What does BIPA require before you collect biometric data?

Most BIPA lawsuits do not turn on a data breach. They turn on the moment before collection, when a company scanned a fingerprint or a face without doing the three things the statute requires first. Section 15(b) is a pre-collection checklist, and skipping any step is the violation, whether or not anyone was ever harmed.

What are the three steps in section 15(b)?

Under 740 ILCS 14/15(b), no private entity may collect, capture, purchase, receive through trade, or otherwise obtain a person's or a customer's biometric identifier or biometric information unless it first does three things. It informs the subject, or the subject's authorized representative, in writing that a biometric identifier or biometric information is being collected or stored. It informs them in writing of the specific purpose and the length of term for which the data is being collected, stored, and used. And it receives a written release executed by the subject. All three must happen before you collect.

What is a "written release"?

Section 10 of the Act defines it, and the definition is broader than a paper form. A written release means informed written consent or an electronic signature, or, in the context of employment, a release executed by an employee as a condition of employment. The 2024 amendment that added electronic signature (Public Act 103-769) confirms consent can be captured digitally. In a workplace, an employer may require the release as a condition of employment, but it still has to obtain the signed release before the first collection.

When must you give notice and get consent?

Before collection, every time a new category of biometric data or a new purpose is introduced. The duty is triggered by the act of obtaining the biometric identifier, so a notice buried in an employee handbook that no one signed, or a consent gathered after the first scan, does not meet the section. Build the notice and release into the enrollment step for any device or app that reads a fingerprint, hand geometry, or face.

How this fits the rest of BIPA

Section 15(b) is the consent duty, but it sits alongside the others. Section 15(a) requires a public written retention and destruction policy. Section 15(c) bars selling or profiting from biometric data, and 15(e) requires reasonable security. If the people you scan are your workforce, the notice-and-consent duty still applies in full, which is why BIPA reaches employee biometrics like fingerprint timeclocks.

Next step

If your product or workplace captures fingerprints, face geometry, or voiceprints, the free 2-minute Obligation Scan flags whether BIPA applies and lists the notice, consent, retention, and security steps you owe, so a missing release does not become a per-violation claim. The US state privacy laws hub shows how Illinois compares with the other biometric and privacy laws.