The demand letter usually starts with a fingerprint. Your employees clock in and out on a biometric time clock, the way millions of workers do, and a plaintiff’s lawyer has noticed. The complaint says the company collected those fingerprints without the written consent the Illinois Biometric Information Privacy Act requires, and then it multiplies. Every scan, by every employee, on every shift, across years, becomes a separate violation, each one tagged at $1,000 or $5,000, and the spreadsheet at the bottom of the letter reaches a figure that looks like the entire value of the company. The message is the one every BIPA demand is built to send. Settle now, because trial would be extinction.
That math is built to look fixed. It is not, and since August 2024 it is wrong on its face. The Illinois legislature amended BIPA that month, and the year before, the Illinois Supreme Court had already said that the damages a plaintiff demands are not the damages the statute commands. The company’s real exposure under the law the courts are actually applying today is a fraction of the number on the demand letter, and understanding why changes the entire posture of the case.
BIPA, codified at 740 ILCS 14, requires a business to give written notice and obtain a written release before it collects a person’s fingerprint, faceprint, or other biometric identifier, and section 20 sets liquidated damages of $1,000 for a negligent violation and $5,000 for one that is intentional or reckless, plus attorney’s fees. The Illinois Supreme Court held in Rosenbach v. Six Flags Entertainment Corporation that a person need not prove any actual injury beyond the statutory violation to sue, which is the holding that keeps these cases alive in state court and the premise on which every demand letter is built. The defense begins where that premise ends.