Biometric Information: One Face Scan Can Cost a Firm $5,000

In one state, a company can owe you five thousand dollars for scanning your face. Even if nothing bad ever happens to that scan. No hack. No leak. No misuse. Just the scan itself.

If you've ever clocked in at work with your

If you've ever clocked in at work with your fingerprint, or walked past a camera at a store entrance, this already touches your life. And if the idea of companies quietly keeping your face feels unsettling, that's a fair reaction. But there's a law that flips the usual rules, and understanding it is how you stop feeling powerless. We're going to look at when a company owes you money, why your face gets special treatment, and how one line in a contract can decide who pays. So how can a company be liable when nothing went wrong?

The answer lives in Illinois. Illinois has a law called the Biometric Information Privacy Act. People shorten it to BIPA. According to legal analysts at Anderson Kill, it's the only state law in the country that lets ordinary people sue a company directly over their biometric data. Biometric data just means measurements of your body. Your face, your fingerprint, your iris.

The law sets two price tags. If a company is careless, you can recover a thousand dollars per violation. If it's intentional or reckless, that jumps to five thousand.

Most of us assume a company is only in trouble if

Most of us assume a company is only in trouble if our data gets stolen. That makes sense. It's how we think about credit cards and passwords. If nobody breaks in, where's the harm? Under this law, though, you don't have to show any harm at all. The company has to tell you it's collecting your face. It has to explain why, and for how long. And it has to get your written consent. Skip those steps, and the debt starts the moment the scan happens.

Picture a restaurant that photographs every customer for security. It tells no one. It gets no signatures. It has no plan to delete anything. Under Illinois law, that restaurant owes each customer money the second those photos are stored. It can't say, but we never used them. The collection is the violation.

Why treat a face so differently from a password? Because you can cancel a credit card. You can't cancel your face. Once it's compromised, there's no replacement. So the law tries to stop the problem before collection, not clean up after it.

The math can get enormous

The math can get enormous. According to the A.C.L.U. of Illinois, in a case involving the restaurant chain White Castle, every single employee fingerprint scan counted as its own violation. The potential damages reached about seventeen billion dollars. That number stopped me cold. Illinois courts asked lawmakers to step in. And in twenty twenty-four, they changed the law so repeated scans of the same person don't keep multiplying.

That brings us to the clause. When a company buys face-scanning tools from a vendor, their contract usually includes an indemnification clause. That's a promise about who pays the legal bills if something goes wrong. According to the law firm Blank Rome, these clauses should cover lawsuits, regulator questions, and other costs tied to biometric laws. Many contracts do the opposite. They specifically carve biometric liability out. For investigators and analysts, the takeaway is simple. Open your service agreement and find out who owns the risk on facial comparison results. For everyone else, it means the company holding your face may have signed away responsibility in a sentence you'll never see.

And the stakes aren't only financial. According to the A.C.L.U. of Georgia, at least thirteen people in the U.S. are publicly known to have been wrongfully arrested after faulty facial recognition matches. One was Porcha Woodruff, a Detroit mother. And in twenty nineteen, federal testing by N.I.S.T. found some software was up to a hundred times more likely to misidentify Asian and Black people than White men.