Illinois BIPA in 2026: What a Major Court Ruling Just Changed for Biometric Data

Illinois' Biometric Information Privacy Act has generated more than $1.5 billion in settlements since it was enacted in 2008, making it one of the most consequential privacy statutes in the country, despite applying to a narrow category of data. If your Shopify store touches biometric information in any way, even indirectly, this is the law you cannot afford to misjudge.

The Basics

BIPA requires any private entity collecting biometric identifiers, fingerprints, facial geometry scans, iris scans, or voiceprints, to provide written notice, explain the purpose and retention period, and obtain written consent before collection. It also requires a publicly available retention and destruction policy, and it prohibits selling biometric data outright.

What makes BIPA uniquely dangerous compared to most privacy laws is Section 20: a private right of action. Individuals can sue directly, without needing to prove they suffered actual harm. The 2019 Illinois Supreme Court case Rosenbach v. Six Flags settled this clearly: the violation itself, collecting biometric data without proper notice and consent, is the injury.

Why the Numbers Get So Large

Statutory damages run $1,000 per negligent violation or $5,000 per intentional or reckless violation, plus attorney fees. Facebook's $650 million settlement remains the largest to date. Google Photos settled for $100 million, TikTok for $92 million, and Motorola's FaceSearch product settled for $47.5 million as recently as 2025.

What Changed in 2026

In August 2024, Illinois amended BIPA to address a costly ambiguity: previously, each individual scan of the same person using the same method could count as a separate violation, meaning a single employee's fingerprint clock-in over years could generate thousands of violations. The amendment clarified that repeated collection of the same person's data by the same method counts as one violation per statutory provision, not one per scan.

The open question was whether this cap applied retroactively to cases already filed. On April 1, 2026, the Seventh Circuit Court of Appeals ruled in Clay v. Union Pacific Railroad Company that it does. This is a meaningful shift, businesses facing pending BIPA litigation now have a real damages ceiling that didn't clearly exist before.

Does This Actually Apply to Your Store

For the overwhelming majority of Shopify sellers, no. BIPA's scope is narrow: fingerprints, facial geometry, retina or iris scans, voiceprints, and hand geometry. General e-commerce data, names, addresses, purchase history, email, falls entirely outside it.

Where it becomes relevant: AI-powered virtual try-on or fitting tools that analyze facial geometry, voice-based customer service or authentication features, fingerprint or facial login for a loyalty app, or any product that itself collects biometric data, like smart wearables or security hardware.

If BIPA Does Apply

Three things matter most: written consent obtained before any collection, a publicly available retention and destruction schedule, and a firm no-sale policy on biometric data. Given the statutory damages and the active plaintiff's bar in this space, this is not an area to guess on.

Check Your Illinois Exposure

All information in this article is sourced from the Illinois Biometric Information Privacy Act (740 ILCS 14), the Seventh Circuit's ruling in Clay v. Union Pacific Railroad Company (2026), and independent legal analysis from Hunton Andrews Kurth and Squire Patton Boggs. Regulens is informational only and this article is not legal advice. Speak to a licensed privacy attorney about your specific compliance situation.

Regulens tracks Illinois as part of its ongoing state-by-state privacy coverage. Your store's readiness is calculated based on your actual inputs and current policy documents.

Free to check, takes three minutes, no credit card needed. Not legal advice. Informational only.

Check your store's Illinois privacy readiness at getregulens.com