Illinois's Biometric Information Privacy Act (BIPA) is one of the most stringent biometric data laws in the country — and it has produced some of the largest class-action settlements in history. Facebook paid $650 million. Google paid $100 million. BIPA applies to any business that collects, captures, or stores biometric identifiers — including fingerprint time clocks, facial recognition in security systems, and voiceprint authentication.
If your business uses fingerprint scanners for employee clock-in, facial recognition for building access, or any biometric data collection system, BIPA requires written consent, a data retention policy, and a prohibition on selling or profiting from biometric data. The IT infrastructure behind these systems — how data is stored, who has access, how long it's retained, and how it's destroyed — is a compliance requirement, not just an operational preference.
An MSP serving Chicago businesses should have documented procedures for BIPA-adjacent systems: helping clients audit which systems collect biometric data, ensuring proper consent mechanisms are in place, and advising on retention and destruction policies. Many businesses discover BIPA liability through litigation rather than proactive review — get ahead of it.
Questions to ask a Chicago MSP about BIPA
- Have you audited client environments for systems that collect biometric data?
- Do you have procedures for helping clients document biometric data retention and destruction policies?
- Can you recommend alternatives to fingerprint time clocks that don't create BIPA exposure?