Página traducida y verificada automáticamente. Prevalece la versión en inglés. Algunas partes siguen en inglés mientras se verifica su traducción. Ver en inglés · Informar un error de traducción
BIPA
Ley de Privacidad de la Información Biométrica de Illinois
Aviso por escrito y consentimiento antes de recopilar datos biométricos, un calendario público de conservación y un derecho de acción privada que ha dado lugar a algunos de los mayores acuerdos en materia de privacidad de EE. UU.
The law in brief
Illinois' Biometric Information Privacy Act (BIPA) regulates how private organizations collect, use, keep and destroy biometric data such as fingerprints, face geometry and voiceprints. It is short, strict and, unusually, lets individuals sue directly, which has made it one of the most litigated privacy laws in the United States.
A quién se aplica
- Private entities, meaning businesses and other non-government organizations, that collect or hold biometric identifiers or biometric information of people in Illinois.
- Biometric identifiers include retina or iris scans, fingerprints, voiceprints and scans of hand or face geometry; biometric information is information based on them that identifies a person.
- Government bodies and some financial institutions are excluded, as are certain health care uses.
What it requires
A public retention and destruction policy
Publish a written policy with a retention schedule, and destroy biometric data when its purpose is satisfied or within three years of the person's last interaction, whichever comes first.
Written notice and release before collection
Before collecting biometric data, tell the person in writing what is collected, why and for how long, and receive their written release.
No selling or profiting
Do not sell, lease, trade or otherwise profit from a person's biometric data.
Limited disclosure and reasonable care
Do not disclose biometric data without consent or another listed basis, and store and transmit it with at least the care used for other confidential information.
Derechos de las personas
People must be told in writing and give a written release before their biometric data is collected. They can sue directly for violations (Sec. 20).
Enforcement and penalties
Un derecho de acción privada: $1,000 o los daños reales por cada infracción negligente, y $5,000 o los daños reales por cada infracción intencional o temeraria, más honorarios de abogados y costas (sec. 20). Una modificación de 2024 trata la recopilación repetida de los mismos datos biométricos de la misma persona por el mismo método como una sola infracción, y confirma que las firmas electrónicas valen como autorización por escrito.
What to do first
- Find every biometric use: time clocks, door access, device unlock, identity verification and voice systems, including vendors' tools.
- Publish a written retention and destruction policy.
- Get informed written releases before collection, including from employees.
- Stop any sale or profit from biometric data and check vendor contracts.
- Protect it at least as well as other sensitive data, and destroy it on schedule.
Checked against the official text on 28 September 2026. Quotations are the operative words of the law, linked to the article they come from; the official text is the authority. This brief is written by the Association for practitioners and is not legal advice.
Novedades recientes
-
State bills propose exemption for biometric data converted to irreversible mathematical representations
The trend could reshape biometric privacy safeguards by carving out a carve‑out for transformed biometric data. Several U.S. state privacy bills are introducing a new exception that excludes biometric data once it is transformed into an irreversible mathematical representation that cannot be used to recreate the original measurement. The proposed language appears in bills such as Mississippi HB 1051 and similar measures in Pennsylvania and Georgia. The exemption could limit the scope of biometric privacy protections for technologies using one‑way mathematical transformations.
Source: Future of Privacy Forum. BIPA in the regulations library.
Fuentes
- Ley de Privacidad de la Información Biométrica (740 ILCS 14) Asamblea General de Illinois · Texto oficial o regulador
Biblioteca de regulaciones
Todas las leyes estatales de privacidad de EE. UU., en un mapa
24 estados tienen una ley integral de privacidad en la biblioteca, junto con las leyes de la UE, del Reino Unido, federales de EE. UU. y globales: 102 en total, cada una explicada en palabras sencillas con sus fuentes. Seleccione un estado para ver qué se aplica allí.
- En vigor
- Entrada en vigor
- Leyes sectoriales