The state of Illinois enacted an amendment to its Biometric Information Privacy Act (BIPA) in 2024 that limited liability for companies. Under the amendment, if a company collects biometric information “from the same person using the same method of collection” in violation of BIPA, it is deemed to have committed only a single violation. As a result, plaintiffs are entitled to “one recovery” per violation. 740 ILCS 14/20.

Earlier this month, the Seventh Circuit Court of Appeals heard the appeal of three consolidated cases concerning whether the limited liability amendment should be applied retroactively, including Willis v. Universal Intermodal Services. Inc., No. 25-2761 (7th Cir.) and two others. The Court is reviewing the district court's rulings, which held that the amendment is not retroactive.

It is now up to the Seventh Circuit to determine whether the amendment is remedial and applies retroactively, or substantive and therefore applies only to cases filed after it became law. For businesses, the concern remains the same as previously raised by the defendants in Cothron v. White Castle Systems, Inc. — counting each unlawful scan or disclosure as a separate BIPA violation, each entitled to its own damages remedy, could expose companies to potentially crippling losses.

Regardless of how the Seventh Circuit rules in these consolidated appeals, companies should pay close attention. If the amendment applies only prospectively, organizations may see an increased volume of BIPA claims, as plaintiffs could interpret this as an opportunity to pursue damages for each unlawful scan that occurred pre-amendment. 

Conversely, if the amendment is applied retroactively, companies should prepare for the likelihood that plaintiffs may place greater emphasis on alternative remedies — such as injunctive relief — rather than solely seeking monetary compensation.  We will provide an update as soon as the Seventh Circuit issues its decision.