Illinois: the Biometric Information Privacy Act
BIPA applies to private employers that collect biometric data in Illinois. It requires them to:
- Publish a written retention schedule and guidelines for destroying biometric data (Section 15(a)).
- Destroy the data when the initial purpose is satisfied or within three years of the employee’s last interaction, whichever comes first (Section 15(a)).
- Before collection, inform the employee in writing of the specific purpose and how long the data will be kept, and obtain a written release, which can be signed electronically (Section 15(b)).
- Never sell, lease, trade or otherwise profit from the data (Section 15(c)).
- Disclose it only with consent or under narrow exceptions (Section 15(d)).
- Protect it at least as carefully as other confidential information (Section 15(e)).
Since August 2024, repeated scans of the same person by the same method count as one violation, and in April 2026 the Seventh Circuit held that this rule applies to cases already pending. Employees have five years to bring a claim. BIPA claims from unionised employees are pre-empted by federal labour law where the collective agreement contains a broad management-rights clause.
Other state laws that affect employers
Texas (CUBI). Employers must inform individuals and obtain consent before capturing a biometric identifier, and selling or disclosing it is restricted. Identifiers must be destroyed within a reasonable time and no later than a year after the purpose expires. Only the Attorney General can enforce the law.
Colorado. Since July 2025, employers must obtain consent before collecting employees’ biometric identifiers and keep a written biometric policy. Consent can be a condition of employment only for set purposes, which include recording the start and end of the working day and controlling access to secure locations. Identifiers must be deleted once the purpose is met, or 24 months after the last interaction if that comes sooner.
New York. Labor Law 201-a bars employers from requiring fingerprinting as a condition of employment. The state labor department treats a mandatory fingerprint time clock as a breach, so fingerprint check-in in New York must be voluntary.
Washington. Its biometric law applies only to enrolment for a commercial purpose, defined around marketing and excluding security uses, so employer attendance systems generally fall outside it.
Fines and penalties by state
| Law | Enforcement | Maximum penalty |
|---|---|---|
| Illinois BIPA | Private lawsuits, often class actions | $1,000 per negligent and $5,000 per intentional or reckless violation, per person, plus attorneys’ fees |
| Texas CUBI | Attorney General | $25,000 per violation |
| Colorado | Attorney General and district attorneys | $20,000 per violation |
| New York Labor Law 201-a | Criminal prosecution | Misdemeanour |
Even under the per-person rule, a 500-employee Illinois site that collected fingerprints without written releases faces up to $500,000 in statutory damages for a single type of violation if negligent, or $2.5 million if intentional or reckless, before legal fees.
Before you enrol the first employee
- Confirm which state laws apply. Each state’s law covers its own workforce, so a multi-state employer may need to meet several at once.
- Publish your retention schedule and destruction guidelines, with deletion triggers for each state, before the first enrolment.
- Give written notice and obtain a signed release before any scan, stating the purpose and retention period.
- Offer a non-biometric option wherever the law requires one, including for fingerprints in New York.
- Review vendor contracts and insurance for biometric claim coverage.
Free templates: Download the free consent-form and retention-policy templates →
How NCheck supports it
As the employer, you are responsible for meeting these laws. NCheck provides controls that help you do so.
- Retention automation and deletion tools to apply your destruction schedule.
- On-premises deployment keeps biometric data inside your own systems, which simplifies vendor-liability questions.
- Encrypted templates support the “reasonable standard of care” BIPA requires.
- RFID, barcode and manual check-in on the same account for employees who decline.
Common in these industries
Retail · Manufacturing · all industries
Frequently asked questions
Which US states regulate biometric attendance?
Illinois and Texas have dedicated biometric laws that apply to employers, and Colorado added employer rules in July 2025. New York bars mandatory fingerprinting of employees. Illinois is the only state where employees can sue directly.
What does BIPA require from an employer?
Before collecting any biometric data, the employer must publish a retention schedule and destruction guidelines. Each employee must then receive written notice of the purpose and retention period and sign a release. The data cannot be sold, and must be destroyed when the purpose is met or within three years of the employee's last interaction, whichever comes first.
Is a fingerprint template covered by BIPA?
Yes. BIPA covers biometric identifiers such as a fingerprint or face geometry scan, and any information based on them that is used to identify a person. A template falls within that second category, so face, fingerprint and iris templates should all be treated as covered.
Do BIPA damages still accrue per scan?
No. Since August 2024, repeated collection from the same person by the same method counts as a single violation, and in April 2026 the Seventh Circuit held this applies to cases already pending. The Illinois Supreme Court has not yet ruled on that point.
This page is general guidance, not legal advice. Laws change; confirm current requirements with your counsel.
Deploy it the compliant way
Run NCheck fully on your own server — data never leaves your network — or in NCheck Cloud. Either way, matching uses encrypted templates, and event photos can be deleted automatically after a period you set. About on-premises → · Security & compliance →