Since its enactment in 2008, Illinois’s Biometric Information Privacy Act (“BIPA”) has been recognized as a pioneering law in biometric privacy, imposing strict requirements on private entities that collect or use biometric identifiers such as fingerprints, facial geometry, and voiceprints. Its unique combination of a private right of action, statutory damages, and no requirement to prove actual harm has made it a powerful tool for plaintiffs and a persistent source of exposure for companies.

Following the first legislative amendment to the statute in 2024, courts and litigants faced critical questions about the scope of liability and the retroactive application of new rules, and in the years that have followed there have been split opinions at the state and district court levels. Last month, the U.S. Court of Appeals for the Seventh Circuit held that the 2024 amendment, which limited statutory damages to a single recovery per person, applies retroactively to cases that were already pending when the amendment was enacted, reversing multiple district court rulings and sharply curtailing plaintiffs’ ability to seek “per scan” damages. By confirming that repeated collection or disclosure of the same biometric data using the same method constitutes only a single compensable violation, the Seventh Circuit significantly reduced potential exposure in hundreds of pending class actions, which may require reassessment of damages calculations and federal jurisdiction in ongoing BIPA litigation.

BIPA Background

BIPA is an Illinois statute that governs the collection, use, and storage of biometric data, including fingerprints, iris or retina scans, voiceprints, and facial geometry.¹ Section 15 of the statute imposes strict obligations on private entities that collect or process biometric identifiers or biometric information.² These obligations include obtaining informed written consent before collecting or disclosing biometric data, providing clear notice of the purpose and duration of data use, and implementing a publicly available policy governing data retention and destruction.³

BIPA also provides individuals with a private right of action for violations, coupled with statutory damages of $1,000 per negligent violation and $5,000 per intentional or reckless violation—or actual damages if greater.⁴ This combination of strict liability, statutory damages, and no requirement to prove actual harm has fueled a surge of class action litigation, making BIPA one of the most litigated privacy statutes in the country. Businesses that fail to comply face not only reputational risk but also potentially significant financial exposure.

The 2024 Amendment: Limiting Damages

In August 2024, Illinois enacted the first amendment to BIPA since its passage in 2008, aimed at curbing the risk of astronomical damages awards. The amendment was a direct response to the Illinois Supreme Court’s 2023 decision in Cothron v. White Castle System, Inc., which held that a BIPA violation accrues each time biometric data is collected or transmitted, even if the same individual’s data is repeatedly processed by the same entity.⁵ Under that interpretation, a company using fingerprint scans for daily employee timekeeping could face thousands of violations, with penalties reaching $5,000 per instance. While the court acknowledged the potential for staggering liability, it left the issue to the legislature.

The amendment clarified that when a private entity repeatedly collects or obtains the same biometric identifier or information from the same person using the same method, it constitutes a single violation, entitling the individual to only one recovery: “A private entity that, in more than one instance, collects, captures, purchases, receives through trade, or otherwise obtains the same biometric identifier or biometric information from the same person using the same method of collection in violation of [the Act] has committed a single violation . . . for which the aggrieved person is entitled to, at most, one recovery.”⁶ It also modernized compliance practices by expressly permitting consent through electronic signatures.⁷ This change significantly reduces exposure by treating repeated scans as a single violation, though it does not eliminate litigation risk entirely.

For more information about the BIPA amendment, see our prior blog post.

Retroactivity

A central question in the years since the 2024 amendment was enacted has been whether the amendment applies retroactively. If it does, all pending BIPA litigation (regardless of when filed or when the alleged scan occurred) is subject to the new damages rule—i.e., a single penalty per affected individual, rather than per-scan penalties for each affected individual.

The Illinois legislature did not specify whether the changes govern violations occurring before the effective date. Prior to the Seventh Circuit’s decision, there seemed to be a growing (though not uniform) consensus that the amendment was not retroactive. For example, in Gregg v. Central Transport LLC, Judge Bucklo initially concluded the amendment should apply retroactively because it clarifies the original statute, citing legislative intent to resolve ambiguity highlighted in Cothron.⁸ But she reversed herself after the plaintiff moved for reconsideration in light of a number of intervening decisions going the other way.⁹ And in Schwartz v. Supply Network, Inc., Judge Alexakis determined the amendment operates only prospectively, reasoning that it substantively alters the law by redefining what constitutes a violation.¹⁰

Seventh Circuit Opinion

On April 1, 2026, the Seventh Circuit resolved this split among district courts and, going against the emerging consensus, held that the 2024 amendment does apply retroactively to cases that were pending at the time of enactment.¹¹ In a consolidated interlocutory appeal led by Clay v. Union Pacific Railroad Co., the court reversed district court rulings that had treated the amendment as prospective only and concluded that the legislature’s changes to Section 20 constitute a remedial, not substantive, modification under Illinois retroactivity principles.¹²

The appeals arose from three separate BIPA actions, including claims by Reginald Clay against Union Pacific Railroad Company and putative class actions by Brandon Willis and John Gregg against their respective employers.¹³ In each case, the plaintiffs alleged repeated collection of fingerprint or biometric data in violation of BIPA Sections 15(a), (b), and/or (d), potentially exposing defendants to millions or, in Willis’s case, billions of dollars in damages should the amendment not be applied retroactively.¹⁴ Recognizing the high stakes, the Seventh Circuit granted interlocutory review to determine whether the 2024 amendment limiting recovery to a single per‑person violation applied to already‑filed cases.

