Illinois Biometric Information Privacy Act (BIPA): AI Compliance Requirements

SB 2979 Amendment — Per-Violation Cap Signed into Law

Illinois Governor signed SB 2979 amending BIPA to limit cumulative statutory damages to one violation per person per defendant — regardless of how many times biometric data was collected or transmitted without consent. This caps class action exposure dramatically (Cothron ruling had created per-transaction liability). However, intentional/reckless violations remain at $5,000 per violation, and negligent violations at $1,000. The amendment is retroactive and applies to pending litigation.

IL Supreme Court — Rosenbach Doctrine Reaffirmed

Illinois Supreme Court reaffirmed the Rosenbach doctrine: plaintiffs do not need to allege actual harm to bring a BIPA claim — technical BIPA violations (consent form missing, policy not published) are sufficient for statutory damages. This keeps the private right of action robust even after SB 2979 per-violation cap. Businesses must ensure formal BIPA compliance, not just avoid data breaches.

Established that a BIPA plaintiff does not need to plead actual harm — a mere technical violation of BIPA (e.g., failing to publish a biometric retention policy or collecting fingerprints without prior consent) is sufficient for statutory damages of $1,000–$5,000 per person. This ruling is the foundation of all BIPA class action litigation and makes even technically non-harmful AI biometric use high-risk.

Outcome: Plaintiff prevailed. All subsequent BIPA class actions rely on Rosenbach. No actual harm requirement.

Held that a BIPA violation accrues each time biometric data is scanned or transmitted without consent — creating per-transaction liability. For White Castle's daily employee fingerprint timeclock scans, this meant potential $17 billion exposure before SB 2979 amendment capped per-person damages. Critical for AI systems with recurring biometric authentication.

Outcome: Per-transaction accrual confirmed. Led directly to SB 2979 legislative fix capping per-person damages.

The $650M Facebook settlement established that cloud-based AI facial recognition for content tagging triggers BIPA even when: (1) the AI computation occurs off-device; (2) the facial data is used for feature improvement rather than identity authentication; (3) the company is headquartered outside Illinois. Applies extraterritorially to any company with Illinois user data.

Outcome: $650M class action settlement. Facebook discontinued "Tag Suggestions" globally.

Resolved, at the appellate level, whether SB 2979's August 2024 per-person damages cap (already tracked by this entry) applies retroactively to BIPA claims that ACCRUED before the amendment took effect - the single biggest open question left by the Cothron per-scan-accrual ruling. The court held the cap is remedial/procedural (it modifies only the Section 20 damages provision, not the Section 15 liability standard, and sets a maximum rather than a minimum recovery), so it applies to any case pending on 2024-08-02, not just claims arising after that date. Directly changes exposure modeling for any AI vendor (facial-recognition access control, voice-biometric authentication, biometric timeclocks) facing a pre-2024 BIPA claim.

Outcome: Seventh Circuit reversed the lower courts and confirmed retroactive application (No. 25-2185, decided 2026-04-01); per-scan damages theories are no longer viable in Seventh Circuit BIPA cases. Consistent with reporting that Illinois BIPA filings fell sharply, from 427 (2024) to 150 (2025), which multiple secondary sources attribute to SB 2979 plus this ruling.