Recently, the United States Court of Appeals for the Seventh Circuit, in a unanimous decision, prevented plaintiffs from imposing massive liability on a company accused of violating the Illinois Biometric Information Privacy Act (“BIPA”) and held that Illinois’ 2024 amendment decreasing BIPA damages applies retroactively.
BIPA Background and 2024 Amendment
Enacted in 2008, BIPA regulates private entities’ collection and use of biometric data. The law requires, among other things, that private entities provide specific notice and obtain consent from the particular person whose biometric information is at issue. 740 Ill. Comp. Stat. 14/15. Significantly, BIPA includes a private right of action which permits “aggrieved” individuals to seek damages for violations of the law, with statutory damages of $1,000 for negligent noncompliance and $5,000 for willful or reckless misconduct.
As covered previously here on Privacy World, a divided Illinois Supreme Court in 2023 held that plaintiffs in BIPA actions could recover multiple times for repeated collection or disclosure of the same biometric data. In response, the Illinois legislature amended BIPA to limit an individual to at most one recovery for the improper collection of the same biometric information, or disclosure of the same biometric information to the same recipient. 740 Ill. Comp. Stat. 14/20(b) (the “2024 Amendment”).
Seventh Circuit Decision
Despite the Illinois legislature’s swift response to the Illinois Supreme Court decision, some plaintiffs have continued to seek multiple recoveries under BIPA. Plaintiffs’ argument has been that the 2024 Amendment was not meant to retroactively apply to already-filed cases or for violations occurring before the 2024 Amendment took effect.
The case before the Seventh Circuit followed this pattern. It arose from three consolidated interlocutory appeals which were pending when the 2024 Amendment went into effect. The case involved plaintiffs whose employer allegedly violated BIPA by collecting “fingerprints or hand geometry” for time clock and facility entry purposes. Clay, No. 25-2185, 2026 WL 891902, at *2 (7th Cir. Apr. 1, 2026). Significantly, each plaintiff sought statutory damages for each scan of their finger or handprints. This had the potential to create liability in the billions for the defendant.
The Seventh Circuit ruled in favor of the defendant and found that the 2024 Amendment “applies retroactively to cases pending at the time it was enacted.” Id. at *3. In reaching this conclusion, the court applied Illinois retroactivity principles. Under that framework, procedural amendments can apply to cases pending when the amendment takes effect, but substantive amendments generally cannot. The court reasoned that the 2024 Amendment was a “procedural” rather than a substantive change to BIPA because it altered only the damages regime, rather than the conduct prohibited by the statute or the elements required to state a cause of action. Because of this finding, the court ruled that the 2024 Amendment could be applied retroactively to cases pending at the time of enactment.
Conclusion
The Seventh Circuit’s decision is a significant development for employers and other businesses defending BIPA claims. While the case is limited to actions that were pending when the 2024 Amendment was enacted, it significantly curtails one of the most aggressive BIPA damages theories employed by the plaintiffs’ bar. Companies that are subject to pending BIPA actions should be aware of this decision and consider revising strategy accordingly.
Stay tuned to Privacy World to be kept in the loop on further developments.
