Things a Private Entity Has to Do

Section 15 sets out the obligations, and they are concrete enough to audit.

A published retention and destruction schedule. A private entity in possession of biometric identifiers must develop a written policy, MADE AVAILABLE TO THE PUBLIC, establishing a retention schedule and guidelines for permanently destroying the data when the initial purpose for collecting it has been satisfied, or within three years of the individual's last interaction, whichever comes first (740 ILCS 14/15(a)). Publicly available is the part organisations miss. An internal policy in a shared drive does not meet the words on the page.

Written notice before the first capture. Before collecting, the entity must inform the subject in writing that a biometric identifier is being collected or stored, and in writing of the specific purpose and the length of term for which it is being collected, stored and used (15(b)(1) and (2)).

A written release. The entity must receive a written release executed by the subject (15(b)(3)). In the employment context, the statute defines written release as a release executed by an employee as a condition of employment, and the 2024 amendment added electronic signature to that definition.

No profit, and controlled disclosure. No selling, leasing, trading, or otherwise profiting from the data (15(c)). No disclosing or redisseminating it without consent, or without one of three narrow grounds: completing a transaction the subject requested, a requirement of law, or a valid warrant or subpoena (15(d)). Storage and transmission must use the reasonable standard of care within the industry, and must be at least as protective as the way the entity handles its other confidential and sensitive information (15(e)).

Notice what all four have in common. They are obligations that attach BEFORE and AROUND the scan rather than to the hardware. You do not buy your way into compliance and no product can hand it to you.

Why the Case Law Is All Doors and Time Clocks

The pattern in the litigation is not subtle.

Rosenbach concerned a fingerprint taken for a theme park season pass. Cothron v. White Castle concerned a fingerprint scan employees used to reach pay stubs and computers. The BNSF case, which produced a 228 million dollar jury verdict, concerned truck driver fingerprints at a rail facility gate. Every one is an access or identity-verification scan, repeated, on the same people, day after day.

That repetition is what made BIPA financially serious. In 2023 the Illinois Supreme Court held in Cothron that a separate claim accrues each time biometric data is collected or transmitted without the required notice and consent. Under that reading, one badge reader used by 200 employees twice a day is not one problem. It is a very large number of problems.

What Changed in 2024, and Then Again in 2026

This is where most published guidance is out of date, and where a buyer making a decision this year needs current information.

The Illinois legislature responded to Cothron. Public Act 103-769, effective 2 August 2024, added subsections (b) and (c) to Section 20. They provide that a private entity which, in more than one instance, collects the same biometric identifier from the same person USING THE SAME METHOD OF COLLECTION has committed A SINGLE VIOLATION, for which the aggrieved person is entitled to, at most, one recovery. The same single-violation rule now applies to repeated disclosures to the same recipient (740 ILCS 14/20(b) and (c)).

That is a substantial recalibration. The per-scan multiplication that made BIPA exposure look unbounded is not the operative damages rule any more.

An open question remained: whether the amendment reached conduct that predated August 2024. Lower courts split, including along county lines within Illinois. On 1 April 2026, in Clay v. Union Pacific Railroad Co. (Nos. 25-2185, 25-2761, 25-2762), the US Court of Appeals for the Seventh Circuit held that the amendment applies retroactively to cases pending when it took effect, treating the change as procedural rather than substantive. The panel reversed multiple district court rulings that had gone the other way, and it sharply reduced exposure across a large number of pending class actions.

That holding is narrower than it first reads. BIPA is an Illinois statute, and the Illinois Supreme Court is the final word on what it means. That court has not decided the retroactivity question. The Seventh Circuit is a FEDERAL court, so on a question of state law it is predicting how the Illinois Supreme Court would rule rather than settling it. Illinois state courts are NOT BOUND by Clay, and BIPA claims are routinely filed there.

The question is therefore closed in federal court in this circuit and open in Illinois state court. Anyone planning on the basis that per-scan damages are dead everywhere is planning on a prediction. Ask your counsel where that leaves you.

Read that carefully rather than as an all-clear. The statutory damages are unchanged at 1,000 dollars for a negligent violation and 5,000 dollars for an intentional or reckless one, plus attorneys' fees and costs, which are frequently the larger number (740 ILCS 14/20(a)). The private right of action is unchanged. The limitations period is five years, set by the Illinois Supreme Court in Tims v. Black Horse Carriers. What changed is the multiplier, not the duty. An entity that never obtained a written release is still an entity that never obtained a written release.

Two Provisions That Take a Large Share of Our Buyers Out of BIPA Entirely

Neither of these appears in most vendor guidance, and both matter to the sort of organisation we work with.

BIPA regulates PRIVATE entities. The statute defines private entity as any individual, partnership, corporation, limited liability company, association or other group, and then says a private entity does NOT include a State or local government agency, and does not include any court of Illinois, a clerk of the court, or a judge or justice (740 ILCS 14/10). A municipal building, a county facility, or a state agency office is not a private entity, and BIPA's obligations and its private right of action do not run against it.

Contractors working FOR a government body are also outside it. Section 25(e) provides that nothing in the Act shall be construed to apply in any manner to a contractor, subcontractor, or agent of a State agency or local unit of government when working for that State agency or local unit of government.

