Changes To Illinois Biometric Data Law Lower Liability, But The Stakes Remain High

In recent years, a heavy question mark has weighed on companies that process biometric information as part of their standard operating procedures: What is our risk exposure?

In a previous Alert, we discussed the impact and cost of biometric data laws on online gaming and sports betting. With statutory damages of up to $5,000 per violation, the Illinois Biometric Information Privacy Act (BIPA) has presented significant potential for risk in an industry where biometric information is often collected as a matter of course to verify user identities. This risk was compounded by the Illinois Supreme Court in 2023, when it held that a claim under BIPA accrues "with every scan or transmission of biometric identifiers or biometric information without prior informed consent." Cothron v. White Castle Sys., Inc., 2023 IL 128004, ¶ 45, 216 N.E.3d 918, 929.