BIPA: The Biometric Information Privacy Act

The Illinois Biometric Information Privacy Act (BIPA), 740 ILCS 14/1 et seq., enacted in 2008, is the most consequential biometric privacy statute in the United States. BIPA creates a private right of action with substantial statutory damages — $1,000 per negligent violation or $5,000 per intentional or reckless violation — and has generated thousands of class action lawsuits against Illinois employers, technology companies, retailers, and service providers.

BIPA applies to any private entity that collects, captures, purchases, receives through trade, or otherwise obtains a person's biometric identifier or biometric information. "Biometric identifiers" include fingerprints, voiceprints, retina and iris scans, and facial geometry. "Biometric information" includes any information based on a biometric identifier that is used to identify an individual. Common workplace applications that implicate BIPA include fingerprint time clocks, facial recognition access systems, iris scanners, and AI-powered video monitoring that captures facial geometry.

BIPA's key requirements for employers are: (1) a written policy establishing a retention schedule and guidelines for permanently destroying biometric data; (2) informing employees in writing of the specific purpose and length of term for which biometric data is being collected; (3) obtaining a written release from the employee before collection; and (4) not selling, leasing, trading, or profiting from biometric data; and (5) not disclosing biometric data without the individual's consent or as required by law.

BIPA's accrual timeline was clarified in 2023. In Cothron v. White Castle System, Inc. (2023), the Illinois Supreme Court held that a BIPA claim accrues each time a private entity scans or transmits biometric data in violation of the Act — not just upon the first collection. This means that an employer who scanned an employee's fingerprint at every clock-in without a proper policy potentially committed a separate BIPA violation for each scan. In a high-volume workplace, this can result in tens of thousands of violations and theoretical damages in the billions of dollars. Employers must audit their biometric data practices immediately.

Non-Compete Reform: Senate Bill 672 (Effective January 1, 2022)

Illinois enacted major non-compete and non-solicitation reforms through SB 672 (codified at 820 ILCS 90), effective January 1, 2022, which applies to all agreements entered into on or after that date. The reforms create income thresholds below which non-compete and non-solicitation agreements are entirely void.

Under the Illinois Freedom to Work Act as amended by SB 672:

For employees above the thresholds, non-competes must still satisfy a multi-factor reasonableness test. Illinois courts consider: whether the agreement is ancillary to a valid contract; whether it is supported by adequate consideration (continued employment of at least two years, or other adequate consideration, must be provided); whether it is reasonable in terms of duration, geographic scope, and activity restrictions; whether it includes a "garden leave" clause or other compensation during the restricted period; and whether the employer advised the employee in writing to consult an attorney before signing, and provided a 14-day review period.

Illinois requires attorney consultation advice and 14-day review. Under the amended Freedom to Work Act, for any non-compete or non-solicitation agreement to be enforceable, the employer must advise the employee in writing to consult an attorney before executing the agreement, and must provide at least 14 calendar days to review the agreement before signing. These are hard requirements — failure to provide the written attorney consultation advice or the 14-day review period alone renders the restriction unenforceable, regardless of how reasonable its terms are.

One Day Rest in Seven Act (ODRISA)

The Illinois One Day Rest in Seven Act (820 ILCS 140) requires that employees be given at least twenty-four consecutive hours of rest in every calendar week and at least a 20-minute unpaid meal period for shifts of 7.5 or more hours. For employees working shifts of 12 or more hours, an additional 20-minute meal period is required.

ODRISA was amended in 2022 to expand employee protections. The amendments increased penalties for violations, clarified that rest periods must be in addition to overtime requirements, and required employers to keep records of rest periods provided. ODRISA violations can result in civil penalties of up to $500 per employee per week of violation, plus attorney's fees. The Illinois Department of Labor may investigate complaints, and employees also have a private right of action.

Equal Pay Act of Illinois (EPEWA)

The Illinois Equal Pay Act of 2003 (820 ILCS 112) was substantially strengthened in 2021, creating one of the most rigorous pay equity frameworks in the country. Key provisions include:

Private employers with 100 or more Illinois employees must obtain an Equal Pay Registration Certificate from the Illinois Department of Labor by March 24, 2024 (and every two years thereafter). To obtain the certificate, employers must: certify that they comply with the Equal Pay Act and Title VII; submit wage records identifying employees by race and gender and total compensation; and certify that pay is not based on protected characteristics.

The Equal Pay Act prohibits paying employees of a different race or sex differently for substantially similar work, unless the differential is justified by a seniority system, merit system, system measuring earnings by quantity or quality of production, or a bona fide factor other than race or sex (such as education, training, or experience). Employers may not reduce any employee's wages to comply with the Act — they must bring up the lower-paid employees.

Illinois Paid Leave for All Workers Act (Effective January 1, 2024)

Illinois became the third state in the US to enact a general paid leave law when the Paid Leave for All Workers Act (820 ILCS 192) took effect on January 1, 2024. Unlike many state sick leave laws that are limited to use for illness or medical care, Illinois's paid leave law allows employees to use the accrued leave for any reason whatsoever — employees do not need to state a reason for taking leave.

Under the Act: employees accrue one hour of paid leave for every 40 hours worked, up to a maximum of 40 hours per year. Employees may begin using accrued paid leave after 90 days of employment. Accrued but unused leave carries over from year to year, but employers may cap the total accrual at 40 hours and may also provide 40 hours of leave at the beginning of each year ("front-loading") rather than requiring accrual.

Employers may not require employees to find a replacement worker as a condition of taking paid leave, may not penalize employees for taking leave, and may not require documentation of the reason for leave. Violations carry civil penalties of $2,500 per violation plus damages equal to the wages owed for the leave not provided.

Practical Compliance Checklist for Illinois Employers

Employers operating in Illinois should review their practices against this compliance checklist: