Illinois Employers May Expect Significantly Reduced Liability in BIPA Lawsuits

Illinois’ Biometric Information Privacy Act (“BIPA”), enacted in 2008 to protect individuals’ biometric privacy and address the unique risks associated with the collection of immutable biometric identifiers, regulates the collection, use, and storage of data such as fingerprints, hand scans, and facial recognition, which many employers use for timekeeping and facility access. Illinois BIPA imposes strict requirements, including notice, written consent, and retention policies, and it is a strict liability statute. Before Cothron v. White Castle System, Inc., courts interpreting Illinois BIPA claims increasingly allowed plaintiffs to pursue damages on a per-scan basis, meaning each individual biometric scan could constitute a separate violation. In practice, this created the potential for extraordinary exposure, as routine, repeated scans across a workforce over time could multiply damages into the billions, including, for example, in Cothron, where the potential damages at issue exceeded $17 billion.

 In Cothron, a White Castle employee alleged that her employer used fingerprint scans for timekeeping and system access without proper consent under Illinois BIPA. The Illinois Supreme Court held that each scan constituted a separate violation, confirming the expansive per-scan damages framework and significantly increasing potential liability. In response, the Illinois legislature amended Illinois BIPA in 2024 to clarify that damages are recoverable on a per-person basis, rather than per scan, for the same biometric data collection method.

 Most recently, on April 1, 2026, the U.S. Court of Appeals for the Seventh Circuit, in Clay v. Union Pacific Railroad Co., confirmed that this limitation applies retroactively to pending Illinois BIPA claims, limiting plaintiffs to a single recovery per individual even for pre-amendment conduct. This decision establishes the controlling damages framework for Illinois BIPA claims, including those currently pending, and is expected to materially reduce potential liability and reshape settlement dynamics in those cases. While this ruling significantly limits damages exposure, Illinois BIPA remains a strict liability statute with ongoing compliance obligations. Employers should continue to ensure that their biometric policies and practices, including notice, consent, and retention procedures, comply with Illinois BIPA requirements as the legal landscape continues to evolve.

Follow us on LinkedIn for additional Legal Updates.

Masuda Funai is a full-service law firm with offices in Chicago, Detroit, Los Angeles, and Schaumburg^.