What is the statute of limitations for BIPA claims?

For years the biggest open question in Illinois biometric litigation was not whether a company broke the rules but how far back a plaintiff could reach. The Biometric Information Privacy Act never wrote down its own deadline, so defendants argued for a short one-year window and plaintiffs argued for five. In 2023 the Illinois Supreme Court settled it, and the answer favors plaintiffs.

How long is the BIPA statute of limitations?

Five years. In Tims v. Black Horse Carriers, Inc., 2023 IL 127801, decided February 2, 2023, the court held that claims under section 15 of the Act are governed by the five-year catch-all limitations period in section 13-205 of the Code of Civil Procedure. That provision sets a five-year deadline for "all civil actions not otherwise provided for." Because BIPA contains no limitations period of its own, the court reasoned, its claims fall into that catch-all.

Why not the one-year period?

The defendant argued that BIPA is a privacy statute and should borrow the one-year period in section 13-201, which covers "publication of matter violating the right of privacy." The court acknowledged that two subsections, 15(c) and 15(d), use words like "sell," "disclose," and "disseminate" that could involve publication. It still declined to split the Act. Applying one deadline to some claims and a different deadline to others would create, in the court's words, an unclear and unworkable regime, especially when the same facts can support claims under more than one subsection. One uniform five-year period keeps the rule predictable.

What the five-year window means in practice

A five-year reach-back is long for a statute that pairs it with a private right of action and fixed damages. Under 740 ILCS 14/20, a prevailing plaintiff recovers 1,000 dollars for a negligent violation or 5,000 dollars for an intentional or reckless one, plus attorneys' fees. Over five years of fingerprint scans or face templates collected without a written release, the number of alleged violations, and the exposure, can grow quickly. The practical lesson is to fix the underlying Illinois BIPA compliance gaps now, because the deadline does not shorten your risk.

Keep the evidence that protects you

The same five years defines how long your records matter. Written consents, your public retention-and-destruction schedule under section 15(a), and logs showing when biometric data was collected and deleted are what you rely on if a claim is filed. Keep them for at least the limitations period. A defense often turns on being able to show a signed release existed before collection, which is impossible if the paperwork is gone.

Next step

If you run biometric systems and touch anyone in Illinois, the five-year window means old collection practices can still surface as claims. The free 2-minute Obligation Scan checks whether BIPA applies to you and lists the notice, written-release, and retention steps that keep a lapse from becoming a class action. To compare how other states treat biometric data, see biometric privacy laws by state, and the US state privacy laws hub for the wider picture.