BIPA
By Gareth HoyleLast updated How we research
BIPA is the Illinois Biometric Information Privacy Act, which requires written consent to collect biometric identifiers and bars selling or profiting from them.
BIPA is the Illinois Biometric Information Privacy Act, 740 ILCS 14, which regulates how private entities collect and use biometric identifiers such as fingerprints, voiceprints, retina or iris scans and scans of hand or face geometry. It gives individuals a private right to sue.
What does BIPA require?
Under section 15(b), an entity must inform the person in writing of the purpose and length of collection and receive "a written release" before it collects a biometric identifier. Section 15(c) states that no private entity in possession of biometric data "may sell, lease, trade, or otherwise profit from" it.
Damages are $1,000 per negligent violation and $5,000 per intentional or reckless violation. Public Act 103-0769, effective August 2, 2024, limits repeated collection from the same person by the same method to one recovery.
Why does BIPA matter for AI training data?
BIPA matters because call recordings, video and photo libraries can contain voiceprints and face geometry. Section 15(c) makes a sale of biometric data from Illinois residents a direct risk, so sellers usually remove it or license only transcripts. See our Illinois seller guide.
Under GDPR, biometric data used to identify a person is special category data under Article 9.