Court decision · 17 February 2023
Cothron v. White Castle System, Inc.
2023 IL 128004 · Supreme Court of Illinois
Superseded. An August 2024 amendment treats repeated collection from the same person by the same method as a single violation.
What it means for your code
B2B vendors shipping biometric login or time-clock features carry per-person statutory exposure for their customers' users; build consent capture into the product.
What happened
An employee scanned her fingerprint to access work systems for years without BIPA-compliant consent.
What was decided
A separate BIPA claim accrues with each scan or transmission of biometric data. (Illinois amended BIPA in August 2024 to treat repeated collection from the same person as a single violation.)
The legal test applied
- A separate BIPA claim accrues with each scan or transmission made without consent
What would have changed the outcome
- Collection after written consent
Summary and analysis by Lawpatch, checked by an editor against the source. Risk analysis, not legal advice; the law may have moved on since this decision.