Law note · Illinois
Biometric Information Privacy Act (BIPA), consent duty for scraped-photo facial geometry
What it asks of an app
- Do not scrape photographs from the open web to derive facial geometry, or collect voiceprints, without first informing the subject in writing and obtaining a written release; the statute's consent duty attaches to your own act of collection regardless of whether the source page was public.
- A written release now includes an electronic signature under the 2024 amendment, so a properly executed electronic consent flow satisfies section 15(b).
- Even where you collect the same biometric identifier from the same person more than once by the same method, you face at most one statutory recovery per person per method under the 2024 amendment, not a per-scan multiplier.
When LexLint raises it
crawls_webprocesses_biometricsprocesses_voicetrains_models
What we found
Section 15(b) requires a private entity, before it may collect, capture, purchase, receive through trade, or otherwise obtain a person's biometric identifier or biometric information, to inform the subject in writing that the data is being collected or stored, inform the subject in writing of the specific purpose and retention period, and obtain a written release.
Section 10 defines biometric identifier as a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry, expressly excluding photographs and physical descriptions on their own; a scan of face geometry derived from a photograph, rather than the photograph itself, is what the statute reaches.
This is precisely the scraping fact pattern behind BIPA's most consequential litigation: Clearview AI scraped several billion photographs from the open web to construct facial-geometry faceprints without notice or consent, settled a state-court suit in May 2022 (ACLU v. Clearview AI) under a nationwide permanent injunction, and reached a roughly $51.75 million equity-stake class settlement in a parallel federal multidistrict litigation in March 2025.
BIPA carries a private right of action (section 20(a)) for each violation, liquidated damages of $1,000 or actual damages for a negligent violation and $5,000 or actual damages for an intentional or reckless one, plus attorney's fees, a materially more exposed damages structure than any general privacy act researched in this wave, none of which carries a private right of action at all.
The 2024 amendment, P.A. 103-769, effective August 2, 2024 (also referenced by a derived corpus candidate as SB 2979's damage-cap amendment, describing the same change), added section 20(b)-(c) limiting a private entity to at most one recovery per person per method of collection or disclosure, responding to Cothron v. White Castle System, Inc., 2023 IL 128004 (Ill. 2023), which had held a separate claim accrues each time biometric data is scanned or transmitted.