Major Biometric Win for Business in Illinois: 3 Lessons as Federal Appeals Court Says BIPA Damages Limit Applies Retroactively to Pending Cases
A federal appeals court just handed Illinois businesses a significant victory, holding that the 2024 amendment to BIPA capping damages at one recovery per person – not one per scan – must be applied to all cases already pending when the amendment was enacted. The 7th Circuit Court of Appeals’ April 1 ruling just resolved one of the most consequential open questions in Illinois biometric privacy law: employers and companies defending against pending Illinois Biometric Information Privacy Act (BIPA) lawsuits can now invoke the 2024 damages amendment that dramatically limits their exposure. What three lessons can you learn from this key ruling, and what three actions steps should you consider?
Background: From “Annihilative liability” to Legislative Action
BIPA has been a litigation magnet since class action lawsuits began flooding Illinois courts in 2018, targeting companies that use fingerprint timeclocks, facial recognition, and other biometric technology. The problem hit a crisis point in February 2023, when the Illinois Supreme Court ruled in Cothron v. White Castle that a separate BIPA violation – and therefore a separate potential damages award – accrued every time a person scanned their biometric information.
To put it in perspective, every single login using the technology racked up another basis for statutory damages. For the employer at issue, that amounted to hundreds of violations per employee over a period of many years. The Illinois Supreme Court itself acknowledged this approach could generate “annihilative liability” and invited the legislature to step in.
The legislature did exactly that. In August 2024, Governor Pritzker signed SB 2979 into law, amending BIPA Section 20 so a company that repeatedly collects biometric information from the same person using the same method has only committed a single violation, entitling that person to “at most, one recovery.”
Billion-Dollar Question
The amendment took effect immediately, but left open the critical question: does it apply to cases that were already in court? The financial stakes were enormous.
- One single plaintiff alleged his employer scanned his fingerprint approximately 1,500 times, potentially worth $7.5 million in statutory damages under the old per-scan standard.
- A second case was filed as a class action that could have exposed another employer to billions of dollars in statutory damages.
- A third single plaintiff alleged another employer collected his hand geometry through a biometric timeclock, with potential class-wide exposure running into the hundreds of millions.
Notably, there was no evidence that any of these plaintiffs had suffered actual harm or damages. Nor was their biometric data breached in any way.
Court Delivers Big Win for Companies
Chief Judge Michael Brennan, writing for a unanimous panel in Clay v. Union Pacific, held that the 2024 amendment applies retroactively to all pending cases. The court’s reasoning turned on the distinction between “substantive” and “procedural” changes under Illinois law:
- A substantive amendment changes the rights, duties, and obligations between parties, or alters when a cause of action arises. These do not apply retroactively.
- A procedural amendment changes how rights are enforced or what remedies are available. These do apply retroactively under Illinois law.
The court concluded the 2024 amendment is firmly in the procedural camp. It did not change Section 15 of BIPA, the portion that sets substantive standards for biometric data collection. Instead, it amended Section 20, the provision that governs damages. Because the amendment addressed only the availability of a remedy, not whether conduct was unlawful, it constitutes a procedural (and thus retroactive) change.
The court also rejected plaintiffs’ argument that the amendment effectively negated thousands of “violations” by recharacterizing them as a single one. The court noted that the word “violation” appears only in Section 20, not Section 15, and that the Cothron decision addressed when claims accrue under Section 15, not how damages are calculated under Section 20. Those are different questions.
On alleged constitutional concerns, the court found none. Illinois courts have long recognized that plaintiffs have no vested right to a particular remedy before judgment is entered, the court said, and the amendment actually reduces annihilative liability for defendants, which may be more susceptible to due process scrutiny. Therefore, the court found no due process problem exists on either side.
3 Big Lessons for Employers and Companies
This ruling has immediate, practical consequences for any Illinois company or employer currently defending a BIPA lawsuit. The three biggest?
- Pending cases are covered. Employers with cases filed before the August 2024 amendment can now invoke the per-person damages cap. This ruling eliminates the argument that the amendment only governs new cases filed after its effective date.
- Class action exposure is sharply reduced. Under the old per-scan model, class actions involving thousands of employees scanning in and out daily could generate billions in exposure. The per-person cap dramatically compresses that number. And devalues cases.
- District courts must reevaluate damages – and possibly jurisdiction. The 7th Circuit specifically noted that district courts on remand may need to reconsider subject matter jurisdiction in light of the ruling, since lower damages could affect whether cases meet the threshold for federal court.
3 Things Employers Should Do Now
In light of this massive decision, here are some key actions you should consider taking to capitalize on the victory.
1. Review existing cases. If your company is currently defending a BIPA case, this ruling should prompt you and your counsel to conduct an immediate review of the damages exposure in that litigation in light of the per-person cap. If you were previously evaluating settlement options based on per-scan liability figures, you need to revisit those calculations (and encourage plaintiffs’ counsel to recalibrate their expectations).
2. Reevaluate existing liability. Work with counsel to proactively communicate this development to relevant stakeholders like insurers, risk management teams, and corporate leadership who may have been carrying BIPA exposure on their books based on the old per-scan damages framework. Updated liability estimates could have meaningful implications for reserves and coverage.
3. Keep your guard up. This ruling will reduce the per-case ceiling but will likely not reduce the volume of BIPA cases. New technology is being targeted in lawsuits daily. Illinois employers using biometric access systems, facial, video, or voice analysis, AI notetaking technology, or any other technology that captures or analyzes biometric identifiers should continue reviewing their consent processes, data retention schedules, and vendor agreements to ensure full compliance with BIPA’s substantive requirements.
Conclusion
Fisher Phillips will continue to monitor developments in BIPA litigation and related biometric privacy law. Make sure you are subscribed to Fisher Phillips’ Insight System to receive updates directly in your inbox. If you have questions about how this ruling affects your pending litigation or your biometric data practices, please reach out to your Fisher Phillips attorney, the author of this Insight, any member of our Chicago office, or any member of our Privacy and Cyber Practice Group.
Related People
