Illinois BIPA (Biometric Information Privacy Act) – Definition
Illinois BIPA is an Illinois state law that regulates the collection, storage, disclosure, and destruction of biometric data. The full name of the statute is the Biometric Information Privacy Act. It was enacted in 2008 as Illinois Public Act 095-0994 and is primarily codified at 740 ILCS 14. In practice, it is widely regarded as one of the strictest biometric privacy laws in the United States because it imposes prior written consent requirements, notice obligations, a retention policy requirement, and a private right of action for individuals whose data is affected.
In the context of photos and video recordings, BIPA becomes relevant when a biometric identifier is created from an image, or can be created from it, such as a mathematical face template used for facial recognition or identity verification. A photograph itself is generally not considered a “biometric identifier” under BIPA. However, extracting facial features from an image and converting them into a biometric template may fall within the scope of the law. This distinction is especially important for AI systems used in image analysis, deep learning model training, and automatic face blurring.
The Scope of BIPA in Photo and Video Processing
BIPA distinguishes between several legal concepts. For compliance teams and Data Protection Officers, the key issue is separating an ordinary image from data generated through biometric analysis of that image. It is precisely this technical transformation of visual material into features used for identification that creates the greatest regulatory risk.
The law defines, among other things, a biometric identifier and biometric information. In practice, these statutory definitions are interpreted broadly, especially by Illinois courts.
- Biometric identifier – includes, among other things, a hand scan, fingerprint, face geometry, and a retina or iris scan.
- Biometric information – any information, regardless of how it is captured, converted, stored, or shared, that is based on an individual’s biometric identifier and used to identify that person.
- Exclusion – a photograph as such is not covered by the definition of a biometric identifier, but data extracted from a photograph may be covered by the law.
For image anonymization, this means that a tool used solely to detect and blur a face does not automatically involve biometric data under BIPA, provided it does not create or store a template used to identify a person. The situation is different when a system compares faces across recordings, assigns identities, performs 1:1 or 1:N matching, or builds persistent profiles of individuals.
Legal Obligations Under BIPA
The most important feature of BIPA is its “notice + written consent” model before collecting or otherwise obtaining biometric data. The obligations go beyond consent alone. The law also requires formal lifecycle management of biometric data.
- informing the individual in writing that a biometric identifier or biometric information is being collected or stored,
- specifying the particular purpose and duration of processing,
- obtaining written consent or a written release,
- developing a publicly available retention schedule and guidelines for permanent data destruction,
- prohibiting the sale, lease, trade, or profiting from biometric data,
- restricting disclosure to third parties unless a statutory exception applies,
- using a reasonable standard of care, at least as protective as for other confidential data.
Under 740 ILCS 14/15, biometric data must be destroyed once the purpose for collecting or obtaining it has been satisfied, or within 3 years of the individual’s last interaction with the private entity, whichever comes first. This is one of the few privacy law retention deadlines in the United States that is stated so specifically.
Why BIPA Matters for Face Blurring and AI Model Training
In practice, two technical stages should be distinguished. The first is object detection in an image, such as detecting a face or a license plate. The second is identifying a person based on biometric features. BIPA primarily affects the second stage, but litigation shows that the line is not always clear and depends on the system architecture and on how intermediate data is recorded or retained.
To build an effective AI model for face blurring, developers typically use deep learning and training datasets containing faces labeled with bounding boxes, landmarks, or segmentation masks. Training a detection model does not necessarily mean that biometric identifiers are being used, as long as the goal is to locate a face in the frame rather than determine the identity of a specific person. The risk increases when the technical pipeline includes:
- face embeddings, meaning vector-based facial feature representations used to distinguish or identify individuals,
- face similarity matching across images and videos,
- creating a reference gallery of individuals,
- linking visual data with other user identifiers.
From a compliance perspective, it is safer to design an anonymization process so that the system does not create persistent identification templates, does not retain embeddings longer than necessary, and does not use face detection for personal identification. In this model, the purpose is image redaction, not biometric identification.
BIPA Penalties and Litigation
BIPA provides a private right of action. This is the main reason why the law has such major operational significance. The statute provides for liquidated damages for violations, regardless of whether actual financial harm can be proven in the traditional sense.
Type of violation
Statutory damages
Legal basis
Negligent violation
USD 1,000 per violation or actual damages
740 ILCS 14/20
Intentional or reckless violation
USD 5,000 per violation or actual damages
740 ILCS 14/20
In Rosenbach v. Six Flags (Illinois Supreme Court, 2019), the court confirmed that a person may sue based solely on a violation of the statute’s requirements, without proving additional harm. In Cothron v. White Castle (Illinois Supreme Court, 2023), the court held that a claim could arise with each separate collection or transmission of biometric data. This significantly increased the scale of financial risk in high-volume processing operations. Illinois lawmakers later limited the accumulation of claims, generally allowing one claim per person for collection-related violations and one claim per person for disclosure- or transmission-related violations.
Key Factors for Assessing BIPA Risk in Video Systems
For compliance assessments, it is not enough to ask whether a system “uses AI.” You must describe what data artifacts are generated and whether they can be used to identify a person. For video analytics and image processing systems, the following checklist is useful.
- Purpose of processing – detection for blurring or identification of a person.
- Type of intermediate data – bounding box, landmarks, embedding, template.
- Retention – storage period for frames, models, logs, and intermediate features.
- Re-identification capability – 1:1 matching, 1:N matching, similarity threshold, reference database.
- Security – encryption, access control, environment segregation, access auditing.
- Scale of operations – number of individuals, number of extraction events, scanning frequency.
From a technical standpoint, it is worth documenting at least: the pipeline architecture, where facial features are generated, numeric retention periods in days, detection error rates, and whether logs contain data that makes identification possible. This information is needed for risk analysis and for responding to questions from legal teams or auditors.
Practical Context for Photo and Video Anonymization
When publishing visual materials, the primary goal is usually to reduce privacy risk by blurring faces and license plates. In this scenario, the scope of data should be minimized and identity recognition features should be avoided unless they are strictly necessary. This approach is consistent with both privacy by design and limiting exposure under BIPA.
In practice, this means preferring solutions that automatically detect faces and license plates solely for the purpose of anonymizing the material. If other elements in the frame also need to be hidden, they should be redacted manually in an editor, without expanding the scope of automated analysis to additional categories of objects and without building extra identification profiles.
Legal References and Sources
The primary basis for interpretation should be the statutory text and case law, not secondary commentary. In compliance projects, it is worth relying on the following sources:
- Illinois Biometric Information Privacy Act, 740 ILCS 14, current version.
- Illinois Public Act 095-0994, enacted in 2008.
- Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186.
- Cothron v. White Castle System, Inc., 2023 IL 128004.
- Public Act 103-0769, amendments concerning the calculation of statutory damages.
- FTC materials on data security practices and privacy by design as supplementary operational context.
See Also
- Data anonymization
- Face blurring
- Data security
- AI in data protection