The Illinois Biometric Information Privacy Act and AI Systems

The Illinois Biometric Information Privacy Act (BIPA) was enacted in 2008 and remains one of the most stringent state laws governing the collection and use of biometric data. For firms operating across multiple US states, including Illinois, understanding BIPA is essential when deploying AI systems that rely on biometric identifiers such as fingerprints, facial recognition, or iris scans. The law requires organisations to obtain written consent before collecting biometric data and to develop a publicly available retention and destruction policy. AI systems that process such data must adhere to these requirements, or risk facing lawsuits and regulatory scrutiny.

The Illinois Attorney General’s Office enforces BIPA, and private litigation is also possible. Companies using AI for identity verification or access control must ensure that their systems comply with BIPA’s consent and retention obligations. For example, a retail chain deploying facial recognition at store entrances must have explicit written consent from customers, and must clearly communicate how long the biometric data will be stored and when it will be deleted. Without such measures, the company could face class-action litigation or enforcement actions.

The law also mandates that organisations notify individuals when their biometric data is collected, stored, or used. AI systems must be designed to provide such notifications, or at least ensure that data subjects are informed through other means. Where AI is used to process biometric data, such as through machine learning models trained on facial images, these systems must be reviewed to ensure they meet BIPA’s transparency and consent frameworks. Failing to do so can result in statutory damages of up to $1,000 per violation, or $5,000 per intentional violation.

The intersection of BIPA and AI systems raises practical compliance issues. For instance, an AI-based surveillance system used by a school district must not only comply with BIPA but must also ensure that data is not retained longer than necessary. The AI models must be reviewed to confirm that they do not inadvertently store or process biometric data beyond the retention period specified by the school’s policy. Similarly, AI tools used for employee identification or access control must have clear protocols for data destruction, aligned with BIPA’s requirements.

Organisations must also consider data minimisation principles when using AI systems that process biometric data. BIPA requires that biometric data be collected only for a specific, legitimate purpose, and that such data not be used for purposes beyond those specified. AI models must be trained on data that meets these criteria, and must not retain or reuse data in ways that contradict these purposes. For example, if an AI system is trained on facial data for access control, it must not later be repurposed for marketing or profiling without fresh consent.

The law also compels organisations to implement reasonable security measures to protect biometric data. AI systems must be designed with these protections in mind. For example, encryption of stored biometric data, access controls, and audit logging are required. Where AI models are deployed in cloud environments, these security measures must be embedded into the AI lifecycle, from data collection through to model deployment. Companies must ensure that their AI governance frameworks include these elements to meet BIPA’s data protection obligations.

The Illinois Supreme Court has interpreted BIPA broadly, meaning that even unintentional violations can result in liability. This makes compliance especially important for firms using AI systems that interact with biometric data. AI developers and data controllers must ensure that their AI systems are reviewed against BIPA’s requirements at every stage of development and deployment. Regular audits of AI models and data handling processes are recommended to identify potential gaps.

The EU AI Act, which applies to AI systems placed on the EU market, also introduces obligations that align with BIPA’s principles. For example, EU AI Act Article 5 prohibits certain high-risk AI practices, including those involving biometric identification. Companies must ensure that AI systems used in Illinois or other US states comply with both local laws and EU regulations. The EU AI Act’s transparency requirements, such as machine-readable marking for generative AI systems, must also be considered when deploying AI models that process biometric data.

The EU AI Act’s Article 4 AI literacy duties apply from 2 February 2025, and national supervision from 2 August 2026. These obligations require that AI systems be designed with human oversight, including in biometric data processing. Firms must ensure that AI models used for biometric identification or surveillance have appropriate human-in-the-loop mechanisms. This is particularly important for AI systems that make decisions affecting individuals, such as access control or surveillance alerts.

The Digital Omnibus on AI, which came into force on 27 July 2026, introduces further obligations for AI systems. Companies must ensure that AI models used for biometric data processing meet these evolving standards. The act defers high-risk AI obligations to 2 December 2027, but firms must begin preparing now to meet these future requirements.

The ISO/IEC 42001:2023 standard provides a framework for AI governance, including data protection and privacy. Firms using AI systems that process biometric data must align their AI management systems with this standard. The standard’s clause 7.2 on data governance is particularly relevant, as it requires that data be collected, processed, and stored in accordance with applicable laws. The standard also supports the establishment of data protection impact assessments, which are useful for AI systems that handle biometric data.

The AI management system must also include processes for data retention and destruction, aligned with BIPA’s requirements. Regular reviews of AI models and data handling practices are necessary to ensure compliance. Firms must also consider the implications of AI certification through ISO/IEC 42006:2025, which governs certification bodies. The first UKAS-accredited certification body, BSI, was established on 15 January 2026, indicating that AI governance frameworks are becoming increasingly formalised.

• Ensure written consent is obtained before collecting biometric data
• Develop and publish data retention and destruction policies
• Implement data minimisation and purpose limitation
• Apply encryption and access controls to stored data
• Ensure AI models are reviewed for compliance with BIPA
• Include human oversight in AI systems that process biometric data
• Prepare for EU AI Act transparency and certification requirements