AI law comparison · Data verified 2026-08-22
California CPRA vs Illinois BIPA
California CPRA and Illinois BIPA are two of the 169 AI and data regulations Aegis Firma tracks. They have different scopes, effective dates, and penalties — and many businesses fall under both. Here is the side-by-side, drawn directly from the regulatory registry.
Find which laws apply to my businessSide by side
Summary of publicly available regulatory text. Verify against current official sources before relying on this for compliance decisions. Not legal advice.
The key difference
Illinois BIPA takes effect first, so it is usually the more urgent of the two. California CPRA tracks 4 compliance requirements and Illinois BIPA tracks 4. They are not interchangeable — meeting one does not discharge the other. The practical question is not which law is “stricter,” but which of them — or both — actually applies to your business.
California Privacy Rights Act (CPRA) — AI Provisions
The CPRA expanded CCPA to cover automated decisionmaking technology (ADMT). The CPPA's ADMT / risk-assessment / cybersecurity-audit regulations (11 CCR §§ 7120-7222) were approved 22-23 September 2025 and took effect 1 January 2026; businesses using ADMT for significant decisions must comply with the ADMT article (pre-use notice, opt-out, access) by 1 January 2027.
Full California CPRA requirementsIllinois Biometric Information Privacy Act (BIPA)
Illinois BIPA (740 ILCS 14, effective 2008, amended 2024) is the nation's strongest biometric privacy law and directly affects AI systems that collect or analyze facial geometry, voiceprints, fingerprints, hand scans, or iris/retina scans. Any business using AI facial recognition (for hiring, attendance, or identity verification), voice authentication, or biometric time-clocks in Illinois must comply. The 2024 amendm…
Full Illinois BIPA requirementsCommon questions
Could both California CPRA and Illinois BIPA apply to my business?
Yes. California CPRA and Illinois BIPA are separate regulations with separate scopes — a business can fall under both at once. California CPRA covers Applies to for-profit businesses doing business in California that meet at least one of: (1) annual gross revenues over $25M in the preceding calendar year (as… Illinois BIPA covers Applies to any private entity — not government — that collects, captures, purchases, receives through trade, or otherwise obtains a person's biometric identifie… If your operations meet both scopes, you must comply with both. Aegis Firma's free scan checks all 169 tracked regulations against your business profile so you do not have to read each law to find out.
Which has the higher maximum penalty — California CPRA or Illinois BIPA?
California CPRA: $7,500 per intentional violation or violations involving consumers under 16; $2,500 per other violation (Cal. Civ. Code § 1798.155) Illinois BIPA: $1,000 per negligent violation; $5,000 per intentional/reckless violation (private right of action) Penalty structures differ by regulator and violation type — read each law's full page for the cure periods and per-violation detail.
When does each law take effect?
California CPRA — effective 2023-01-01. Illinois BIPA — effective 2008-10-03. Dates last verified against official sources on 2026-08-22 and 2026-08-22 respectively.
Related comparisons
Stop guessing which laws apply
Answer a short questionnaire about your business and Aegis Firma tells you exactly which of 169 regulations apply — and what each one requires you to do.
Start free compliance scan