Unlike a password, a fingerprint can't be changed once it's compromised. That's one reason Illinois treats workplace biometric scans as a privacy issue. Sometimes, yes, an Illinois employer can require a biometric time clock. But there's a catch: the Illinois Biometric Information Privacy Act, found at 740 ILCS 14, lays out real prerequisites. Before a covered fingerprint scan is collected or stored, the employer generally has to provide written notice, state a purpose and a retention period, and get a written release. Note, though, that BIPA doesn't promise every worker some non-biometric way to clock in.
What the Illinois Biometric Information Privacy Act requires at work
If you work for a private employer, expect written notice before your fingerprint is collected or stored. That notice has to explain the specific purpose and how long the data lasts, and under Section 15(b) the employer needs a written release from you too. All of this comes before your first scan. Never after. And certainly not "when we get around to it."
BIPA dates back to 2008 and applies to private entities, private employers included. Public-sector workplaces aren't all covered. One wrinkle worth knowing: Section 10's definition of a written release speaks directly to releases signed as a condition of employment.
Fingerprints get named outright in the statute. Also covered is information derived from a covered identifier, at least when it's used to identify someone. Don't rely on what the device is called, though. Coverage turns on what the software actually captures and keeps, identifying templates included.
A plain employee number, by itself, is not a biometric identifier. With facial-recognition clocks, Section 10 draws a line between ordinary photographs and scans of face geometry.
Whether your employer crossed the line under the illinois biometric information privacy act depends on the facts: what the clock actually captured, what you signed, and when. Hold onto your enrollment paperwork.
In Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186, the Illinois Supreme Court held that a person need not allege an additional injury beyond a violation of BIPA's rights to qualify as aggrieved. Section 20 allows private lawsuits, sure. What the ruling doesn't do is tell you what any particular clock collected.
What should a biometric time clock notice say?
A notice that complies with the law names the biometric collection, spells out its specific purpose, and states how long it lasts. Set whatever you were handed against that standard.
| What to check | What the document should explain | Concern to document |
|---|
| Data collected | Whether the clock captures a fingerprint or creates a biometric template | The form only says "timekeeping data" |
| Purpose | The specific reason for collecting and using the data | No purpose is stated |
| Duration | How long the data will be collected, used, and stored | No retention period appears |
| Written release | The authorization requested before collection begins | Enrollment occurred before signing |
| Outside access | Who stores or receives the data | The employer will not identify its time-clock vendor |
Now line up the actual language and timing with Section 15(b). A blanket handbook acknowledgment may not cut it. As for outside access, that implicates Section 15(d), a separate concern; the collection-notice provision says nothing about a vendor roster.
Clicking a button doesn't cure missing disclosures, even though the amended law now expressly permits electronic signatures on releases. Save the screen you saw before signing, along with the date and any explanation of the data stored by the clock.
How the Illinois biometric data retention policy works
A private entity possessing covered biometric data must maintain a publicly available written retention schedule and destruction guidelines under Section 15(a).
Permanent destruction is due when the original purpose has been satisfied or within three years after your last interaction with that entity, whichever occurs first, absent a valid warrant or subpoena.
Your individual notice and the public policy are separate obligations. Ask for both documents if you received only an enrollment form.
Section 15(d) restricts disclosure and redisclosure, with exceptions such as your consent or disclosures required by law. Section 15(e) requires reasonable care within the entity's industry, with protection at least as strong as it uses for other confidential and sensitive information.
Using an outside vendor isn't automatically unlawful. Ask who receives your template and what authorization permits that transfer. A vendor contract doesn't, by itself, settle questions about access controls or other safeguards.
How to make an Illinois biometric deletion request
Ask in writing whether the original timekeeping purpose has ended and which retention schedule applies. Request the destruction date for data held by the employer and for any copies kept by a vendor or affiliate.
BIPA doesn't create unlimited deletion on demand while the stated purpose remains active. The Section 15(a) deadline depends on when that purpose is satisfied or when you last interacted with the entity, rather than simply when you submit a request.
- Save the notice and release. Keep relevant handbook pages, enrollment screens, and messages you lawfully received.
- Send a dated written request to human resources or the employer's privacy contact.
- Ask what was collected and where it is stored. Identify each recipient and request a destruction date for every copy.
- Preserve the response and note any continued scans after your request.
- Seek advice from an Illinois attorney or an appropriate worker representative if the response conflicts with your documents or no meaningful answer arrives.
Keep your own lawful copies. Don't secretly access employer systems or take protected company records. Preserve the original dates on messages you received.
Related biometric privacy questions
Is biometric data treated as sensitive personal information?
Yes. BIPA Section 5 recognizes the sensitivity of biometrics because biological identifiers can't be replaced like passwords, although legal labels differ among statutes. Beyond fingerprints and the face-geometry scans covered above, Section 10 also reaches voiceprints, retina or iris scans, and scans of hand geometry.
What workplace conduct may violate biometric privacy rules?
Collection without prior notice or a written release may violate Section 15(b). Missing public policies or improper disclosures may violate other Section 15 duties, as may inadequate security. The evidence determines the outcome. Section 20 authorizes liquidated damages of $1,000 for negligent violations and $5,000 for intentional or reckless violations, or greater actual damages, plus other statutory relief.
What BIPA change matters in 2026?
The amendment effective in 2024 changes how damages are counted under Section 20. Repeated collection of the same person's biometric data using the same method is a single Section 15(b) violation with at most one recovery. Repeated Section 15(d) disclosures receive similar treatment when made by the same method to the same recipient. The amendment also expressly permits electronic signatures for written releases.
Can a worker be forced to use biometrics?
BIPA doesn't guarantee every worker another clock-in method, but covered employers must satisfy Section 15. Seek workplace-specific advice before refusing a scan.
What to do before your next fingerprint scan
Read the notice before enrolling and save the version you receive. Request the retention policy if it isn't readily available. If scans already occurred without a clear explanation, document the enrollment timeline and seek fact-specific legal guidance. This is general information, not a verdict on your claim. The numbered steps above tell you where to start.