BIPA Alert: Seventh Circuit Ruling Applies BIPA Amendments Retroactively, Ending “Per Scan” Exposure For Companies Operating In Illinois

In a major positive development for employers facing biometric privacy litigation under the Illinois’ Biometric Information Protection Act (BIPA), the Seventh Circuit Court of Appeals unanimously held that the 2024 legislative amendments to BIPA’s damages provisions apply retroactively to pending cases. This decision dramatically curtails potential billion-dollar exposure for Illinois employers and represents the definitive end of so-called “per-scan” damages.

As we previously discussed, the Illinois Supreme Court’s 2023 ruling in Latrina Cothron v. White Castle System Inc. created an untenable outcome for Illinois employers in holding that BIPA violations accrued each time an employer collected an individual’s biometric information without complying with BIPA’s notice and consent requirements. Cothron meant that employers could incur damages (ranging from $1,500 to $5,000) every time they collected employees’ biometric information without adequate notice and consent. For example, if an employee working five days per week used unlawfully collected biometric data to scan in and out four times per day (i.e., to start/end the shift and to take a lunch break), their employer could be liable for damages ranging from $1,500,000 to $5,000,000 per employee per year.

Following the Cothron ruling, the Illinois General Assembly passed, and Governor J.B. Pritzker signed, amendments to BIPA in August 2024 that eliminated these “per-scan” damages and replaced them with “per-person” damages, such that repeated non-compliant collections of the same person’s biometric information via the same method only amounted to a single BIPA violation.

The Seventh Circuit has now unanimously held that the 2024 BIPA amendments apply retroactively to any pending litigation filed before the amendments’ enactment. This decision may signal the proverbial “death knell” for smaller, individual BIPA claims, as the Seventh Circuit emphasized both the discretionary nature of BIPA damages as well as the potential impact on subject matter jurisdiction for pending cases that may no longer satisfy the amount-in-controversy threshold of $75,000. Although the Seventh Circuit’s decision does not eliminate employer exposure under BIPA, it provides more predictability for employers navigating ongoing litigation and settlement negotiations and further deflates the once-ballooning exposure for employers under BIPA.

With the rise of biometric-related technologies in employment, including some artificial intelligence systems, Illinois employers that currently use or are planning to use these tools to collect employee biometric information should immediately draft and implement a BIPA-compliant notice and consent policy. Though the BIPA threat may be diminished, it has not been altogether eliminated, so BIPA compliance remains a must.