The court explained that under Illinois’s modified Landgraf framework, which “consider[s] only whether the General Assembly has expressly indicated the temporal reach of the amendment,” if an amendment is silent, courts apply Section 4 of the Illinois Statute on Statutes, which creates a default rule based on whether the amendment is substantive or procedural.¹⁵ Substantive amendments that affect rights, duties, or when a cause of action arises apply prospectively, while procedural amendments governing how rights are enforced may apply retroactively.¹⁶ Illinois courts treat remedial provisions as procedural and therefore generally retroactive, a principle the court stated had been reaffirmed repeatedly by the Supreme Court of Illinois.¹⁷The court held that therefore the amendment governs pending cases because it affects only remedies, not the underlying standards of liability or claim accrual.¹⁸ The court emphasized that the legislature left BIPA Section 15, the statute’s liability provision, untouched and instead amended Section 20, the statute’s damages provision, by clarifying that repeated collection or disclosure of the same biometric identifier from the same person using the same method gives rise to “at most, one recovery.”¹⁹ The court concluded that this change cabins the damages available to plaintiffs without altering when a cause of action arises or what conduct the statute prohibits, placing the amendment squarely within Illinois’s long‑standing rule that remedial changes apply retroactively.²⁰

The court rejected plaintiffs’ remaining arguments against retroactive application of the amendment.²¹ It concluded that treating remedial changes as procedural did not depend on the abandoned “vested rights” framework; Illinois courts had repeatedly reaffirmed that remedial amendments were procedural and could apply retroactively, and later decisions had continued to rely on that principle even under the modern retroactivity framework.²² The court also rejected plaintiffs’ argument that the amendment was substantive because it altered incentives or affected conduct outside the courtroom.²³ It reasoned that all remedial changes necessarily influence behavior to some degree and that accepting plaintiffs’ view would improperly convert damages‑related amendments into substantive changes, contrary to long-standing Illinois law.²⁴ Finally, the court found no state constitutional barrier to retroactive application.²⁵ Illinois law had long held that plaintiffs had no vested right in a particular remedy, especially where damages were discretionary.²⁶ Because the amendment reduced rather than increased potential liability, it impaired no protected rights.²⁷ Accordingly, applying the amendment retroactively raised no constitutional concerns.²⁸

As a result, the Seventh Circuit held that plaintiffs alleging thousands of biometric scans are entitled to no more than a single statutory recovery under amended Section 20, even in actions filed before the amendment was enacted on August 2, 2024.²⁹ The court reversed and remanded all three district court decisions, instructing lower courts to reassess damages calculations, and potentially subject matter jurisdiction, in light of the retroactive application of the amendment.³⁰

Conclusion

The Seventh Circuit’s decision in Clay v. Union Pacific Railroad Co. marks a significant turning point in BIPA litigation. By holding that the 2024 amendment limiting recovery to a single per‑person violation applies retroactively to pending cases, the court substantially reduced the damages exposure facing defendants in the many actions filed under the statute’s earlier interpretation. The ruling resolves a growing split among Illinois district courts and provides long‑awaited clarity on the scope and temporal reach of the amendment.

At the same time, the decision underscores that BIPA remains an aggressive enforcement regime. While the amendment curtailed so‑called per‑scan damages, the statute continues to provide significant statutory damages for violations. Companies operating biometric systems should therefore continue to assess their compliance programs, particularly with respect to notice and consent practices.

Finally, the court’s decision may have broader implications beyond damages calculations, including federal jurisdiction. Decreasing the amount of damages available in BIPA cases may affect whether the removal provisions of the Class Action Fairness Act (“CAFA”) apply in any particular case; CAFA removal is only available when the amount-in-controversy exceeds $5 million. 28 U.S. Code § 1332(d)(2). Similar issues have already arisen in cases filed post-amendment.³¹

As lower courts begin applying the decision on remand, additional guidance is likely to emerge regarding case strategy and settlement dynamics in BIPA litigation going forward. Please subscribe to the WilmerHale Privacy and Cybersecurity Law blog to stay up to date on all our articles as we continue to track this evolving landscape.

Footnotes:

1. 740 Ill. Comp. Stat. Ann. 14/15 (West 2025).
2. Id. §15.
3. Id.
4. Id. §20.
5. Cothron v. White Castle Sys., Inc., 2023 IL 128004, 216 N.E.3d 918, as modified on denial of reh’g (July 18, 2023).
6. 740 Ill. Comp. Stat. Ann. 14/15(b), 14/15(d), 14/20(b).
7. Id.
8. Gregg v. Cent. Transp. LLC, No. 24 C 1925, 2024 WL 4766297 (N.D. Ill. Nov. 13, 2024), opinion vacated on reconsideration, No. 24 C 1925, 2025 WL 907540 (N.D. Ill. Mar. 21, 2025). 
9. Gregg v. Cent. Transp. LLC, No. 24 C 1925, 2025 WL 907540 (N.D. Ill. Mar. 21, 2025).
10. Schwartz v. Supply Network, Inc., No. 23 CV 14319, 2024 WL 4871408 (N.D. Ill. Nov. 22, 2024).
11. Clay v. Union Pac. R.R. Co., No. 25-2185, 2026 WL 891902 (7th Cir. Apr. 1, 2026).
12. Id. at *7.
13. Id. at *2.
14. Id. at *3.
15. Clay, 2026 WL 891902 at *3.
16. Id. 
17. Id. 
18. Id. at *4.
19. Id. at *4-6.
20. Id. at *6.
21. Id.
22. Id.
23. Id.
24. Id. at *7.
25. Id.
26. Id.
27. Id. 
28. Id.
29. Id.
30. Id.
31. Jones v. USP Chicago, Inc., No. 23 CV 16817, 2025 WL 1547290 (N.D. Ill. May 29, 2025).