Biometric Risk: Collecting Biometric Data Amid BIPA's Legal Shift

Here's the story everyone in the biometric industry should be talking about, and almost nobody is. While the news cycle burns through deepfake headlines, something quieter and arguably more consequential is happening in appellate courts across the United States. The legal scaffolding around biometric data collection is being remodeled. And depending on which floor you're standing on, that looks either like a breakthrough or a trap.

A new opinion from the U.S. Court of Appeals for the Third Circuit, covered in depth by Law.com, has experts describing a possible directional shift, courts moving toward favoring defendants and pulling back on the broadest readings of Illinois' Biometric Information Privacy Act. That word "narrowing" is doing a lot of heavy lifting right now, and it's getting picked up fast by organizations looking for permission to accelerate their biometric programs. Don't be one of them.

The $7.5 Million Question, And the $5,000 Answer

To understand what's actually at stake, you need to understand how dramatically the damages math changed. Before the 2024 BIPA amendment, the per-scan model meant a single employee whose biometric identifiers were scanned 1,500 times, say, clocking in and out of work, could theoretically anchor a claim worth $7.5 million. That wasn't hypothetical. That was the engine driving some of the biggest class action settlements in tech history.

The 2024 amendment flipped that model entirely, capping recovery to one claim per person rather than one claim per scan. The Seventh Circuit subsequently ruled this cap applies retroactively to cases already pending. Maximum recovery now: $5,000 per person. The drop from $7.5 million to $5,000 for the same underlying conduct is, and I don't use this word lightly, staggering. And yes, it's real. Per State of Surveillance's analysis of the Seventh Circuit's ruling, that retroactive application is now settled law, reshaping not just future cases but the value of cases already in the pipeline. This article is part of a series, start with Deepfake Detection Face Voice Lip Sync Forensic Stack.

On paper, this should have chilled BIPA litigation significantly. The financial upside for plaintiffs' attorneys dropped off a cliff. Class actions that once promised nine-figure outcomes now top out considerably lower. So why did more than 100 new BIPA class actions get filed in Illinois in 2025, according to Privacy World's year-end review? That's the part of this story the "narrowing" framing conveniently leaves out.

BIPA Litigation Damages Narrow, Exposure Expands

The plaintiffs' bar is not retreating. It's adapting. Lower per-case damages mean attorneys are structuring claims differently, filing more cases, and targeting organizations with larger exposed populations. Volume litigation at lower per-case damages still creates serious operational friction, discovery costs, reputational exposure, and management distraction. The ceiling dropped. The floor didn't.

Biometric Authentication and the Information Gap

Biometric authentication systems collect a specific kind of information: fingerprints, iris scans, voiceprints, facial geometry. That information is different from a password because it cannot be reset once it's exposed. This is the core reason biometric authentication carries a different risk profile than ordinary account security, and it's why regulators keep circling back to biometric data even as damages caps shrink individual payouts.

"Biometric litigation risks endure even post-BIPA amendment, the cause of action survives the damages cap, and companies that treat the amendment as a green light for looser compliance practices are misreading the legal environment." Sidley Austin Data Matters Blog, Sidley Austin

That framing, "misreading the legal environment", should be pinned to the wall in every compliance meeting happening right now. The Third Circuit's Amazon opinion, the Seventh Circuit's damages ruling, the 2024 amendment: these are not sequential chapters in BIPA's death story. They're evidence that BIPA is evolving into something leaner and harder to dismiss. Fewer headline-grabbing mega-settlements. More persistent, lower-dollar cases that quietly drain resources and attention.

Why Investigators Face Biometric Data Risk

Biometric Systems and Covert Collection Risks

Some biometric systems are designed to run in the background, matching faces or voices without the subject ever being told. That covert style of data gathering is exactly where biometric risk concentrates, because there's no notice, no consent form, and no paper trail if a regulator or plaintiff's attorney comes asking. Investigators who explore facial comparison tools without first mapping how the underlying biometric systems capture and store data are building on a foundation that a single court ruling can knock out from under them.

Here's where this gets professionally specific. For investigators, whether you're running open-source intelligence workflows, conducting background verification, or using facial comparison tools in case research, the temptation to read "narrowing legal risk" as permission to move faster is real and understandable. Budget pressure is constant. Adoption pressure is rising. And if the legal hammer looks smaller, the risk calculus shifts.

But investigators operate in a particularly fraught corner of biometric law. Unlike a retailer scanning employee timecards, investigative facial comparison workflows often involve subjects who have no existing relationship with the organization, no established consent framework, and no expectation that their biometric data is being processed. That's a different liability profile entirely, and one that courts haven't fully adjudicated yet. Previously in this series: Sassas Face Off 68 000 Grandmas Pensioners Cut Off By Algori.

