Guide · AI & Privacy · Illinois BIPA

BIPA in 2026: Timeclocks, Cameras & AI Interviews After the Amendment

Illinois changed the damages math in 2024, not the operating duties. A 2026 BIPA program still begins before collection: identify the biometric function, give the required notice, obtain a written release, control disclosure, publish retention rules, and make deletion real.

By Lincoln Square Law · 9-minute read

Start with the function, not the product label

BIPA analysis starts with what the system captures and derives. The statute defines biometric identifiers to include fingerprints, voiceprints, retina or iris scans, and scans of hand or face geometry. It separately covers biometric information based on a covered identifier and used to identify an individual. That means a “security camera,” “timeclock,” “voice assistant,” or “AI interview tool” is not a legal category. The relevant facts are whether the feature creates or receives one of the covered identifiers or information based on it, how the feature identifies a person, where the data goes, and what the organization does with it.

That distinction matters for cameras. Ordinary video footage is not automatically a BIPA event. A camera platform that merely records video presents different issues from a feature that extracts a face-geometry template to recognize employees, patients, customers, or visitors. Before counsel can classify the use, someone has to obtain the technical documentation, configuration settings, data flow, and vendor explanation. “Facial recognition is included” is not enough, and neither is “we turned on smart cameras.” Record the exact feature and purpose.

The 2024 amendment changed recovery, not section 15

Public Act 103-0769 responded to the damages implications of repeated scans. Section 20 now provides that repeated collection of the same biometric identifier or information from the same person using the same method of collection constitutes a single violation of section 15(b) for recovery purposes. Repeated disclosure to the same recipient using the same method likewise produces, at most, one recovery under section 15(d). The amendment also made clear that a “written release” can include an electronic signature.

Those changes do not eliminate the private right of action, the liquidated-damages provisions, attorneys’ fees, or injunctive relief. More importantly for operations, they did not repeal section 15. A business still needs a public retention-and-destruction policy, written pre-collection notice of the purpose and term, a written release, disclosure controls, and reasonable care. The compliance question therefore remains: can the business prove that the required controls existed before the first covered collection and were followed thereafter?

The operating control is a pre-collection gate

The easiest BIPA violation to prevent is the one that never begins. Put a gate between procurement or configuration and biometric activation. The system owner should not be able to enable fingerprint enrollment, face recognition, voice verification, or another covered function until Privacy or Legal has confirmed the data type, purpose, retention period, recipient list, written notice, release language, and deletion path. Procurement should also identify whether the vendor is receiving covered data, because disclosure obligations can be implicated even when the company never sees the underlying template itself.

The gate should end with evidence, not an email saying “approved.” Keep the signed or electronically executed releases, the version of the notice each person received, the public policy, the vendor terms, the technical description, and the approval record. If the system is later challenged, those materials establish what the organization understood and what controls were in place. If a material feature changes, reopen the gate instead of assuming the original approval covers the new function.

Timeclocks: treat enrollment as the legal event

Fingerprint and hand-geometry timeclocks remain the most straightforward BIPA use case because the covered data is often obvious and collection is routine. Build the workflow around enrollment. Before an employee enrolls, deliver the written notice and obtain the written release. Tie the retention period to the actual employment and payroll process.

When employment ends, the offboarding workflow should trigger deletion according to the published schedule rather than relying on a future manual cleanup project.

Audit a sample from the system, not just the policy. Select former employees and determine whether the biometric record was deleted on the schedule the policy promises. Confirm whether templates persist in backups, third-party hosted environments, test accounts, or replacement devices. If the vendor performs deletion, obtain evidence of the deletion mechanics and contractually require cooperation. A policy that promises destruction while the technical environment retains templates indefinitely is an operational gap, not a drafting problem.

Cameras: separate recording, analytics, and identification

Modern camera platforms bundle object detection, people counting, access analytics, and facial features. A BIPA review should therefore inventory features one by one. Ask whether the system creates a persistent face template, whether it matches a person against a gallery, whether the template is stored locally or in the cloud, whether the vendor can use it for its own purposes, and whether the organization can disable or delete it. The answer may differ by building, camera model, or software tier.

Do not assume a general surveillance sign is a BIPA release. Section 15(b) requires written information about collection or storage, the specific purpose and length of term, and a written release. If the organization decides a specific camera feature is covered, the notice-and-release process must match the population exposed to it. In a workplace, that may mean employees and contractors. In a customer-facing environment, the practical and legal questions become substantially harder and may counsel against using the feature at all.

AI interviews require a separate trigger analysis

An Illinois hiring tool can implicate more than one law, but the triggers are different. The Artificial Intelligence Video Interview Act applies when an employer asks applicants to record video interviews and uses AI analysis of those applicant-submitted videos for Illinois-based positions. It requires advance notice, an explanation of how the AI works and what characteristics it evaluates, and consent before the interview, with additional limits on sharing and deletion obligations. That law does not turn every recorded interview into a BIPA event.

BIPA enters the analysis if the technology actually collects or derives a covered biometric identifier or biometric information. The Illinois Human Rights Act adds another 2026 layer for AI used in recruitment and other employment decisions, including a prohibition on discriminatory effects and a notice requirement. One hiring product can therefore require three different factual determinations. Build one intake form that asks the questions for all three instead of letting HR, Privacy, and Employment counsel conduct separate and inconsistent reviews.

Vendor contracts should allocate the evidence burden

A useful biometric addendum does more than say “vendor will comply with BIPA.” Require the vendor to identify the biometric functions and data it creates or receives, limit use to the documented service, prohibit sale and unauthorized disclosure, describe retention and deletion, identify subprocessors and hosting locations, protect data using at least the statutory standard of care, support requests and litigation holds, and notify the customer before a material feature or data-use change. The contract should also address defense and indemnity for vendor-caused failures rather than assuming the general limitation-of-liability clause solves the issue.

Ask for operational proof. If the vendor says it never receives templates, require architecture or product documentation supporting that statement. If it hosts templates, require deletion confirmation and controls for backups. If a subprocessor performs recognition, identify that recipient and its role. BIPA risk often turns on facts hidden behind a software interface. Contract terms are valuable when they force those facts into the diligence record before deployment.

When a gap is discovered, preserve facts before rewriting policy

If a business discovers a biometric system operating without the expected documentation, the first move should be controlled fact preservation. Identify when collection began, who was enrolled, what method was used, which notice and release versions exist, what data was transmitted, which recipients received it, and whether any templates remain.

Preserve configuration histories, enrollment records, vendor tickets, contracts, and deletion logs. Then decide whether collection should be paused while the legal and operational gaps are addressed.

Do not “fix” the historical record by backdating forms or replacing old notices without preserving them. Remediation should show a truthful chronology: what the organization found, what it changed, when new consent was obtained if appropriate, how retention and deletion were corrected, and what vendor controls were added. That record is useful for counsel, regulators, insurers, auditors, and future diligence because it demonstrates how the company responded once it understood the issue.

Make the annual audit a systems test, not a policy recital

A mature audit selects actual systems and people. Reconcile the biometric inventory to procurement and application directories. Sample consent records. Compare policy retention periods to configured deletion. Review vendor recipient lists and subprocessors. Check whether former employees or inactive customers remain enrolled. Verify that new camera, access-control, payroll, and recruiting purchases passed the pre-collection gate. Review incidents and complaints for facts that should change the control design.

The result should be a short exception register with owners and deadlines. If no exception is found, preserve the evidence supporting that conclusion. BIPA compliance is strongest when the organization can connect a public policy to the exact system, the exact population, the signed release, the vendor flow, and the deletion event. That evidence chain is what turns a policy into a defensible operating program.