BIPA Statutory Damages: the $1,000 and $5,000 Figures

Two numbers in one subsection built the largest privacy class-action practice in the United States. They are $1,000 and $5,000, they are per violation, and for a decade the fight was entirely about what counts as one violation.

The figures, from section 20

Section 20 of the Illinois Biometric Information Privacy Act, 740 ILCS 14/20, gives any person aggrieved by a violation a right of action against the offending party, and sets the recovery as follows:

• $1,000, or actual damages, whichever is greater, for each violation resulting from negligence.
• $5,000, or actual damages, whichever is greater, for each intentional or reckless violation.
• Reasonable attorney’s fees and costs, including expert witness fees and other litigation expenses.
• Other relief, including an injunction, as the court may deem appropriate.

The figures are liquidated floors, not caps: a plaintiff who proves larger actual damages recovers those instead. In practice nobody proves actual damages from a face template, which is why the statutory figures are the entire subject. The fee-shifting provision is the second engine — it is what makes a claim worth bringing when the individual recovery is $1,000. The text is at the Illinois General Assembly.

No injury required: Rosenbach

For the first decade of the Act the open question was whether “aggrieved” required some harm beyond the violation itself. The Illinois Supreme Court answered it in Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186, decided 25 January 2019: a person need not allege actual injury or adverse effect beyond the violation of rights conferred by the Act in order to qualify as aggrieved and to seek liquidated damages.

That holding is the reason BIPA litigation exists at scale. In every other American privacy statute the fight starts with whether the plaintiff was hurt; here it starts with whether a release was signed. Opinions of the Illinois Supreme Court are published at illinoiscourts.gov.

Per scan or per person: Cothron

The second question was arithmetic. If an employee clocks in with a fingerprint twice a day for five years, is that one violation of section 15(b) or roughly 2,500? The Illinois Supreme Court answered in Cothron v. White Castle System, Inc., 2023 IL 128004, decided 17 February 2023, on a certified question from the Seventh Circuit: a claim accrues under sections 15(b) and 15(d) with every scan or transmission, not only the first.

Set out the multiplication that follows, using the court’s own logic and nothing else:

assumptions, stated:
  employees in class          9,500
  scans per employee per day      2
  working days per year         250
  years in the class period       5

scans = 9,500 x 2 x 250 x 5      = 23,750,000
negligent, at $1,000 per scan    = $23.75 billion
reckless, at $5,000 per scan     = $118.75 billion

this is arithmetic on the statute, not a prediction of any award.

The court in Cothron acknowledged that damages of that scale could be ruinous and pointed to two limits: the word “may” in section 20 gives trial courts discretion over whether to award liquidated damages at all, and the legislature remained free to amend. Both limits were then used.

The 2024 amendment, and what it left open

The legislature acted first. Senate Bill 2979 was signed on 2 August 2024 as Public Act 103-0769 and amended section 20 so that a private entity that more than once collects or discloses a person’s biometric identifier from the same person by the same method has committed a single violation, for which the aggrieved person is entitled to at most one recovery. The same public act confirmed that an electronic signature satisfies the written-release requirement in section 15(b). The text is at the Illinois General Assembly.

What the amendment did not say is whether it applies to conduct that occurred, or claims that were filed, before 2 August 2024. That silence is the live question. Federal judges in the Northern District of Illinois have divided on it: some have treated the amendment as clarifying the legislature’s original intent and therefore applicable to pending cases, and others have treated it as a substantive change to accrued rights and therefore prospective only. It is not yet clear which reading will prevail, and the question would be settled by the Illinois Supreme Court on a certified question, by the Seventh Circuit, or by a further legislative amendment saying so expressly.

What the numbers mean in practice

Almost no BIPA case is tried, so the statutory figures function as settlement pressure rather than as awards. The publicly reported resolutions give the shape: the Facebook face-tagging class settled for $650,000,000, approved by the Northern District of California in February 2021 in In re Facebook Biometric Information Privacy Litigation, No. 3:15-cv-03747; the Google Photos matter settled in Illinois state court for $100,000,000; and the Six Flags case that produced Rosenbach itself settled for $36,000,000. Each of these is a court-approved settlement rather than a judgment, which matters: a settlement figure prices litigation risk, and no court found a per-scan damages number in any of them.

Three structural points follow for anyone building a product that touches faces or voices in Illinois. First, the exposure is a function of headcount and duration, not of harm, so a long-running internal timeclock can be worth more than a consumer feature. Second, the negligent/reckless distinction is a five-fold multiplier that turns on what you knew, which makes a documented compliance decision genuinely valuable evidence. Third, insurance is contested — coverage disputes over whether BIPA claims fall within CGL policy exclusions for violations of statutes concerning the distribution of material have been litigated in Illinois, and the outcome depends on policy wording.

For the underlying duties that generate all of this, see what section 15 actually requires. For the neighbouring Illinois statute covering AI in recorded interviews, see the AI Video Interview Act, which has no private right of action and therefore almost no litigation history — the clearest available demonstration of what the remedy, rather than the duty, is doing.