Rules
Illinois BIPA and Face-Match Apps: What the Biometric Privacy Law Requires
What Illinois' Biometric Information Privacy Act requires before an app collects face data, how its damages work, and what the FTC adds for face-match tools.
What to take away
- Illinois' Biometric Information Privacy Act (BIPA) lists a "scan of hand or face geometry" among the biometric identifiers it covers.
- Before a private entity collects such data, it must inform the person in writing, state the purpose and length of term, and receive a written release.
- A person can sue without proving any harm beyond the violation itself. The Illinois Supreme Court said so in 2019.
- Statutory damages are $1,000 for a negligent violation and $5,000 for an intentional or reckless one, or actual damages if greater, plus attorney fees and costs, under the text the Court quoted.
- The Federal Trade Commission (FTC) applies a separate layerno deceptive claims about accuracy or data use, and no secret collection.
Why a lookalike app is a BIPA question
A face-match app takes a photo, measures the face and compares the measurements with a gallery. The comparison is the product. Our piece on what happens after a selfie upload describes the chain: the file, a face crop, a numeric embedding and sometimes location metadata. Whether those measurements fall within BIPA depends on how the statute defines its terms.
The Illinois Supreme Court recited the definitions in Rosenbach v. Six Flags Entertainment Corp. (2019 IL 123186). The Act defines "biometric identifier" as "a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry". "Biometric information" means "any information, regardless of how it is captured, converted, stored, or shared, based on an individual's biometric identifier used to identify an individual."
Two phrases matter for an app. "Scan of face geometry" is wide enough that a tool measuring the layout of a face is a candidate for coverage. And "regardless of how it is captured, converted, stored, or shared" means that converting a face into numbers does not obviously take it outside the Act. The statute also has further definitions and exclusions, so read the current text on the Illinois General Assembly site before deciding that a given feature is in or out. An app built to be used by Illinois residents should treat its face measurements as covered unless counsel has advised otherwise.
What must happen before collection
Section 15(b) is the provision the Court quoted at length. It says no private entity may "collect, capture, purchase, receive through trade, or otherwise obtain" a person's biometric identifier or biometric information unless it first does three things:
- Informs the person, or a legally authorized representative, in writing that a biometric identifier or biometric information is being collected or stored.
- Informs them in writing of the specific purpose and length of term for which it is being collected, stored and used.
- Receives a written release executed by the person or their legally authorized representative.
The order of words matters: "first". Consent collected after the photo is uploaded and processed does not satisfy the section as the Court quoted it. For a quiz or lookalike tool, that points to a notice and release step ahead of the upload button, not a line in terms of service shown afterwards.
The Court also noted that the Act covers collection, retention, disclosure and destruction. In the Rosenbach complaint, the plaintiffs alleged the defendants had no publicly available written policy on retention schedules and destruction. The opinion quotes that allegation, but it does not set out the full text of the retention provisions, so check section 15 as a whole when drafting a retention policy.
Who can sue, and for how much
Section 20 gives "any person aggrieved by a violation of this Act" a right of action in state circuit court or as a supplemental claim in federal district court. A prevailing party may recover for each violation:
- liquidated damages of $1,000 or actual damages, whichever is greater, against a private entity that negligently violates the Act;
- liquidated damages of $5,000 or actual damages, whichever is greater, against one that intentionally or recklessly violates it;
- reasonable attorneys' fees and costs, including expert witness fees; and
- other relief, including an injunction.
The key holding in Rosenbach is that a plaintiff does not need to show actual injury beyond the statutory violation. The Court held that when a private entity fails to comply with one of section 15's requirements, that failure is an invasion, impairment or denial of the person's statutory rights. The person is "aggrieved", and "no additional consequences need be pleaded or proved." The Court rejected the idea that these are merely technical violations, reasoning that the Act gives people notice before collection and the power to say no.
That is why the Act matters to small developers as well as large platforms. The text turns a missing notice or release into a claim, and the damages are set per violation. The damages quoted above come from the Court's 2019 recital of the statute. The Act may have been amended since in ways that affect how violations are counted, so confirm the current wording of section 20 on the Illinois General Assembly site and ask counsel how it applies to your user numbers.
The Court also cited the General Assembly's own findings: biometrics are biologically unique, so once compromised, the individual has no recourse, is at heightened risk of identity theft, and is likely to withdraw from biometric-facilitated transactions. Expect courts to read the Act with that purpose in mind.
What the FTC adds for face-match tools
BIPA is a state statute. The FTC's May 2023 Policy Statement on Biometric Information applies nationwide through the FTC Act, and it names practices relevant to lookalike apps:
- False or unsubstantiated claims about the accuracy or effectiveness of biometric technologies may be deceptive. A headline match percentage is exactly this kind of claim, which is why our guide to what US tools get wrong about accuracy matters.
- False or unsubstantiated claims about how biometric data is collected or used may also be deceptive.
- Factors the FTC will weigh on unfairness include not assessing likely harms before collecting data, collecting or using it in secret or in unexpected ways, not vetting third parties that access the data, not training staff, and not monitoring the technology over time.
The FTC also warned that facial recognition may have higher error rates for some populations than others, and that large biometric databases attract malicious actors. In December 2023, the FTC announced an order against Rite Aid over its facial recognition program. The order requires notice when biometric information is enrolled in a database, deletion of images and the algorithms built from them, deletion of biometric information within five years, and a five-year ban on using facial recognition for surveillance. That order concerned a retailer, not a lookalike quiz, but it shows the kinds of conditions the agency considers reasonable.
A practical checklist for a face-match feature
- Decide whether the feature measures face geometry. If it does, treat the data as biometric.
- Show a written notice before any uploadwhat is collected, why, and for how long.
- Collect a signed or clearly recorded written release before the photo is processed, and keep a record of it.
- Publish a retention and destruction policy, and delete on the schedule it states.
- Do not sell or share face data without checking the rules on disclosure.
- Keep accuracy claims modest and supportable. See how US sites score a pair.
- Review the vendors that touch the data, and record what they do with it.
For the related question of how photo-based quizzes treat the images you give them, see our overview of lookalike quizzes. None of this is legal advice. A developer with Illinois users should have counsel review the notice, release and retention terms.
