Chicago Business Attorney Blog
What happened?
The Seventh Circuit Court of Appeals held in Clay v. Union Pacific Railroad Co. that the 2024 amendment to Section 20 of the Illinois Biometric Information Privacy Act applies to cases that were already pending when the amendment took effect on August 2, 2024.
What does that mean?
Businesses defending existing BIPA lawsuits over repeated biometric scans now have a strong legal argument that damages are capped at one recovery per person for the same method of collection, not one recovery per scan, as the Illinois Supreme Court previously allowed in Cothron v. White Castle.
What should you do?
Treat this ruling as an opportunity to audit your biometric time clocks, vendor contracts, consent forms, retention schedules, security practices, and insurance coverage before the next demand letter arrives.
The Seventh Circuit’s decision in Clay v. Union Pacific Railroad Co. is the most significant development in BIPA litigation since the Illinois legislature amended the statute in 2024. For Illinois businesses currently defending BIPA claims, or at risk of facing them, the ruling materially changes the damages picture. But it is not a free pass. BIPA remains fully in force, and the companies that use this moment to clean up compliance will be far better positioned when the next claim arrives.
BACKGROUND: HOW BIPA DAMAGES BECAME A BUSINESS-ENDING THREAT
The Illinois Biometric Information Privacy Act requires businesses that collect biometric data, including fingerprints, hand geometry, facial scans, retina scans, and similar identifiers, to follow strict notice, consent, retention, and security rules. 740 ILCS 14/15. Violations carry statutory damages of $1,000 per negligent violation and $5,000 per reckless or intentional violation, plus attorneys’ fees and possible injunctive relief. 740 ILCS 14/20(a).
The exposure became potentially crushing after Cothron v. White Castle Sys., Inc., 216 N.E.3d 918 (Ill. 2023), in which the Illinois Supreme Court held that a new BIPA claim accrues with every single scan or transmission of biometric data. For an employer with hundreds of employees clocking in and out daily over several years, that meant damages could multiply into the tens or hundreds of millions of dollars, even for technical violations involving no actual harm.
THE 2024 AMENDMENT: WHAT THE LEGISLATURE CHANGED
The Illinois legislature responded to Cothron by amending Section 20 of BIPA, effective August 2, 2024. The amendment provides that:
Repeated collection of the same person’s biometric data using the same method counts as a single recoverable violation under Section 15(b).
Repeated disclosure of the same person’s biometric data to the same recipient using the same method counts as a single recoverable violation under Section 15(d).
Statutory authority: 740 ILCS 14/20(b), (c); Pub. Act 103-0769, eff. Aug. 2, 2024.
What the amendment did not resolve was whether this damage-limiting rule would apply to lawsuits already filed before August 2, 2024. That question is what the Seventh Circuit answered in Clay.
CLAY V. UNION PACIFIC: WHAT THE SEVENTH CIRCUIT HELD
In Clay v. Union Pacific Railroad Co., a consolidated appeal that also included Willis v. Universal Intermodal Services, Inc. and Gregg v. Central Transport LLC, the Seventh Circuit held that the 2024 amendment applies retroactively to pending cases.
The court’s reasoning is the key. The Seventh Circuit concluded that the amendment changed the remedy available under BIPA, not the underlying legal duties. The substantive obligations in Section 15 remain exactly the same. Businesses must still obtain consent, maintain a public retention and destruction policy, disclose the purpose and duration of collection, and protect biometric data with reasonable safeguards. What changed is how damages are measured under Section 20.
Under established Illinois retroactivity doctrine, remedial and procedural changes apply to pending cases. Relying on Perry v. Department of Financial and Professional Regulation, 106 N.E.3d 1016 (Ill. 2018), and Commonwealth Edison Co. v. Will County Collector, 749 N.E.2d 964 (Ill. 2001), the court held that the 2024 amendment falls into that category and therefore governs cases that were already in litigation when it took effect.
Citation: Clay v. Union Pac. R.R. Co., Nos. 25-2185, 25-2761, 25-2762, slip op. at 7, 17 (7th Cir. Apr. 1, 2026).
WHAT CLAY MEANS FOR ILLINOIS BUSINESSES DEFENDING BIPA CLAIMS
If your company is currently defending a BIPA lawsuit based on employees repeatedly scanning a fingerprint or hand at the same time clock, Clay gives you a significantly stronger damages argument than you had before.
Instead of multiplying statutory damages by every individual scan over the entire class period, you now have grounds to argue that recovery is limited to at most one recovery per person for the same method of collection under Section 15(b), and at most one recovery per person to the same recipient for the same method under Section 15(d).
That single change can dramatically alter settlement value, litigation reserves, and overall case strategy. Cases that looked financially catastrophic under the Cothron per-scan theory may now be defensible at a fraction of the original exposure.
