Which Section You Violated Decides Which Courthouse
Almost every article about the Illinois Biometric Information Privacy Act is about what it requires. Almost none is about the question that gets decided first in a real case: whether the complaint can be heard in federal court at all. BIPA's sections answer that differently, and the answer moves the exposure more than most compliance changes do.
The strange shape of a BIPA jurisdictional fight
In most litigation the defendant argues the plaintiff has suffered no injury and the plaintiff argues they have. BIPA inverts it. Because Illinois state courts do not apply the federal Article III requirement — and because Rosenbach v. Six Flags (Ill. 2019) held that a statutory violation alone makes a person "aggrieved" under BIPA without any separate damage — the plaintiff often wants less injury on the face of the complaint, not more, so the case cannot be removed. The defendant, meanwhile, argues the plaintiff was genuinely harmed, so that a federal judge can hear it.
If that sounds procedural to the point of triviality, consider what rides on it: which bench rules on class certification, whether a threshold standing motion is available at all, and which jury pool values a statutory privacy violation. For a company that has deployed a face-recognition timeclock, a voice-authentication line or an AI security-camera analytics feature across an Illinois workforce, this is the first fork in the road and it is largely decided by documents you already control.
Three decisions that split the statute
Bryant v. Compass Group USA (7th Cir. 2020)
§ 15(b) — STANDING EXISTSA vending machine took a fingerprint without the written notice and release § 15(b) requires. The court held the loss of the right to decide, informed, whether to hand over a biometric is itself a concrete injury — so the case belonged in federal court and remand was reversed.
Read this as the default: a well-pleaded notice-and-consent claim is federally justiciable. It is also the claim most deployments actually expose, because the consent artefact is the thing most often missing.
Fox v. Dakkota Integrated Systems (7th Cir. 2020)
§ 15(a) — SPLIT IN TWOBryant had said a bare failure to publish a retention-and-destruction schedule is a duty owed to the public, not an injury to one person. Fox distinguished the other half of the same section: unlawfully holding an individual's handprint after the statutory destruction trigger invades that individual's privacy and does confer standing.
The operative question is therefore not 'is this a § 15(a) claim' but 'is this a publication claim or a retention claim'. Your own retention log decides which one a plaintiff can plausibly plead.
Thornley v. Clearview AI (7th Cir. 2021)
§ 15(c) — PLEADED AWAYPlaintiffs brought only a § 15(c) claim — profiting from biometric data — and expressly alleged no particularised injury. The Seventh Circuit affirmed remand: a plaintiff is the master of the complaint and may draft one that fails Article III on purpose.
This is the manoeuvre that makes removal a coin-flip rather than a strategy. A sophisticated plaintiff's firm decides the forum at the drafting stage, and the narrow pleading it takes to stay in state court also caps what the class can recover.
How a case actually gets to federal court
Diversity removal under the Class Action Fairness Act is the usual route: a proposed class over 100 members, an aggregate amount in controversy above $5 million, and minimal diversity between any class member and any defendant. BIPA classes clear the size and amount thresholds easily — statutory damages of $1,000 per negligent violation and $5,000 per reckless or intentional one reach $5 million at 5,000 employees on the negligent tier.
What CAFA does not supply is Article III standing, which is a separate and non-waivable requirement. That is the trap in a removal decision: remove a publication-only § 15(a) case and the federal court will not dismiss it, it will remand it — after you have paid for the motion, disclosed your position, and taught the other side which section to lean on.
What your records decide
The pleading a plaintiff can write is limited by the facts that are discoverable about your deployment. Four artefacts do most of the work:
The written release, per person, dated before first capture
§ 15(b) requires notice of the fact of collection, the specific purpose, and the retention term, plus a written release obtained beforehand. A release signed after enrolment is the violation, not the cure — and it is the claim that carries standing into federal court.
A publicly available retention and destruction schedule
§ 15(a) requires the policy to be published. Missing it produces the one theory that cannot be removed, which means the case stays in the forum plaintiffs prefer. Publishing it is a single page of text and it changes the jurisdictional posture of any future claim.
Proof that destruction actually happened on schedule
The Fox half of § 15(a). A published policy you do not follow is worse than no policy: it supplies both the standard and the breach. The record needed is a dated deletion log tied to the triggering event, not a statement of intent.
