Illinois Biometric Information Privacy Act (740 ILCS 14)

Binding law — in force

Do not disclose face or voice biometrics to another party without consent (Illinois BIPA)

A private entity in possession of a biometric identifier or biometric information may not disclose, redisclose or otherwise disseminate it unless the person consents, the disclosure completes a financial transaction the person requested or authorized, it is required by law, or it is required by a valid warrant or subpoena. Detect templates, or the images or voice samples used to identify people, sent to a third-party service or partner with no consent check for that disclosure.

il-bipa.biometric-disclosure-consent · 740 ILCS 14/15(d) · official source · jurisdictions: US-IL

Binding law — in force

Inform in writing and obtain a written release before collecting face or voice biometrics (Illinois BIPA)

Before a private entity collects, captures or otherwise obtains a person's biometric identifier (such as a scan of face geometry or a voiceprint) or biometric information, it must inform the person in writing that the data is being collected or stored, inform them in writing of the specific purpose and how long it will be collected, stored and used, and receive a written release (informed written consent or an electronic signature). Detect a face- or voice-recognition path that computes or enrolls a template with no recorded written release first.

il-bipa.biometric-notice-and-written-release · 740 ILCS 14/15(b) · official source · jurisdictions: US-IL

Binding law — in force

Publish a biometric retention schedule and destroy face and voice templates on time (Illinois BIPA)

A private entity that possesses biometric identifiers or information must have a written, publicly available policy with a retention schedule and destruction guidelines, destroying the data when the initial purpose is satisfied or within three years of the person's last interaction, whichever comes first, and must follow it. Detect stored face or voice templates (for example a Rekognition collection or face embeddings in a database) with no deletion path, and the absence of a published biometric retention policy.

il-bipa.biometric-retention-and-destruction · 740 ILCS 14/15(a) · official source · jurisdictions: US-IL