BIPA Got Smaller. Your Risk Just Got Bigger.

Here's the story everyone in the biometric industry should be talking about — and almost nobody is. While the news cycle burns through deepfake headlines, something quieter and arguably more consequential is happening in appellate courts across the United States. The legal scaffolding around biometric data collection is being remodeled. And depending on which floor you're standing on, that looks either like a breakthrough or a trap.

A new opinion from the U.S. Court of Appeals for the Third Circuit, covered in depth by Law.com, has experts describing a possible directional shift — courts moving toward favoring defendants and pulling back on the broadest readings of Illinois' Biometric Information Privacy Act. That word "narrowing" is doing a lot of heavy lifting right now, and it's getting picked up fast by organizations looking for permission to accelerate their biometric programs. Don't be one of them.

The $7.5 Million Question — And the $5,000 Answer

To understand what's actually at stake, you need to understand how dramatically the damages math changed. Before the 2024 BIPA amendment, the per-scan model meant a single employee whose biometric identifiers were scanned 1,500 times — say, clocking in and out of work — could theoretically anchor a claim worth $7.5 million. That wasn't hypothetical. That was the engine driving some of the biggest class action settlements in tech history.

The 2024 amendment flipped that model entirely, capping recovery to one claim per person rather than one claim per scan. The Seventh Circuit subsequently ruled this cap applies retroactively to cases already pending. Maximum recovery now: $5,000 per person. The drop from $7.5 million to $5,000 for the same underlying conduct is — and I don't use this word lightly — staggering. And yes, it's real. Per State of Surveillance's analysis of the Seventh Circuit's ruling, that retroactive application is now settled law, reshaping not just future cases but the value of cases already in the pipeline. This article is part of a series — start with Deepfake Detection Face Voice Lip Sync Forensic Stack.

On paper, this should have chilled BIPA litigation significantly. The financial upside for plaintiffs' attorneys dropped off a cliff. Class actions that once promised nine-figure outcomes now top out considerably lower. So why did more than 100 new BIPA class actions get filed in Illinois in 2025, according to Privacy World's year-end review? That's the part of this story the "narrowing" framing conveniently leaves out.

Narrower Damages. Not Narrower Risk.

The plaintiffs' bar is not retreating. It's adapting. Lower per-case damages mean attorneys are structuring claims differently, filing more cases, and targeting organizations with larger exposed populations. Volume litigation at lower per-case damages still creates serious operational friction, discovery costs, reputational exposure, and management distraction. The ceiling dropped. The floor didn't.

"Biometric litigation risks endure even post-BIPA amendment — the cause of action survives the damages cap, and companies that treat the amendment as a green light for looser compliance practices are misreading the legal environment." — Sidley Austin Data Matters Blog, Sidley Austin

That framing — "misreading the legal environment" — should be pinned to the wall in every compliance meeting happening right now. The Third Circuit's Amazon opinion, the Seventh Circuit's damages ruling, the 2024 amendment: these are not sequential chapters in BIPA's death story. They're evidence that BIPA is evolving into something leaner and harder to dismiss. Fewer headline-grabbing mega-settlements. More persistent, lower-dollar cases that quietly drain resources and attention.

Why Investigators Are Particularly Exposed

Here's where this gets professionally specific. For investigators — whether you're running open-source intelligence workflows, conducting background verification, or using facial comparison tools in case research — the temptation to read "narrowing legal risk" as permission to move faster is real and understandable. Budget pressure is constant. Adoption pressure is rising. And if the legal hammer looks smaller, the risk calculus shifts.

But investigators operate in a particularly fraught corner of biometric law. Unlike a retailer scanning employee timecards, investigative facial comparison workflows often involve subjects who have no existing relationship with the organization, no established consent framework, and no expectation that their biometric data is being processed. That's a different liability profile entirely — and one that courts haven't fully adjudicated yet. Previously in this series: Sassas Face Off 68 000 Grandmas Pensioners Cut Off By Algori.

The smart play isn't to accelerate because legal risk appears to be softening. It's to build cleaner, more documented processes now — while the rules are still being written — so you're not retrofitting compliance after an appellate opinion draws a line that catches your workflow on the wrong side.

At CaraComp, we see this dynamic play out constantly: organizations that treat facial comparison as an informal workflow rather than a documented professional process are the ones scrambling when legal standards shift. The technology itself isn't the liability. The absence of process around it is.

The Rules Are Still Being Written. Act Like It.

There's a phrase that keeps appearing in legal commentary on the current BIPA moment: "significant consequences." As in, the answers to questions still pending before appellate courts may have significant consequences on the shape of biometric privacy litigation in 2026 and beyond. That's not reassuring language. That's a warning.

The Third Circuit's Amazon opinion is one data point. The Seventh Circuit's retroactivity ruling is another. The 100-plus new filings in 2025 are a third. Taken together, they don't tell a coherent story about biometric law getting safer. They tell a story about biometric law getting more complex — with lower-stakes individual claims, higher filing volumes, and faster adoption pressure creating a combination that is genuinely hard to predict. Up next: Your Facial Recognition Tool Is Lying To You Why 50 Of Deepf.

Organizations rushing to deploy biometric workflows because "BIPA got narrower" are betting on a legal forecast that hasn't stabilized. The plaintiffs' bar spent decades building BIPA into a litigation machine. It didn't dismantle that machine because the damages cap dropped. It recalibrated.

There's a version of this story where the industry becomes more disciplined because the legal stakes feel more manageable. Smaller maximum damages, cleaner compliance expectations, normalized workflows. That version is possible. But the version where lower headline risk produces looser internal standards — and then a new appellate opinion draws a line nobody expected — is equally possible, and considerably more expensive.

The real question isn't whether BIPA is dying. It clearly isn't. The question is whether your biometric workflows are built to survive a legal environment that's still mid-evolution — or whether you're going to find out they weren't when a plaintiff's attorney in Cook County files case number 101.