Illinois BIPA: Court Exempts Home Care Fingerprint Scans

Imagine you give your fingerprint to your employer. You assume the privacy law protects it. But an Illinois court just ruled that the exact same fingerprint can be protected in one situation, and completely unprotected in another. Nothing about the fingerprint changed. Only the reason it was collected did.

If you've ever scanned a finger to clock in at

If you've ever scanned a finger to clock in at work, or handed over a face scan to unlock a door, this touches you directly. Most of us believe privacy law works like a shield that follows our data everywhere. It doesn't. And that gap between what we assume and what's actually true is where people get burned. Today I want to walk you through a real case that proves it, and by the end, you'll understand something most people never learn about your own biometric data. So how can one fingerprint have two completely different legal statuses?

Let's start with the case itself. An Illinois appellate court refused to revive a lawsuit against a home-care provider. Why? Because that company collected its employees' fingerprints for a required background check. And under Illinois law, that specific purpose fell into an exemption.

The law in question is called BIPA, the Illinois Biometric Information Privacy Act. It's one of the strongest privacy laws in the country. On its face, the rule sounds simple. Your fingerprints, your face, your voice, those are protected. A company has to tell you why they're collecting it, and get your written consent first. Simple, right?

Here's where it stops being simple. The law has exemptions. If a company collects biometric data for healthcare treatment, payment, or operations, it can skip the consent step. And there's a separate exemption for contractors working on behalf of a state or local government. Home-care providers delivering state-funded services can slot right into that gap.

The same fingerprint scan that would need your

So the same fingerprint scan that would need your consent at a private tech company becomes perfectly legal when it's a background check for a government-contracted care provider. The data is identical. The legal protection flips. For a lawyer, that's a jurisdictional puzzle. For you, it means the protection you assumed you had depends entirely on who's asking and why.

Let me give you the analogy that made this click for me. Think of these laws like building permits. A permit to demolish a house doesn't let you ignore safety codes when you renovate. Collecting a fingerprint for one approved reason doesn't give a company permission to use it for a different reason. The law protects the use, not just the data.

Now, here's the misconception almost everyone carries. People assume that once they hand over a fingerprint, one privacy law protects it everywhere it travels. And honestly, that assumption feels reasonable, it's your fingerprint, after all. But the protection isn't tied to the data. It's tied to the specific, defined purpose. A hospital worker's fingerprint used to open a medicine cabinet might be exempt. That very same fingerprint, later used to sort research data, would suddenly require consent. Same finger. Same worker. Different rule.

And the stakes here are enormous. Under BIPA, a company can owe a thousand dollars for each careless violation, and five thousand for each reckless one. Consumers have already won over eight hundred million dollars in settlements from Meta, Google, and TikTok. That's why the word "purpose" matters so much, it can be the difference between owing nothing and owing a fortune.