Biometric Information and BIPA: One
A company might be keeping a copy of your face. You never said yes to that. And you can't ever change your face. In Illinois, a company can owe up to $5,000 for that, even if nobody hacks anything. So who's holding onto your face tonight? You're going to find out who has it. And you'll learn how to ask them to erase it.
At least 13 people in the U.S. got arrested for things they didn't do, because police trusted a face match that was wrong. But those were police cases, not company privacy cases.
Companies get your face a different way, in 3 quiet steps. A store spots your face and measures your eyes, your nose and your jaw. Then the store saves those measurements in its files.
The store never asks you for a yes at any of those steps. Illinois counts it as a violation when they don't ask.
Nobody breaks in, and nobody steals anything. Your face just sits there in that company's files. Lawmakers call that biometric information, meaning data from your body.
Under Illinois's Biometric Information Privacy Act, companies have to ask first.
Before a company scans you, it has to warn you in writing. The company has to tell you why it wants your face, and how long it'll keep it. Then the company needs your yes, in writing too.
Last, the company has to set a date for deleting your face. The company has to publish the date it destroys your scan.
With a delete date, your scan won't sit in their files forever. Without a date, nobody knows how long they'll keep it. In Illinois, a company with no delete date is breaking the rules.
That's 4 rules before a company scans your face. If the company skips just one, it's breaking Illinois law.
If this helps, a like and a subscribe help us keep it coming.
Those rules exist because you can fix a leaked password in a minute. But nobody can give you a new face.
Anderson Kill, a law firm, spells out what it costs. If a company breaks the rule carelessly, it can owe $1,000. If it breaks the rule recklessly, it can owe $5,000. And the company can owe that for every single violation.
A fast food chain scanned its workers' fingers. The chain could owe money for every single scan, and the ACLU of Illinois says about $17 billion was on the line. Illinois changed the law in 2024 after the courts asked, so repeat scans now count once.
Companies don't only measure your face. Some companies track how fast you type and how you walk.
Companies decide who pays in a contract you never get to sign. Sometimes you, the person who got scanned, end up paying.
A company might promise to protect your face. K&L Gates, a law firm, says insurance companies fight over paying for these claims. But the company might have no money behind that promise.
You'd probably think a company owes you something after someone hacks it. But in Illinois, the company can owe you the moment it scans you without asking. You don't have to prove you got hurt. When the company skips your yes, that's the harm itself.
So if a gym or a store offers you a PIN, take the PIN. For scans you already gave, ask your questions in writing.
Ask them in writing what they keep from your face. Ask for the exact date they'll destroy it. Then ask them to delete your scan.
When you unlock your phone, it checks your face against one copy you saved. Police can check your face against a whole crowd of faces.
Send that email, and then see what they send back. Whether they answer or not, you'll learn a lot. If the company ignores you, go to your state attorney general. Their office takes privacy complaints.
CaraComp wrote this up, and they go deeper on what you can do. They also list the words to look for on that page.
Illinois spells out in the law exactly what it protects. The list starts with a scan of your eye and your fingerprint. Your voice, your hand and your face are on it too.
Open the privacy policy at your gym or your job. Search it for the words biometric, face, voice and retain, which means keep. If you can't find a delete date there, that's a warning.
You can search for those 4 words in just a few minutes. Companies that wrote their plans before 2024 might be following rules that have changed since. That means a company's privacy page might be out of date.
Nobody has to steal anything for your face to matter. Now you know who to ask, and what to ask.
Tonight, write down every place that's scanned you. Think about your gym, your job and stores with face cameras. Send each one those 3 questions this week.
Every company that keeps your face is one more place it can leak. Ask each one to delete your face before that happens.
Every day we take one story like this and make it simple. Subscribe and tap the bell. Tomorrow's is free too. See you in today's briefing. If this helps, a like and a subscribe help us keep it coming.
