Since its enactment in 2008, Illinois’s Biometric Information Privacy Act (“BIPA”) has been recognized as a pioneering law in biometric privacy, imposing strict requirements on private entities that collect or use biometric identifiers such as fingerprints, facial geometry, and voiceprints. Its unique combination of a private right of action, statutory damages, and no requirement to prove actual harm has made it a powerful tool for plaintiffs and a persistent source of exposure for companies.
Following the first legislative amendment to the statute in 2024, courts and litigants faced critical questions about the scope of liability and the retroactive application of new rules, and in the years that have followed there have been split opinions at the state and district court levels. Last month, the U.S. Court of Appeals for the Seventh Circuit held that the 2024 amendment, which limited statutory damages to a single recovery per person, applies retroactively to cases that were already