16.1 Illinois, Washington, Texas, and Facial-Recognition Limits

Illinois BIPA Is the Private-Right Prototype

Body of Knowledge 2.6.1 puts biometric identifiers and facial recognition inside Domain V.B. The exam’s prototype is the Illinois Biometric Information Privacy Act (BIPA), 740 ILCS 14, enacted in 2008. Official text: https://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=3004. BIPA applies to a private entity — a person, partnership, corporation, limited-liability company, or other organization, including a state or financial institution as defined in the statute, but not a state or local government agency or a state or federal court. Government facial-recognition policy is a different question, treated later in this section.

A biometric identifier is a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry. BIPA expressly excludes writing samples, written signatures, photographs, human-biological samples used for scientific testing, demographic data, physical descriptions (height, weight, hair color, eye color), tattoos, and donated-organ information. Biometric information is any information, regardless of how it is captured, converted, stored, or shared, based on a biometric identifier and used to identify an individual. A raw face image sitting in a camera roll is not automatically BIPA data. A face-geometry template used to identify the person in the image is.

Section 15(a) requires a private entity in possession of biometric identifiers or biometric information to develop a written policy, made available to the public, that establishes a retention schedule and guidelines for permanently destroying the data when the initial purpose for collecting or obtaining it has been satisfied or within three years of the individual’s last interaction with the private entity, whichever occurs first. Section 15(b) is the collection rule. No private entity may collect, capture, purchase, receive through trade, or otherwise obtain a person’s biometric identifier or biometric information unless it first (1) informs the subject or a legally authorized representative in writing that a biometric identifier or biometric information is being collected or stored, (2) informs the subject in writing of the specific purpose and length of term for which it is being collected, stored, and used, and (3) receives a written release. “Written release” means informed written consent, an electronic signature, or — in employment — a release executed as a condition of employment.

Section 15(c) is a categorical profit ban: no private entity in possession of a biometric identifier or biometric information may sell, lease, trade, or otherwise profit from it. That is not a “unless you disclose it in the notice” rule. There is no consent override for a sale. Section 15(d) limits disclosure, redisclosure, or dissemination to cases where the subject consents, the disclosure completes a financial transaction the subject requested, the disclosure is required by state or federal law or municipal ordinance, or the disclosure is required pursuant to a valid warrant or subpoena. Section 15(e) requires the reasonable standard of care within the private entity’s industry and a standard of care at least as protective as the entity uses for other confidential and sensitive information.

Private Right of Action and the 2024–2026 Damages Reset

Section 20 is why BIPA dominates the case law. Any person aggrieved by a violation has a private right of action in an Illinois circuit court or as a supplemental federal claim. Liquidated damages are $1,000 or actual damages, whichever is greater, for a negligent violation, and $5,000 or actual damages, whichever is greater, for a reckless or intentional violation, plus reasonable attorneys’ fees and costs and other relief, including an injunction. In Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186, the Illinois Supreme Court held that a person is “aggrieved” by a statutory violation without a separate showing of actual harm. In Cothron v. White Castle System, Inc., 2023 IL 128004, the same court held that a separate claim accrued each time a private entity scanned or transmitted the same person’s biometric data — a per-scan rule that produced annihilative class exposure. The court invited the General Assembly to revisit the statute.

The General Assembly did. Senate Bill 2979, Public Act 103-0769, became effective 2 August 2024. It amended section 20 to provide that a private entity that, in more than one instance, collects, captures, purchases, receives through trade, or otherwise obtains the same biometric identifier or biometric information from the same person using the same method of collection has committed a single violation, for which the aggrieved party is entitled to at most one recovery. A parallel single-violation rule applies to repeated disclosures of the same data to the same recipient using the same method. That is a per-person-per-method rule, not a per-scan rule.

On 1 April 2026, the U.S. Court of Appeals for the Seventh Circuit, in Clay v. Union Pacific Railroad Co., held that the 2024 amendment is a remedial / procedural change and therefore applies retroactively to cases that were already pending on 2 August 2024. Teach the per-person-per-method cap as current law, including for pending pre-amendment filings in the Seventh Circuit. A new method — a fingerprint timeclock and a later face-geometry gate on the same employee — is still a second method and a second potential recovery. A thousand scans of the same finger on the same clock are not.

Scenario. An Illinois warehouse used an unconsented fingerprint timeclock from 2019 through 2025. Each of 400 employees scanned in and out twice a day. Under Cothron, plaintiffs pleaded thousands of scans per person. Under SB 2979, as the Seventh Circuit applied it in 2026, each employee has one collection claim for that method, at $1,000 if the violation is negligent or $5,000 if it is reckless or intentional (or actual damages if greater). Counsel who still recites “$5,000 times every punch” is answering a 2023 exam.

