BIPA liability and a changing penalty landscape
BIPA imposes statutory damages of up to USD 1,000 for each negligent violation and USD 5,000 for each reckless or intentional violation. A 2024 amendment narrowed exposure by counting multiple scans of the same individual on the same day as a single violation, but potential damages can still climb quickly for large fleets. In their complaint, the truckers say HMD installed inward-facing cameras that recorded and retained face templates without the notices, data-retention schedules, and consent forms mandated by the statute.
HMD argued that BIPA claims are pre-empted by the Federal Aviation Administration Authorization Act, which limits state regulation of motor-carrier services. Judge Shah rejected that defense, echoing other Illinois rulings that biometric-privacy requirements regulate data practices, not freight or route prices.
Industry pressure mounts after multimillion-dollar settlements
The case follows a USD 4.25 million January 22 2025 settlement by video-telematics firm Lytx, which denied wrongdoing but agreed to pay Illinois drivers who claimed its cameras scanned their faces without BIPA-compliant consent. Earlier, railroad operator BNSF paid USD 75 million to end a biometric suit over fingerprint readers at Chicago rail yards, underscoring the rising cost of non-compliance.
Technology vendors are responding. For example, Motive Technologies’ “Driver Privacy” mode disables the inward-facing lens after a truck idles for three minutes, while keeping the road-facing camera active for safety. Other firms have rolled out similar auto-deactivation features to limit data collection when it is not strictly required.
Federal ID checks add another layer of biometrics
BIPA suits are unfolding alongside new federal programs that also rely on biometrics. In April 2025 the Federal Motor Carrier Safety Administration began requiring new carriers to complete a selfie-based identity check, supplied by Idemia, when applying for a USDOT number. The FMCSA system includes explicit consent screens and federal data-retention limits, but it applies only to new registrants and does not override state laws like BIPA.
Judge Shah’s ruling opens the door to discovery and a potential class-certification bid later this year. With Illinois courts continuing to test the boundaries of biometric privacy, transportation companies face growing pressure to balance safety analytics with rigorous notice-and-consent protocols—or risk being the next target of high-stakes litigation.
–
By Ali Nassar-Smith
