BIPA Compliance for Event Venues Using Facial Recognition (2026)
Stadiums, concert halls, and conference centers are rapidly adopting AI facial recognition for express entry and security. But if you operate in Illinois, failing to comply with BIPA could lead to catastrophic class-action lawsuits.
The Rise of Facial Recognition at Live Events
Ticketing giants and security vendors are heavily pushing biometric entry systems. "Look-and-walk" express lanes reduce crowding, while AI-powered security cameras scan crowds for banned individuals. However, the Illinois Biometric Information Privacy Act (BIPA) strictly regulates how businesses can collect and use facial geometry.
The Liability Threat
Even with the recent BIPA amendments limiting damages to a "per-person" rather than "per-scan" basis, a venue holding 20,000 attendees could face damages of $20,000,000 to $100,000,000 for a single non-compliant event (statutory damages are $1,000 to $5,000 per violation).
Key BIPA Requirements for Venues
- Prior Written Consent: You cannot scan a crowd and match faces without explicit, prior written consent. Implied consent (like a sign on the door) is NOT sufficient for BIPA.
- Specific Disclosures: Attendees must be informed in writing about the specific purpose and length of time their biometric data will be collected, stored, and used.
- Retention Policy: You must publish a written schedule detailing when the biometric data will be permanently destroyed (usually shortly after the event concludes).
- No Selling Data: You cannot sell, lease, or trade attendees' biometric data under any circumstances.
Security Cameras vs. Express Ticketing
Express Ticketing: Opt-in facial recognition ticketing is easier to defend because attendees actively choose to enroll via an app, providing an opportunity to capture a legally binding digital signature and consent form.
Security Surveillance: Passive crowd scanning is extremely high-risk. If your security cameras use AI to scan the faces of everyone walking through the gates to cross-reference a watchlist, you are collecting biometric data from thousands of people who did not consent. This is a primary target for class-action litigation.
Is Your Tech Stack Compliant?
Event venues often inherit liability from their third-party ticketing and security vendors. RatedWithAI helps organizations audit their digital infrastructure for compliance and accessibility risks.
Audit Your Systems →Frequently Asked Questions
Does BIPA apply to security cameras at event venues?
Yes, if those security cameras are equipped with AI facial recognition software that scans and identifies individuals. Standard CCTV recording does not trigger BIPA, but active biometric scanning and face-matching software strictly requires prior written consent from attendees in Illinois.
Can we use facial recognition for express ticketing lanes?
Yes, but you must strictly adhere to BIPA compliance. Attendees must explicitly opt-in, receive written disclosures about how their biometric data is used and stored, and you must have a publicly available retention policy detailing when the data will be destroyed.
Who is liable for BIPA violations: the venue or the ticketing software vendor?
In most cases, both. Illinois courts have consistently held that the entity collecting the biometric data (the venue) and the third-party vendor providing the software (the tech company) can both be held liable for BIPA violations. Venues must ensure their vendor contracts include strong indemnification clauses.