Question 1

Does BIPA apply to AI video interview tools like HireVue?

Accepted Answer

Yes. Illinois BIPA (740 ILCS 14) applies to any collection of biometric identifiers, including facial geometry derived from video analysis. AI video interview platforms that use facial analysis or emotion detection to evaluate candidates collect biometric data within BIPA's definition. The employer is responsible for BIPA consent obligations even when the collection happens through a vendor's platform.

Question 2

What is the difference between BIPA (Illinois) and CUBI (Texas)?

Accepted Answer

Both laws regulate biometric data in employment contexts, but enforcement mechanisms differ significantly. Illinois BIPA (740 ILCS 14) has a private right of action — individuals can sue directly — with statutory damages of $1,000 per negligent violation and $5,000 per intentional or reckless violation per person. Texas CUBI (Tex. Bus. & Com. Code § 503.001) is enforced exclusively by the Texas Attorney General, with civil penalties up to $25,000 per violation. Illinois BIPA is the higher class action risk.

Question 3

What biometric data does a voice AI tool collect?

Accepted Answer

Voice pattern analysis tools that identify characteristics of a speaker's voice — pitch, cadence, stress patterns — collect voiceprints, which are a covered biometric identifier under both 740 ILCS 14 (BIPA) and Tex. Bus. & Com. Code § 503.001 (CUBI). If your AI hiring platform uses voice analysis to score candidate responses, BIPA/CUBI consent is required for Illinois and Texas applicants before the analysis begins.

Question 4

What does a BIPA-compliant biometric consent form need to say?

Accepted Answer

Under 740 ILCS 14/15(b), a BIPA-compliant consent form must inform the subject: (1) that biometric data is being collected or stored, (2) the specific purpose for the collection and use of the biometric data, (3) the length of time for which the data will be collected, stored, and used. The consent must be obtained in written form (electronic is acceptable) and must be given before collection begins.

Question 5

How long can employers retain biometric data under BIPA?

Accepted Answer

Under 740 ILCS 14/15(a), biometric data must be permanently destroyed when the initial purpose for collection has been satisfied, or within 3 years of the individual's last interaction with the employer — whichever comes first. Employers must have a publicly available written retention schedule. Retaining biometric data beyond the required period is an independent violation.

Question 6

What is the required biometric data destruction process?

Accepted Answer

Permanent destruction under BIPA means the biometric data cannot be reconstructed. Deletion from active systems is not sufficient if backup copies exist. The destruction must apply to all copies in all locations. Employers must document destruction with a dated record of when data was destroyed and what data was covered. EmployArmor's destruction log creates this record automatically when the retention period triggers.

Question 7

Can employers be sued for BIPA violations without a data breach?

Accepted Answer

Yes. The Illinois Supreme Court confirmed in Rosenbach v. Six Flags Entertainment Corp. (2019) that a BIPA violation — such as collecting biometric data without consent — constitutes an actionable injury without requiring proof of actual harm. This means employers who use AI tools that collect biometric data without proper consent are exposed to class action lawsuits even if no breach or misuse of the data occurs.

Question 8

Does Washington's biometric law apply to AI hiring tools?

Accepted Answer

Washington's biometric privacy law (Wash. Rev. Code § 19.375) covers the enrollment of biometric identifiers for commercial purposes. Unlike BIPA, it does not have a private right of action — enforcement is by the Washington Attorney General. The law requires notice and consent before collection and prohibits sale of biometric identifiers. Employers using AI video tools in Washington should assess whether facial geometry or voice analysis triggers Wash. Rev. Code § 19.375 obligations.

Question 9

What BIPA policy must employers publish publicly?

Accepted Answer

Under 740 ILCS 14/15(a), employers must develop and make publicly available a written policy establishing a retention schedule and guidelines for permanently destroying biometric data when the initial purpose is satisfied or the retention period expires. This policy must be accessible to the public — posting in an internal HR manual does not satisfy the requirement. The policy must be updated whenever the employer adds new biometric data collection practices.

Question 10

What are typical BIPA class action settlement amounts?

Accepted Answer

BIPA class action settlements have ranged from $9.5 million (BNSF Railway, 2023) to over $650 million (Facebook/Meta, 2022) and $92 million (TikTok, 2022). In the employment context, cases with thousands of employees or applicants in Illinois can quickly accumulate $1,000–$5,000 per-person statutory damages. Employers who used AI hiring tools without BIPA consent for even a single hiring cycle may face class exposure in the tens or hundreds of millions.

Biometric Compliance FAQ: BIPA and CUBI for AI Hiring Tools

Frequently Asked Questions

Related AI Employment Laws

Assess Your Biometric Compliance Risk