Your Face Got Scanned 2,600 Times. A Court Just Said That's One Violation.

Full Episode Transcript

Picture this. You clock in at work every morning by scanning your fingerprint. You do it twice a day for five years. That's about twenty-six hundred scans of your body. And a federal court just decided that all of those scans count as one single violation of your privacy.

Trusted by Investigators Worldwide

Run Forensic-Grade Comparisons in Seconds

Court-ready facial comparison reports. Results in seconds.

Get Started

7-day refund guarantee**

If your job has ever asked you to press your finger

If your job has ever asked you to press your finger to a reader — or look into a camera to unlock a door — this story is about you. Illinois has the toughest biometric privacy law in the country. It's called BIPA. For years, the big question was simple. If a company scans your face or fingerprint without asking, how much do they owe you? Every single scan? Or just once? The answer used to threaten to bankrupt entire companies. Now the math has completely changed.

Back in 2023, Illinois courts held that a violation happened with every single scan. Every finger press. Every face capture. Under that reading, one employee scanned twice a day for five years could claim damages topping two and a half million dollars. Now stretch that across a thousand workers. You're looking at more than two billion dollars a year — for one company. Judges even had a name for it. They called it "annihilative liability." Liability so large it could wipe a business off the map. That number scared lawmakers. So in 2024, Illinois changed the law. The legislature said repeated scans of the same person, using the same method, count as a single violation. One recovery. Not thousands. Then came the case that locked it in. It's called Clay versus Union Pacific. The subject in front of the Seventh Circuit was whether that new rule applied backward — to cases already filed. The court said yes. Fully retroactive. So for the everyday worker, this means the paycheck-sized payout for a privacy slip just shrank dramatically. For the company, it means one mistake no longer ends the business. And you can see it in the numbers. According to legal trackers, these class action filings dropped from over four hundred in 2024 to around a hundred and fifty in 2025. Settlement totals fell too — from more than two hundred million dollars down to about a hundred and thirty-six million. The flood slowed to a trickle almost overnight.

The Bottom Line

But here's what didn't change. The rules still say a company must ask before scanning you. They still must tell you. They still must delete the data properly. The court shrank the punishment. It didn't remove the protection. Companies can no longer face financial extinction for one mistake — but they can't skip your consent either.

So the short version. A federal court decided that scanning your body thousands of times counts as one violation, not thousands. That saved companies from billions in payouts. But your right to say yes before they scan you is still standing. Your fingerprint at the gym. Your face at the office door. That data is becoming as normal as a password. This ruling just made the consequences for misusing it far more predictable — for them, and for you. The full breakdown's in the show notes if you want the deep dive.

Your Face Got Scanned 2,600 Times. A Court Just Said That's One Violation.