Your Business Uses Facial Recognition. The Legal Risk May Be Bigger Than You Think.

Your company turns on a new feature in its video conferencing platform. Meeting transcripts now label each speaker automatically. Because the update arrived with a routine notice from the vendor, nobody thought much about it.

In most states, that feature raises only ordinary privacy questions. In Illinois, however, it may implicate the Biometric Information Privacy Act, one of the most heavily litigated privacy statutes in the country.

What BIPA Requires

The Biometric Information Privacy Act, 740 ILCS 14/1 et seq., protects biometric identifiers, including voiceprints, fingerprints, retina scans, and scans of face geometry. Before collecting that information, a private entity must provide written notice, obtain a written release, and maintain a written policy governing how long the data is kept and when it will be destroyed.

Why the Exposure Is Unusual

BIPA allows individuals to sue directly, and the damages add up quickly. A prevailing plaintiff may recover liquidated damages of $1,000 for each negligent violation or $5,000 for each intentional or reckless violation, or actual damages if greater, along with attorney fees and costs.

Moreover, plaintiffs do not need to show they were harmed. In Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186, the Illinois Supreme Court held that a failure to comply with the statute is enough to allow a person to sue. The court later applied a five-year limitations period to BIPA claims in Tims v. Black Horse Carriers, Inc., 2023 IL 127801, so claims can reach back years.

The Per-Scan Problem, and the Legislature’s Response

The exposure grew further in Cothron v. White Castle System, Inc., 2023 IL 128004, where the Illinois Supreme Court held that a separate claim accrues each time a business collects or transmits biometric data without complying with BIPA. As a result, White Castle’s potential exposure was estimated at more than $17 billion. Recognizing the risk of ruinous awards, the court invited the legislature to clarify the statute.

The General Assembly responded by amending BIPA in August 2024. Under the amendment, when the same person’s biometric data is collected repeatedly by the same method, that person may recover only once. The amendment also allows consent by electronic signature. Then, in April 2026, the Seventh Circuit held in Clay v. Union Pacific Railroad Co. that the amendment applies to cases pending when it took effect.

Voice Is the New Front

As employers brought fingerprint time clocks into compliance, plaintiffs increasingly turned to AI and voice technology. In Carpenter v. McDonald’s Corp., for example, a plaintiff alleged that a drive-through AI voice assistant collected customers’ voiceprints without consent. Similarly, in Wilcosky v. Amazon.com, Inc., a federal court in Illinois certified a class in November 2025 of approximately 1.2 million people in Illinois for whom Amazon allegedly created voiceprints. In late 2025, a plaintiff in Cruz v. Fireflies.AI Corp. alleged that an AI meeting assistant violated BIPA by using speaker recognition to distinguish participants. And in May 2026, journalists, voice actors, and podcasters filed nine class actions alleging that major technology companies used their voices to train AI voice models without the consent BIPA requires.

Many of these cases may turn on a technical question: whether the technology actually creates a voiceprint. BIPA does not define the term, so courts have generally described it as measurable patterns in a person’s voice that can identify the speaker, which is different from simply recording a call. As a result, a tool that separates speakers by their vocal characteristics may cross that line even if no one markets it as biometric, a risk that also arises when AI tools screen job applicants.

Enabling a Vendor’s Feature Does Not Transfer the Risk

Many businesses never build biometric technology. Instead, they enable a feature inside software they already use, sometimes after a vendor update. Even so, the business that deals directly with the employees or customers is often the party sued, and some complaints name both the business and the vendor. When vendors themselves bear liability, by contrast, is still being litigated. Who ultimately pays often comes down to the vendor contract.

Insurance May Cover More Than You Expect, or Less

A BIPA lawsuit does not necessarily fall outside a company’s insurance program. In West Bend Mutual Insurance Co. v. Krishna Schaumburg Tan, Inc., 2021 IL 125978, for example, the Illinois Supreme Court held that a tanning salon’s general liability insurer owed a defense against a BIPA suit over customer fingerprints. The court reasoned that the suit fell within the policy’s coverage for publication of material that violates a person’s right of privacy, and that the violation-of-statutes exclusion did not apply.

Since then, however, insurers have had more success with other exclusions. In National Fire Insurance Co. of Hartford v. Visual Pak Co., 2023 IL App (1st) 221160, the Illinois Appellate Court enforced a broader violation-of-law exclusion and declined to follow the Seventh Circuit’s contrary decision in Citizens Insurance Co. of America v. Wynndalco Enterprises, LLC, 70 F.4th 987 (7th Cir. 2023). Federal courts in Illinois have also increasingly enforced “access or disclosure” exclusions. As a result, the outcome often turns on the exact wording, the policy year, and the forum.

For a company facing a BIPA claim, therefore, that means looking beyond the general liability policy to D&O, employment practices, cyber, and technology errors-and-omissions coverage. It also means looking back. Because BIPA has a five-year limitations period, one lawsuit may implicate several policy years, and older policies may not contain the biometric exclusions common in newer forms. Prompt notice under every potentially applicable policy avoids handing the insurer a late notice defense.

Before Turning On the Next AI Feature

Before turning on the next AI feature, a few steps can prevent a BIPA problem:

• Identifying where biometric data might be collected: speaker identification in meeting or call software, voice authentication, facial recognition in cameras or apps, and fingerprint or face scanners, including features added through vendor updates.

• Obtaining written notice and consent before collection begins: some businesses keep voice or face recognition disabled for Illinois users until consent is in place.

• Adopting a written retention and destruction policy: BIPA requires one.

• Reviewing vendor agreements: who is responsible for compliance, whether the vendor will indemnify the company, and how biometric data is stored and deleted.

• Reviewing the insurance program, including older policies: before a claim arrives rather than after.

In most states, a misconfigured AI feature is a compliance problem. In Illinois, it can become a class action.

If your business is facing a BIPA claim, or is unsure whether its technology collects biometric data, we can help you assess the exposure and any available insurance coverage. Contact us to discuss your matter.

This article provides general information and does not constitute legal advice. For guidance concerning a specific matter, see our AI-related litigation practice. The outcome of any matter depends on its specific facts and applicable law. To discuss potential representation, schedule a consultation. Submitting an inquiry does not establish an attorney-client relationship.