Each of these is a refusal this regime lets a counterparty attempt, paired with the answer to it. Reading them before you write is worth more than any amount of polish on the letter itself.
The SB 2979 single-recovery cap
high likelihoodUnder 740 ILCS 14/20, repeated collection of the same biometric identifier by the same method is a single violation. The claimant is entitled to one recovery, not one per scan.
What answers it
For collection by one method, this is now the law and you should not fight it — accept one recovery and move on to the parts it does not cover. What the cap does NOT reach: (1) separate METHODS of collection — a fingerprint timeclock and a facial-recognition camera are two methods, and each carries its own recovery; (2) violations of § 15(a), the retention-schedule and destruction duty, which the amendment did not touch; (3) violations of § 15(c), the absolute prohibition on selling, leasing, trading or otherwise profiting from biometric data; (4) disclosure to DIFFERENT recipients, since the cap runs per recipient. Plead each separately.
Public Act 103-0769 (SB 2979), effective 2 August 2024 — single recovery per person per method of collection — 740 ILCS 14/20(b)–(c)
The amendment applied backwards to conduct before August 2024
high likelihoodThe 2024 amendment clarified existing law rather than changing it, so it applies to your claim even though the conduct predates it.
What answers it
This is genuinely contested and you should not concede it. The argument against retroactive application is that the amendment substantively changed the measure of damages rather than clarifying a procedure, and Illinois law generally presumes amendments affecting substantive rights operate prospectively. If your collection occurred before 2 August 2024, plead Cothron accrual in the alternative and make them litigate it. Check the current state of Illinois appellate authority before filing — this was moving through the courts during 2025 and 2026.
Public Act 103-0769 (SB 2979), effective 2 August 2024 — single recovery per person per method of collection — 740 ILCS 14/20(b)–(c)
"You consented in the employee handbook"
high likelihoodThe claimant acknowledged our handbook, which discloses the timeclock system.
What answers it
§ 15(b) requires three specific things before collection: written notice that a biometric identifier is being collected or stored, written notice of the specific purpose and the length of term for which it will be collected, stored and used, and a WRITTEN RELEASE executed by the subject. A general handbook acknowledgment is none of these. Ask for the document that names the biometric identifier, states the retention term, and bears a signature. It usually does not exist.
740 ILCS 14/15 — retention, consent, no sale, no disclosure, standard of care — § 15(a)–(e)
"You suffered no actual injury"
medium likelihoodThe claimant cannot identify any harm from our collection of their fingerprint, so there is no claim.
What answers it
Rosenbach v. Six Flags, 2019 IL 123186, is directly against this: a person is "aggrieved" within § 20 by the statutory violation itself, and need show no additional injury. That is the whole design of the statute — liquidated damages exist precisely because biometric harm is hard to quantify and impossible to undo.
Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186 — a statutory violation alone makes a person "aggrieved"
"The vendor collected it, not us"
medium likelihoodThe biometric data was collected and stored by our timeclock vendor. Direct your claim to them.
What answers it
BIPA reaches any "private entity" that collects, captures, obtains, stores or discloses biometric identifiers, and both the employer and the vendor routinely qualify. The employer obtained the identifier; the vendor stored it. Sue both, and let them argue about apportionment. § 15(a) also requires a publicly available written retention and destruction policy — ask each of them for theirs.
740 ILCS 14/15 — retention, consent, no sale, no disclosure, standard of care — § 15(a)–(e)