Washington: Notice and Consent, No BIPA-Style Private Right

Washington’s stand-alone biometric statute is RCW chapter 19.375 (Laws of 2017, ch. 299). Official text: https://app.leg.wa.gov/RCW/default.aspx?cite=19.375. A person may not enroll a biometric identifier in a database for a commercial purpose without first providing notice, obtaining consent, or providing a mechanism to prevent the subsequent use of that identifier for a commercial purpose. “Enroll” is narrower than BIPA’s “collect”: it means converting the identifier into a reference template that cannot be reconstructed into the original image and storing it in a database that matches it to a specific individual. Notice is a disclosure, not considered affirmative consent, given through a procedure reasonably designed to be readily available to affected individuals. The exact notice and type of consent required are context-dependent.

Unless consent has been obtained, a person who has enrolled an identifier may not sell, lease, or otherwise disclose it for a commercial purpose except in listed circumstances (to provide a product or service the individual requested, as necessary to effect a financial transaction, to identify a missing or deceased person, or as required by law). Retention is limited to a period no longer than reasonably necessary. Enforcement is by the Washington Attorney General under the Consumer Protection Act. Chapter 19.375 does not create a private right of action like BIPA. Do not import BIPA’s statutory damages into Olympia.

Chapter 15 already taught that Washington’s My Health My Data Act (MHMD) (RCW 19.373) does create a privately enforceable Consumer Protection Act claim for consumer health data, which expressly includes some biometric data. That is a different statute with a different scope. RCW 19.375 is the BoK’s commercial-enrollment biometric law. MHMD is the health-data overlay. Name the chapter before you name the remedy.

Texas CUBI: Attorney-General Model, High Stakes per Violation

Texas’s Capture or Use of Biometric Identifier Act (CUBI) is Business and Commerce Code § 503.001. Official Attorney General page: https://www.texasattorneygeneral.gov/consumer-protection/file-consumer-complaint/consumer-privacy-rights/biometric-identifier-act. A biometric identifier means a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry. A person may not capture a biometric identifier of an individual for a commercial purpose unless the person informs the individual before capture and receives the individual’s consent. A person who possesses a commercially captured identifier may not sell, lease, or otherwise disclose it except in listed circumstances and must store, transmit, and protect it from disclosure using reasonable care and in a manner at least as protective as the person stores other confidential information. Destruction must occur within a reasonable time, but not later than the first anniversary of the date the purpose for collecting the identifier expires, subject to a security-purpose exception.

The Texas Attorney General has exclusive authority to enforce CUBI and may recover a civil penalty of not more than $25,000 for each violation. There is no private right of action. That enforcement model has still produced very large public settlements against major technology platforms that allegedly built face or voice templates from user content without the consent CUBI requires. The exam contrast is structural, not “Texas is toothless.” Illinois lets the class-action bar police the timeclock. Texas lets the Attorney General police the platform — at $25,000 a violation, without a BIPA-style per-person cap written into the statute.

Scenario. A national retailer deploys overhead cameras that build face-geometry templates to detect repeat shoplifters. In Illinois, each enrolled shopper has a BIPA collection claim unless the store obtained a written release — and SB 2979 still leaves one recovery per person for that camera method. In Texas, the same deployment is a CUBI capture-for-commercial-purpose problem for the Attorney General, not a shopper class action. In Washington, the question is whether the template was enrolled in a commercial database and whether notice, consent, or an opt-out mechanism came first.

Facial-Recognition Limits: Public Versus Private

Facial recognition is not a single national ban. It is a stack. First, face geometry is already a biometric identifier under BIPA and CUBI. A private company that templates faces in Illinois or captures face geometry for a commercial purpose in Texas is inside those statutes even if no city ordinance exists. Second, municipal public-sector bans prohibit city departments — including police — from obtaining, retaining, accessing, or using facial-recognition technology. San Francisco (2019) is the classic public-sector ban; Boston and several other cities followed with government-use ordinances. Third, a smaller set of cities regulate private use. Portland, Oregon banned city-agency use and, beginning 1 January 2021, banned private entities from using face-recognition technologies in places of public accommodation (stores, restaurants, hotels), with narrow exceptions such as unlocking the user’s own device. That private-sector city ban is the exam’s “public versus private” contrast: a San Francisco police department and a Portland department store are not the same legal fact pattern.

Some states separately restrict law-enforcement face recognition (use, logging, or probable-cause rules). Those are government-access rules, closer to Domain III than to BIPA. Do not treat a city police ban as a repeal of BIPA, and do not treat BIPA as a nationwide private-sector facial-recognition code.

Exam traps

• Reciting Cothron per-scan damages as current law fails after SB 2979 and the Seventh Circuit’s 2026 retroactivity holding. The current rule is one recovery per person per method.
• Washington chapter 19.375 is not BIPA-with-a-different-caption. It has no private statutory-damages action.
• Texas CUBI is Attorney General only. A $25,000-per-violation AG statute is not a consumer class action.
• Face geometry is already a BIPA/CUBI identifier. A city public-sector ban does not answer a private Illinois timeclock question.