An Illinois federal district court has ruled that the August 2024 amendment to the Illinois Biometric Information Privacy Act (BIPA), which imposes limits on recoverable damages, cannot be applied retroactively to alleged violations that occurred before the amendment took effect. The decision preserves the possibility of higher damage awards for pre-amendment conduct and sets an important precedent for ongoing BIPA litigation.
The ruling, issued on July 9, 2025, arose from a class action lawsuit accusing a company of violating BIPA and committing common law negligence. The defendants had sought dismissal of the case, arguing that the court lacked jurisdiction under the Class Action Fairness Act (CAFA). Specifically, they claimed that applying the new damages cap retroactively would reduce potential damages below CAFA’s $5 million amount-in-controversy threshold, thereby removing the case from federal jurisdiction. However, the court rejected that argument, finding that the amended damages limits do not apply to conduct occurring before the law’s effective date of August 2, 2024.
Amendment Limits Damages but Not Retroactively
The August 2024 amendment to BIPA, enacted as Public Act 103-0769, significantly reduced potential liability by clarifying that damages apply to each individual rather than each biometric scan and by permitting electronic signatures to satisfy the law’s written consent requirements. These changes were designed to address the surge in high-value settlements and verdicts in BIPA class actions. For instance, a class action lawsuit against ITS Technologies involving fingerprint timekeeping systems highlighted the stakes of BIPA litigation and the potentially massive financial exposure facing employers.
In its opinion, the court explained that statutory amendments affecting substantive rights, including the availability or scope of damages, generally apply only prospectively unless the legislature explicitly states otherwise. Applying established legal principles, the court concluded that the BIPA amendment is a substantive change because it limits the amount of damages plaintiffs can seek. As a result, claims based on conduct before August 2, 2024, remain governed by the original version of BIPA, which allows for liquidated damages for each instance of biometric data collection or disclosure without proper consent.
Broader Impact on BIPA Litigation and Other States
The ruling could influence many other pending BIPA lawsuits, as the retroactivity of the amendment has become a central question in the ongoing wave of biometric privacy litigation in Illinois. Recently, an Illinois federal judge allowed Union Pacific to pursue an early appeal to the Seventh Circuit on this precise retroactivity issue, recognizing the matter’s significance and the lack of binding appellate guidance so far.
Meanwhile, other states are expanding their biometric privacy frameworks. Colorado has enacted its own biometric privacy law, which requires consent for collecting biometric data and mandates timely deletion of such information. These developments underscore the evolving legal landscape facing businesses that handle biometric identifiers across multiple jurisdictions.
The Illinois court’s interpretation reinforces settled principles that amendments changing substantive rights typically do not apply retroactively, a stance that may shape similar decisions in other states as biometric privacy laws continue to develop.
Sources: JD Supra, McGlinchey, JD Supra – Biometric Information Privacy Act
–
By Cass Kennedy
