Seventh Circuit Ruling Ends Per Scan Damages in Illinois Biometric Privacy Law Cases

Federal Court Decision Applies 2024 BIPA Amendments Retroactively to Pending Litigation

A unanimous Seventh Circuit Court of Appeals ruling has dramatically reduced potential liability for Illinois employers facing biometric privacy lawsuits by applying 2024 legislative amendments retroactively to pending cases.

The decision in Clay v. Union Pacific Railroad Co. resolves a heated legal debate that had exposed businesses to what critics called "existential financial risk" from the state's toughest biometric privacy law.

The Per Scan Damages Problem

Under the Illinois Biometric Information Privacy Act, employers faced massive liability for failing to obtain proper notice and consent before collecting biometric data from employees or customers.

Before August 2024, each noncompliant scan counted as a separate violation. A single employee whose fingerprint was scanned at a timeclock each day could generate thousands of individual violations over their employment.

The lead plaintiff in the Union Pacific case, Reginald Clay, alleged his fingerprint had been scanned 1,500 times, which could have resulted in $7.5 million in damages for him alone.

Other Illinois employers faced similar exposure. A single employee working five days per week who used unlawfully collected biometric data to scan in and out four times per day could trigger $1,500,000 to $5,000,000 per employee per year in damages.

The 2024 Legislative Fix

The Illinois General Assembly passed amendments to BIPA in August 2024, which eliminated per scan damages and replaced them with per person damages.

Under the new framework, repeated noncompliant collections of the same person's biometric information via the same method count as a single violation rather than multiple violations.

The amendments were signed into law by Governor J.B. Pritzker and were designed to provide more predictability for businesses while maintaining BIPA's core protections.

The Retroactive Ruling

On April 1, 2026, the Seventh Circuit ruled unanimously that the 2024 BIPA amendments apply retroactively to pending litigation filed before the amendments' enactment.

"The ruling is meaningful good news for companies currently defending BIPA litigation," according to legal analysis from Latham & Watkins. "It takes away the most alarming damages scenarios that had been driving high pressure settlement negotiations and in some cases existential financial risk."

The court held that because the amendment affects only the damages available to plaintiffs, not the underlying standards for liability, it is remedial in nature and applies retroactively.

Death Knell for Smaller Claims

The decision may signal the "death knell" for smaller, individual BIPA claims, according to legal analysts.

The Seventh Circuit emphasized both the discretionary nature of BIPA damages as well as the potential impact on subject matter jurisdiction for pending cases that may no longer satisfy the amount in controversy threshold of $75,000.

"Illinois employers that currently use or are planning to use these tools to collect employee biometric information should immediately draft and implement a BIPA compliant notice and consent policy," according to legal analysis from Foley & Lardner.

"Though the BIPA threat may be diminished, it has not been altogether eliminated, so BIPA compliance remains a must."

Important Caveats

Despite the ruling, several important limitations remain.

First, the Seventh Circuit's opinion is not the final word on this issue. Because retroactivity of a state law amendment is ultimately a matter of Illinois law interpretation, the Illinois Supreme Court will have final say.

"If a pending state court case reaches that court, it could theoretically rule differently," according to legal analysis from Latham & Watkins. "The legal picture may continue to evolve."

Second, companies are still on the hook for BIPA violations. The amendment and the Seventh Circuit's ruling reduced the magnitude of damages, not the existence of liability.

"Businesses that are not compliant with BIPA's notice, consent, and retention policy requirements remain exposed to claims," according to legal analysis from Latham & Watkins.

Emerging AI Risks

Perhaps the most pressing compliance concern for businesses going forward involves artificial intelligence.

"Companies should be aware that facial recognition technology and voice recognition technology, increasingly embedded in off the shelf AI tools, may be capturing biometric information from employees and customers without anyone at the company realizing it," according to legal analysis from Latham & Watkins.

AI powered cameras that use facial recognition for security or analytics, and AI recording or transcription software that processes voiceprints, are examples of tools that could potentially be collecting biometric information as a byproduct of their primary function.

A recent complaint filed against AI notetaker Fireflies.AI alleges the Fireflies tool records, transcribes, and stores voices of meeting participants, including voices of those who are not Fireflies users, without the requisite notice, consent, and retention safeguards required by BIPA.

The Bigger Picture

Since 2019, when the Illinois Supreme Court ruled in Rosenbach v. Six Flags that individuals can sue under the law without having to prove an actual injury, more than 1,500 lawsuits have been filed under the act in Illinois state and federal courts.

Major settlements include:

• Facebook paid $650 million in 2020 to resolve a BIPA class action
• TikTok agreed to pay $92 million in a 2022 settlement
• Google settled an Illinois class action for $100 million in 2022

Employers across Illinois ranging from trucking companies to cosmetic companies to hospitals have faced BIPA litigation. Companies can face $1,000 in damages per person affected and $5,000 in damages per each BIPA provision violated.

The Seventh Circuit ruling provides a measure of predictability back to the damages landscape while maintaining BIPA's core protections. But for companies that have not yet taken BIPA compliance seriously, this is a moment of clarity.

"The law is still in effect, the obligations are still real, and the exposure, while reduced, has not disappeared," according to legal analysis from Latham & Watkins.

What Employers Should Do Now

The Seventh Circuit's ruling gives businesses a reprieve from the most alarming damages scenarios, but it does not eliminate the need for compliance.

Employers that use biometric data for timekeeping, building access control, identity verification, or fraud prevention must ensure they have proper notice and consent policies in place.

The ruling applies retroactively to pending litigation, but new cases must still comply with the law. And for existing cases, while the damages exposure has been significantly reduced, the legal uncertainty remains until the Illinois Supreme Court weighs in.

The decision represents a genuine legal victory for businesses facing BIPA litigation, but it also highlights the importance of proactive compliance.

For businesses that operate in Illinois and handle biometric data, the BIPA compliance program is not optional. It is a fundamental requirement of doing business in the state.

The Seventh Circuit ruling has brought predictability back to the damages landscape. But the obligations under BIPA remain in full force.