Read together, a biometric entry system installed at a municipal facility sits in a materially different position from the same system at a private employer down the street. That is not a loophole and we are not suggesting anyone structure around it. It is a scope line the legislature drew, and a public-sector buyer who has been told to fear BIPA is often being told to fear a statute that does not reach them.

There is also a carve-out at Section 25(d) for the Private Detective, Private Alarm, Private Security, Fingerprint Vendor, and Locksmith Act of 2004, which is worth raising with counsel if your integrator or monitoring provider is licensed under it. We are not going to characterise its scope for you.

Where the Storage Architecture Actually Does Legal Work

Most of BIPA is about process, not product. Two provisions are the exception.

Section 15(d) restricts disclosing, redisclosing or otherwise disseminating biometric data. Section 15(e) requires storage and transmission using the reasonable standard of care within the industry, at least as protective as your handling of other confidential and sensitive information.

Where face or fingerprint templates live is therefore a legal question and not only an IT preference. A reader whose templates are held on premise, under the operator's control, produces fewer parties to whom data has been disseminated than an architecture where templates sit with a third-party platform. Fewer disclosures means less to paper, less to monitor, and fewer relationships in which a 15(d) question can arise. It is the same argument, in a different statute, as the data sovereignty questions cloud-only architecture raises.

The 15(e) standard-of-care duty also puts device security squarely inside the compliance question. A biometric reader is a networked device with the same default-credential and firmware exposure as anything else on the network, which is the subject of what happens when the manufacturer becomes the vulnerability. Storing templates behind a device nobody has patched is not obviously the reasonable standard of care within the industry.

Iron Gate's Position

We sell access control with biometric options, so read what follows knowing that.

Our position is that most buyers should decide whether they need biometrics at all before deciding whose biometrics to buy. A credential-based system, a mobile credential, or a card avoids the statute rather than complying with it, and for a large share of sites it does the actual security job. Biometrics earn their place where credential sharing is the specific threat you are defending against, and where the operational gain is worth standing up the notice, release and published-schedule process that Section 15 requires. That process is real work, it is ongoing, and it belongs to you rather than to your integrator.

If you do deploy biometrics, our recommendation is on-premise template storage where the site can support it, for the reasons in the section above. And we would rather tell a public-sector buyer that BIPA's obligations do not run against them than sell them a compliance story built on a statute that excludes them.

What we cannot do is tell you whether you are compliant. No integrator can, and any vendor who says otherwise is selling something. Section 15 obligations attach to your notices, your releases and your published policy, none of which are things we supply.

Common Questions

Does BIPA apply to security cameras?

Generally not, on its own terms. Photographs and video are expressly excluded from the definition of a biometric identifier at 740 ILCS 14/10. A camera system becomes relevant where it maps face geometry to identify people, which is a different capability from recording footage.

What does BIPA require before an employee uses a fingerprint reader?

Written notice that a biometric identifier is being collected, written notice of the specific purpose and length of term, and a written release executed by the employee, all before the first capture (740 ILCS 14/15(b)). Separately, a publicly available retention and destruction schedule must exist (15(a)).

How much can a BIPA violation cost?

1,000 dollars for a negligent violation and 5,000 dollars for an intentional or reckless one, or actual damages if greater, plus attorneys' fees, costs and expert witness fees (740 ILCS 14/20(a)). Since the August 2024 amendment, repeated collection of the same identifier from the same person by the same method counts as a single violation with at most one recovery (20(b)).

Is the per-scan damages theory still live?

Not as the operative rule, with one important limit on where that is settled. Cothron established per-scan accrual in 2023, and the 2024 amendment limited recovery to one per person per method going forward. On retroactive application to earlier conduct, the Seventh Circuit held in Clay v. Union Pacific Railroad Co. (1 April 2026) that the amendment does apply retroactively. That is a federal court predicting Illinois law. The Illinois Supreme Court has not ruled, and Illinois state courts, where BIPA claims are commonly filed, are not bound by it. The duties in Section 15 are unchanged either way.

Does BIPA apply to a city or county facility?

The Act's obligations run against private entities, and the definition expressly excludes State and local government agencies and Illinois courts (740 ILCS 14/10). Section 25(e) also excludes contractors and subcontractors working for a State agency or local unit of government. Public-sector buyers should still confirm their own position with counsel.

Sources

• 740 ILCS 14, Biometric Information Privacy Act, full text, law.justia.com/codes/illinois/chapter-740/act-740-ilcs-14/, retrieved 2026-08-13
• Public Act 103-769, effective 2 August 2024, as reflected in the source notes to 740 ILCS 14/10 and 14/20
• Cothron v. White Castle System, Inc., 2023 IL 128004
• Tims v. Black Horse Carriers, Inc., 2023 IL 127801
• Clay v. Union Pacific Railroad Co., Nos. 25-2185, 25-2761, 25-2762 (7th Cir., 1 April 2026), on retroactive application of the 2024 amendment

This article describes what the statute says. It is not legal advice, it does not tell you whether your organisation is compliant, and it is not a substitute for counsel who can look at your facts.

To talk through whether a biometric reader is the right answer for your site, or whether a credential is, call Iron Gate Technologies at 904-896-5618.