Vendor contract terms on disclosure and profit
§ 15(c) and § 15(d) reach dissemination and profiting from biometrics. Where a third-party AI provider processes the template, the contract is what shows whether anyone profited from it — and § 15(c) is the section Thornley used to defeat removal.
There is a counter-intuitive consequence worth stating plainly. Fixing the § 15(a) publication gap makes the remand-proof theory unavailable and pushes a future plaintiff toward § 15(b) — a claim that is removable. Fixing the § 15(b) consent gap removes the strongest claim outright. Both are worth doing; only one of them also moves the forum, and it is the cheaper of the two.
What is no longer in dispute
Three questions that once drove BIPA strategy have been answered and should not be re-litigated in an internal memo. Rosenbach (2019) settled that no separate damage beyond the statutory violation is needed to sue. Tims v. Black Horse Carriers (2023) settled that the limitations period is five years for every section, not two. Cothron v. White Castle (2023) settled that a claim accrued on every scan — and then Illinois SB 2979, effective August 2, 2024, settled the damages consequence the other way, treating repeated collections of the same biometric from the same person by the same method as a single violation. The remaining live questions are forum, certification and whether your consent record exists.
Is your biometric notice reachable on the page that collects?
§ 15(b) notice and the § 15(a) schedule both have to be findable by the person being scanned. A policy behind a hover-only link, inside an unlabelled PDF, or on a page a screen reader cannot parse is a notice you will have trouble proving was given. Scan the page free and see what a claimant's lawyer would find.
Scan Your Consent Page for Free →This is background on how BIPA cases are allocated between courts, not legal advice. Forum strategy in a live matter is a decision for counsel with the complaint in front of them.
Frequently Asked Questions
Why would a defendant want a BIPA case in federal court?
Three reasons that are mechanical rather than atmospheric: a federal judge rules on Article III standing at the threshold, which is a dismissal argument that does not exist in Illinois state court; Rule 23 certification practice is more developed and generally more demanding than the Illinois analogue; and removal moves the case out of the Cook County Circuit Court venue where most BIPA class actions are filed and tried. None of it touches the merits. It changes who decides and how early.
What did Bryant v. Compass Group actually hold?
The Seventh Circuit held in 2020 that a § 15(b) claim — collecting a biometric identifier without first giving written notice and obtaining a written release — is a concrete injury for Article III purposes, because the statute creates a right to be informed before the scan and losing that right is the harm itself. In the same opinion it held that a bare § 15(a) claim, meaning failure to make a retention-and-destruction schedule publicly available, is a duty owed to the public at large and does not by itself confer standing on an individual plaintiff.
So a § 15(a) claim can never be in federal court?
Not quite, and the distinction matters. Fox v. Dakkota Integrated Systems, also Seventh Circuit 2020, separated the two halves of § 15(a): failing to publish the policy is the public-facing duty from Bryant, but unlawfully retaining a person's biometric data past the statutory destruction deadline is a concrete invasion of that person's own privacy interest and does confer standing. A § 15(a) retention theory travels to federal court; a § 15(a) publication theory does not.
Can a plaintiff choose to stay out of federal court?
Yes, and Thornley v. Clearview AI is the playbook. The Seventh Circuit affirmed remand in 2021 because the plaintiffs had deliberately pleaded a narrow § 15(c) profit-from-biometrics claim and expressly disclaimed any particularised injury. A plaintiff is the master of the complaint and may plead away the very injury that would support federal jurisdiction. The trade is real: the narrower the pleading, the narrower the recovery it can support.
Does the 2024 amendment change the forum analysis?
It changes the stakes rather than the jurisdictional test. Illinois SB 2979, signed August 2, 2024, provides that repeated collections of the same biometric from the same person by the same means constitute a single violation for damages — which reversed the per-scan arithmetic from Cothron v. White Castle that had made a timeclock case a nine-figure exposure. Standing still turns on which section was violated and how it was pleaded. What moved is the number at the end.
How long do we stay exposed after switching the system off?
The Illinois Supreme Court held in Tims v. Black Horse Carriers in 2023 that a five-year limitations period applies to all BIPA claims, not the two-year period for privacy publication torts. A face-recognition feature retired in 2026 is inside the window until 2031, which is why the retention-and-destruction half of § 15(a) outlives the deployment and why the deletion you performed needs a dated record proving it happened.