WHAT CLAY DOES NOT DO: THE LIMITS OF THIS RULING
Clay is an important decision, but Illinois businesses should not overread it. Several significant limitations apply.
The underlying BIPA obligations remain fully in force. Your business still needs a publicly available retention and destruction policy, written notice to employees before collecting biometric data, disclosure of the purpose and length of use, a written release (which may now include an electronic signature), and reasonable security safeguards for stored biometric data. 740 ILCS 14/10; 14/15(a), (b), (d), (e).
Statutory damages remain substantial. Even under the amended statute, a negligent violation still carries $1,000 per person, and a reckless or intentional violation carries $5,000 per person, plus attorneys’ fees, litigation costs, and possible injunctive relief. For a class of several hundred employees, exposure remains serious.
Not every BIPA theory is reduced to one recovery. The 2024 amendment specifically addresses repeated collection under Section 15(b) and repeated disclosure to the same recipient under Section 15(d). Claims involving a missing or inadequate retention and destruction policy under Section 15(a), different methods of collection, or disclosures to different recipients may still create meaningful and unaffected exposure.
Clay is a federal court’s prediction of Illinois law, not a final Illinois Supreme Court ruling. It carries significant weight, but the Illinois Supreme Court could ultimately reach a different conclusion on retroactivity. Businesses should factor that uncertainty into their strategy.
YOUR BIPA COMPLIANCE CHECKLIST: WHAT TO FIX NOW
Clay is an opportunity. The businesses that treat this ruling as a reason to audit and correct their biometric data practices, rather than as a reason to relax, will be best positioned when the next demand letter arrives:
☐ Confirm you have a written, publicly available biometric data retention and destruction policy.
☐ Verify that written notice is provided to employees before any biometric data is collected.
☐ Confirm that your consent forms disclose the specific purpose and duration of biometric data use.
☐ Update consent forms to allow electronic signatures, as now permitted under the amended statute.
☐ Review all vendor and third-party contracts involving biometric data for disclosure compliance under Section 15(d).
☐ Assess whether your biometric data storage and transmission practices meet the reasonable safeguards standard.
☐ Review insurance coverage for BIPA-related claims and verify that your policy terms reflect current exposure.
☐ If you are currently defending a BIPA claim, reassess settlement value and litigation reserves in light of Clay.
☐ Consult counsel before making changes to biometric collection methods that could affect your existing exposure.
FREQUENTLY ASKED QUESTIONS
Does Clay v. Union Pacific affect BIPA cases that were filed before the 2024 amendment? Yes. That is the core holding. The Seventh Circuit ruled that the 2024 amendment to Section 20 of BIPA applies to cases that were already pending when the amendment took effect on August 2, 2024, because the amendment changed the remedy rather than the underlying legal duty. Defendants in pending cases can now argue that damages are capped at one recovery per person per method of collection, not one recovery per scan.
Does this ruling eliminate our BIPA liability entirely? No. Clay reduces the potential scale of damages in many pending cases, but it does not eliminate BIPA liability. The substantive obligations under Section 15, including written notice, consent, a public retention policy, and security safeguards, remain fully in force. Statutory damages of $1,000 to $5,000 per person still apply, plus attorneys’ fees and possible injunctive relief.
What if we use multiple biometric collection methods, for example a fingerprint scanner and a facial recognition system? The 2024 amendment limits damages for repeated collection using the same method. A business that collects biometric data using different methods may face separate recoveries for each distinct method. This is an area where individual fact analysis matters, and legal counsel should be consulted.
We use a third-party vendor that handles biometric time clocks. Are we still exposed? Yes. Illinois employers remain responsible for BIPA compliance even when a vendor handles the technology. Vendor contracts should be reviewed for indemnification provisions, disclosure obligations under Section 15(d), and alignment with your retention and destruction policy.
Is Clay the final word on retroactivity? Not necessarily. Clay is a Seventh Circuit decision predicting how Illinois courts will apply the retroactivity doctrine. It carries significant persuasive authority, but the Illinois Supreme Court has not directly ruled on whether the 2024 amendment applies to pending cases. That remains a risk factor defendants should monitor.
What should we do if we are currently defending a BIPA lawsuit? Consult your litigation counsel immediately to reassess the damages exposure under Clay, revisit settlement value and reserves, and evaluate whether the amendment affects any pending motions or class certification issues. Separately, use this moment to audit your underlying compliance practices regardless of the lawsuit’s outcome.
CONSULT WITH EXPERIENCED ILLINOIS BUSINESS ATTORNEYS The attorneys at Bellas & Wachowski have been counseling Illinois business owners on BIPA compliance and employment law for decades. Whether you are defending a pending claim, assessing your current biometric data practices, or updating consent forms and vendor contracts, we offer the experience your business needs. Contact us for more information. This article is provided for general informational purposes only and does not constitute legal advice. You should not act upon any information in this article without seeking the advice of a licensed attorney. Prior results do not guarantee a similar outcome.