Seventh Circuit Ruling Resets the BIPA Damages Landscape for Illinois Employers
A landmark decision issued April 1, 2026 by the U.S. Court of Appeals for the Seventh Circuit has significantly changed the stakes of biometric privacy litigation in Illinois. In a consolidated ruling resolving three interlocutory appeals—Clay v. Union Pacific Railroad Co., Willis v. Universal Intermodal Services, and Gregg v. Central Transport LLC—the court held that a 2024 amendment to the Illinois Biometric Information Privacy Act (BIPA) capping damages at a single recovery per plaintiff applies retroactively to all cases pending at the time the amendment was enacted. For Illinois businesses facing open claims, this decision fundamentally changes the financial calculus.
Background on Illinois BIPA Damages and Liability
BIPA has been one of the most consequential privacy statutes in the country since its enactment, requiring private entities to obtain written consent before collecting biometric identifiers such as fingerprints, retina scans, and facial geometry. BIPA damages carry real teeth: $1,000 per negligent violation and $5,000 per intentional or reckless one.
The exposure multiplied dramatically after the Illinois Supreme Court’s 2023 ruling in Cothron v. White Castle System, Inc., which held that a separate BIPA claim accrues every time biometric data is unlawfully collected or disclosed. For a workforce using fingerprint time clocks, that translated quickly into potentially catastrophic exposure.
The Illinois General Assembly responded in 2024 by amending BIPA Section 20 to cap damages, providing that repeated collections of the same biometric data from the same person using the same method constitute a single violation, entitling a plaintiff to at most one recovery. What remained unresolved, until now, was whether that cap applied to cases already in filed at the time the amendment was enacted.
Seventh Circuit Ruling on BIPA Damages
The court held that the 2024 amendment applies retroactively to all cases pending at the time the amendment was enacted. The analysis turned on Illinois’s law of retroactivity, which distinguishes between substantive changes (which do not apply retroactively) and procedural or remedial changes (which do).
Writing for a unanimous panel, Chief Judge Brennan concluded that the amendment is remedial in nature: it addressed the availability of damages, not proscribed conduct. The legislature placed the amendment in Section 20, the damages provision, without touching Section 15, which governs the prohibited conduct.
What the BIPA Ruling Means for Illinois Employers
The practical effects are significant and immediate. This includes all the following:
- Exposure is reduced in litigation pending in federal court. Employers facing open BIPA claims, whether individual or class, can now apply the single-recovery cap to all lawsuits that were either pending at the time the amendment was enacted or those filed thereafter. The per-scan damages theory that drove settlement demands into the millions is no longer viable.
- Settlement negotiations shift. Plaintiffs inflated opening demands, often anchored to per-scan calculations, lose their leverage. For employers engaged in or approaching mediation, this ruling provides a clearer picture of actual exposure.
- Some uncertainty remains. Illinois state courts are not bound by Seventh Circuit decisions. It is possible a state court case could reach the Illinois Supreme Court on the same question, producing a different result.
- BIPA compliance still matters. The ruling limits BIPA damages: it does not eliminate liability. Employers who have not yet brought their biometric data practices into full compliance remain exposed to litigation. The single-recovery cap is not a safe harbor.
Key Action Items for BIPA Compliance
Wondering how you can stay in compliance with BIPA? Levin Ginsburg recommends taking the following steps to start:
- Audit current biometric data practices. Confirm that written consent is being obtained before any collection, and that your retention and destruction policy is documented and followed.
- Review pending BIPA claims considering this ruling. If your company is a named defendant in an open BIPA case, consult with counsel to reassess litigation strategy and settlement posture under the single-recovery framework.
- Evaluate class action exposure with updated damages modeling. Prior projections based on per-scan calculations should be revisited.
- Monitor Illinois state court developments. A state court of appeals raising the same retroactivity issue could eventually prompt the Illinois Supreme Court to weigh in.
- Document your compliance program. Even with reduced damages exposure, a robust BIPA compliance record remains the best protection against liability and the most effective tool in settlement discussions.
If your organization is dealing with a data breach, or looking to strengthen its incident response plan before one occurs, Levin Ginsburg is here to help. Because every situation involves unique facts and risks, we recommend reaching out through our website to discuss your specific circumstances with our team.