The smart play isn't to accelerate because legal risk appears to be softening. It's to build cleaner, more documented processes now, while the rules are still being written, so you're not retrofitting compliance after an appellate opinion draws a line that catches your workflow on the wrong side.

At CaraComp, we see this dynamic play out constantly: organizations that treat facial comparison as an informal workflow rather than a documented professional process are the ones scrambling when legal standards shift. The technology itself isn't the liability. The absence of process around it is.

The Rules Are Still Being Written. Act Like It.

There's a phrase that keeps appearing in legal commentary on the current BIPA moment: "significant consequences." As in, the answers to questions still pending before appellate courts may have significant consequences on the shape of biometric privacy litigation in 2026 and beyond. That's not reassuring language. That's a warning.

The Third Circuit's Amazon opinion is one data point. The Seventh Circuit's retroactivity ruling is another. The 100-plus new filings in 2025 are a third. Taken together, they don't tell a coherent story about biometric law getting safer. They tell a story about biometric law getting more complex, with lower-stakes individual claims, higher filing volumes, and faster adoption pressure creating a combination that is genuinely hard to predict. Up next: Your Facial Recognition Tool Is Lying To You Why 50 Of Deepf.

Organizations rushing to deploy biometric workflows because "BIPA got narrower" are betting on a legal forecast that hasn't stabilized. The plaintiffs' bar spent decades building BIPA into a litigation machine. It didn't dismantle that machine because the damages cap dropped. It recalibrated.

There's a version of this story where the industry becomes more disciplined because the legal stakes feel more manageable. Smaller maximum damages, cleaner compliance expectations, normalized workflows. That version is possible. But the version where lower headline risk produces looser internal standards, and then a new appellate opinion draws a line nobody expected, is equally possible, and considerably more expensive.

The real question isn't whether BIPA is dying. It clearly isn't. The question is whether your biometric workflows are built to survive a legal environment that's still mid-evolution, or whether you're going to find out they weren't when a plaintiff's attorney in Cook County files case number 101.

Biometric risk is the plain-English name for what all of this legal maneuvering actually protects against: the chance that biometric data, once collected, gets used, stored, or exposed in a way the person never agreed to. When people talk about collecting biometric data responsibly, they mean building a process where biometric risk is identified and reduced before a single fingerprint or face scan is captured, not after a lawsuit forces the issue. That distinction, before versus after, is the entire compliance game right now.

Data privacy and biometric security are often treated as separate departments inside an organization, but the BIPA landscape is erasing that line. Data protection failures around biometric information create the exact fact pattern plaintiffs' attorneys look for: biometric data collected without clear notice, stored without a documented retention schedule, and shared without the subject's knowledge. Unauthorized access to a database holding fingerprints or facial templates is a different order of harm than unauthorized access to a list of email addresses, because identity fraud built on biometric data is much harder to unwind.

Security around biometric information has to be treated as a first-class requirement, not an add-on bolted onto an existing IT security policy. Practically, that means encrypting biometric data both in transit and at rest, limiting who inside the organization can query the raw biometric information, and logging every access event so that if potential data breaches are ever investigated, there's a clear record of who touched what and when. Secure handling of biometric data isn't a one-time setup either; it needs regular review as tools, vendors, and legal standards change.

For teams running biometric authentication or biometric systems day to day, the practical checklist starts with data minimization: collect only the biometric data you actually need for the stated purpose, and avoid holding onto biometric information longer than the purpose requires. Pair that with written notice and consent language that plainly explains what biometric data is being captured, why, and for how long. Together, minimization and clear consent do more to reduce biometric risk than any single piece of security technology, because they shrink the amount of biometric information that could ever be exposed in the first place.

Privacy conversations about biometric data collection tend to focus on the moment of capture, but the bigger privacy exposure often sits in storage and retention. A face scan taken today and deleted next month carries far less privacy risk than the same scan retained indefinitely in an unmonitored database. Building automatic deletion schedules into biometric systems, and confirming those schedules actually run, closes one of the most common gaps investigators and compliance teams find during an audit.

None of this eliminates biometric risk entirely, no amount of security or process makes a lawsuit impossible. But it does change the shape of the risk from an open-ended, unpredictable exposure into a manageable, documented one. Organizations that can show a regulator or a judge exactly how biometric data was collected, secured, and limited in scope are in a fundamentally different position than organizations that can't answer those questions at all. That's the real dividing line the current wave of BIPA litigation is drawing, and it has nothing to do with how large or small the damages cap happens to be.