BIPA and hiring tools: what Illinois' biometric law covers in recruiting

Illinois' Biometric Information Privacy Act, 740 ILCS 14, requires a private entity to publish a written policy, give advance notice, and get a written release before it collects a biometric identifier such as a fingerprint, voiceprint, or face or hand geometry scan. It applies to any hiring tool that does this, not only to AI video interview platforms: fingerprint timeclocks used for onboarding, voice-analysis features in some interview software, and facial geometry captured by AI video analysis are all covered. A private right of action backs it, with damages of $1,000 per negligent violation or $5,000 per intentional or reckless violation, and Illinois' 2024 amendment changed how a "violation" is counted for repeat collection from the same person.

This page covers BIPA itself, as distinct from Illinois' separate video-interview-specific statute covered in the Illinois AI Video Interview Act. BIPA is the broader, older law; the Video Interview Act adds procedural requirements on top of it for one specific use case.

The short answer: does BIPA apply to your hiring tools

If a tool you use in recruiting or onboarding collects a fingerprint, a voiceprint, or a scan of face or hand geometry from a person in Illinois, BIPA's Section 15 requirements apply to your organization as the private entity in possession of that data, regardless of whether a vendor's software is doing the actual measuring. Ordinary photographs and video recordings, on their own, are excluded from BIPA's definition of biometric identifier; what triggers the statute is a technology deriving a measurement, such as facial geometry, from that image or recording.

What counts as a biometric identifier

The Act's definitions section limits "biometric identifier" to a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry, and separately covers "biometric information," meaning information based on a biometric identifier used to identify a person, regardless of how it is captured or stored. For recruiting tools, the two categories that come up most are facial geometry, when a video-analysis feature measures facial structure from interview footage, and voiceprints, when a tool analyzes speech patterns rather than just transcribing words. Interview Signal does not perform facial or voice biometric analysis; its transcript and scorecards are built from the words spoken, not from a geometry or voiceprint measurement, which is a distinction worth confirming with any vendor whose marketing mentions "AI analysis" of a candidate's video.

Section 15: the four things required before you collect

740 ILCS 14/15 sets out what a private entity must do before and after it collects a biometric identifier or biometric information:

Illinois' 2024 amendment, discussed below, also confirmed that "written release" is satisfied by an electronic signature, which matters for a hiring process that runs entirely online.

Where hiring tools most often touch biometric data

• Fingerprint timeclocks and badge access used once a candidate becomes an employee or placed worker, common at staffing agencies with hourly onboarding.
• AI video interview platforms that measure facial geometry or expression from submitted or live video, as distinct from platforms that only transcribe or store the video itself.
• Voice-analysis features that go beyond transcription to analyze vocal characteristics.
• Background-check or identity-verification steps that use a face scan to match a candidate to an ID document.

A tool that only records audio or video and produces a text transcript, without deriving a geometry or voiceprint measurement from it, is not collecting a biometric identifier as BIPA defines the term. The distinction is the measurement, not the recording itself; confirm which category a specific vendor's feature falls into rather than assuming from the word "AI" in its name.

Staffing agencies onboarding workers for a client site should also check who owns the timeclock or badge system the worker will use. If the agency places someone at a client that requires a fingerprint scan for building access or shift punches, and the client's system is the one collecting the fingerprint, the client is the private entity in possession of that data for BIPA purposes, not necessarily the agency. That allocation is worth confirming in the placement agreement rather than assuming, since it decides who is responsible for the written policy, the notice and the destruction schedule for that specific data.

Damages: Section 20, and why the 2024 amendment matters

740 ILCS 14/20 gives anyone aggrieved by a violation a right of action in Illinois state court or as a supplemental federal claim, for liquidated damages of $1,000 or actual damages, whichever is greater, for a negligent violation, and $5,000 or actual damages, whichever is greater, for an intentional or reckless violation, plus attorneys' fees and costs. The Illinois Supreme Court held in Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186, that a plaintiff need not allege actual harm beyond the statutory violation itself to have a right of action.

In Cothron v. White Castle System, Inc., 2023 IL 128004, the Illinois Supreme Court read the statute as it then stood to mean a separate claim accrues each time a biometric identifier is scanned or transmitted, not only on first collection, which is how a fingerprint timeclock used daily could produce damages far larger than the number of employees affected. Illinois responded with Senate Bill 2979, signed August 2, 2024 as Public Act 103-0769, which provides that a private entity that more than once collects or discloses the same person's biometric identifier or biometric information using the same method has committed a single violation, with at most one recovery for that person. The dollar amounts in Section 20 were not changed; what changed is that repeat use of the same tool against the same person is now counted once rather than per use. A federal appeals court has since applied the amendment to cases that were already pending when it took effect, according to reporting current as of this writing; confirm the current appellate posture before relying on that point for a specific case.

BIPA versus the Illinois AI Video Interview Act

A hiring process can trigger both at once: an AI video interview tool that measures facial geometry from submitted video is covered by BIPA because it collects a biometric identifier, and separately by the Video Interview Act because it is AI analysis of an applicant-submitted video interview. Meeting one statute's requirements does not automatically satisfy the other; check both.

A compliance checklist for hiring tools

• List every hiring or onboarding tool that could derive a fingerprint, voiceprint, or face or hand geometry measurement, not just tools marketed as "biometric."
• Confirm a written, publicly available policy exists with a retention schedule and destruction guidelines.
• Confirm candidates and employees get written notice of the specific purpose and retention period, and give a written release, an electronic signature is enough, before collection.
• Confirm the data is never sold, leased or traded, and disclosure is limited to the statute's narrow exceptions.
• Ask each vendor directly whether its product derives a biometric identifier as BIPA defines it, in writing, rather than relying on marketing language.
• Set a destruction process that runs automatically at the earlier of purpose-fulfilled or three years from last interaction.
• Re-check this page against the current statute text periodically; BIPA has been amended before and the pending appellate questions around the 2024 amendment may resolve further.

For the video-interview-specific notice and consent language, see the Illinois AI Video Interview Act. For recording consent generally, including states outside Illinois, see is it legal to record a job interview.