BIPA and Out-of-State Employers 2026: Your Company Is Not in Illinois, Your Employee Is

How the Reach Question Is Decided

The statute has no geographic clause, so a presumption fills the gap

BIPA does not say who it applies to geographically. Illinois courts apply a general presumption against extraterritorial application: a statute reaches conduct occurring primarily and substantially within Illinois. That test is not a checklist with a threshold — it is a weighing of where the relevant circumstances occurred, decided on the facts of the case.

The relevant conduct is the collection, not the incorporation

The circumstances that matter are where the person was when their biometric identifier was captured, where they live and work, where the relationship was formed, and where the notice and release should have been delivered. The defendant's state of incorporation and the location of its headquarters are weak signals by comparison, which is why an out-of-state employer cannot rely on its own address as a defence.

It is usually decided on a full record, not at the pleading stage

Because the test is fact-bound, courts frequently decline to resolve it on a motion to dismiss and let it proceed into discovery. That matters more than the eventual answer: the cost of a biometric class action is concentrated in class discovery, so a defence that only wins at summary judgment has already lost most of what the defence was for.

Server location is not the anchor people expect

Teams reach for where the data was processed or stored, which is intuitive and mostly unhelpful. The scan happens where the person is. A face template computed in a data centre two states away from an employee standing at an Illinois time clock does not move the conduct out of Illinois, and an Illinois-hosted server does not by itself drag a wholly out-of-state interaction in.

Personal jurisdiction is a separate question with its own answer

Whether Illinois law applies and whether an Illinois court can hear a claim against your vendor are different questions. A vendor that sells into Illinois, supports Illinois customers and processes Illinois residents' biometric data through its product is arguing about purposeful availment on facts that are not favourable, and a customer's contractual indemnity does not make the vendor's own jurisdictional exposure go away.

Five Fact Patterns With No Illinois Office

Each of these puts a capture event inside the state, on a schedule your own systems record.

The remote employee at a home workstation

A worker who lives in Illinois and logs into a system that performs face verification, keystroke or gait analysis, or camera-based attention monitoring is being scanned in Illinois every shift. The employer may have no office, no registration and no other employee in the state. The scan is still happening there, repeatedly, on a schedule your own logs record precisely.

The hire who moves mid-employment

An employee who relocates to Illinois converts a compliant arrangement into a non-compliant one silently, because consent was collected under another state's rules and nobody re-papers on a relocation. The address change sits in your HR system with a date on it, which makes the period of exposure easy for a plaintiff to define and hard for you to dispute.

Contractors, temps and platform workers

Driver verification selfies, delivery-app identity checks and staffing-agency onboarding scans reach Illinois residents through intermediaries. Statutory duties here attach to the entity in possession of the data rather than to the employer of record, so an arrangement that allocates employment status does not allocate this.

Remote proctoring and customer-facing verification

Exam proctoring, telehealth intake, age estimation and identity checks in onboarding flows all capture faces or voices from wherever the person happens to be. A consumer product with no Illinois presence at all serves Illinois residents constantly, and the geolocation data that proves it is usually in the product's own analytics.

Vendors who believe the customer owns the problem

A processor that receives templates from its customers is in possession of them, and the subsections governing disclosure and profit attach to possession. 'We only act on our customer's instructions' allocates risk between two companies; it does not answer a duty owed to the individual whose face was scanned.

The Defences That Do Less Than Expected

The choice-of-law clause in the employee agreement

A clause selecting another state's law is not a reliable exit. Courts weigh whether applying the chosen law would offend a fundamental public policy of the state with the greater interest, and a statute with a private right of action and liquidated damages is the archetype of such a policy. The clause is worth having for other reasons and worth nothing as a biometric defence.

'We turned it off in Illinois' without proving when

Geographic feature-gating is the right control and is frequently undermined by its own record-keeping. The question in litigation is not whether the gate exists today but on what date it was deployed, how location was determined, and what happened to templates collected before it. Keep the deployment date, the rule, and the deletion evidence together.

Location determined by employer-of-record address

Many gates key off a work-location field that means the office an employee is administratively attached to, not where they physically are. For remote staff those two values diverge by design, so a gate built on the administrative field passes testing and fails in production for exactly the population at issue.

The insurance position

Biometric and statutory-violation exclusions have become common in general liability and cyber policies, and recovery under a policy written before those exclusions is the kind of thing decided years later. An out-of-state company that assumed it was outside the statute has usually not asked its broker the question at all.

Other states are drafting in the same direction

Texas and Washington have biometric statutes enforced by their attorneys general, Colorado has added biometric consent duties for employers, and several 2026 state privacy acts treat biometric data as sensitive with its own consent rules. A control built solely as an Illinois carve-out will need rebuilding as a general rule within a couple of years.

Five Things to Put in Place

Find every capture point and ask where the person is

List the features that capture a face, a voice, a fingerprint or a body measurement, and for each one note how you would determine the subject's physical location at capture. Features where the honest answer is 'we cannot tell' are the ones to fix first.

Key location off the person, not off the org chart

Use the residence or work-location-of-record for remote staff, refreshed on change, and treat a relocation as a trigger that re-runs consent. For consumer flows, use the signals you already collect for tax or fraud purposes rather than adding new tracking to solve a compliance problem.

Make the compliant path the default everywhere

Notice of the fact and purpose, the retention schedule, and a written release before capture is a workable flow for every user in every state, and it removes the need for a gate to be correct. Most organisations that tried to run two paths ended up maintaining a gate they could not evidence.

Put the vendor question in the contract you are signing now

Ask whether the vendor gates by geography, what signal it uses, whether it retains templates after a gate is applied, and who bears the cost of a claim brought by an individual rather than by you. Indemnity language that only covers claims against the customer misses the shape of these cases.

Keep the dates

Deployment dates for gates, effective dates for consent text, relocation dates from HR, and deletion evidence with timestamps. Exposure in these claims is measured in periods, and a defendant who can define the period precisely is in a materially better position than one reconstructing it from memory.

Questions Multistate Employers Ask

We have no office in Illinois. Can BIPA still apply to us?

Yes, and the absence of an office is one of the weaker facts in the analysis. Illinois courts apply a presumption against extraterritorial reach, asking whether the circumstances relating to the claim occurred primarily and substantially within Illinois. The circumstances that carry weight are where the individual was physically located when the biometric identifier was captured, where they live and work, where the relationship with your organisation exists, and where the notice and written release ought to have been given. Your state of incorporation and the location of your servers are part of the picture but rarely the decisive part, because the conduct the statute regulates is the capture of a person's biometric identifier and that happens where the person is. A company with one remote Illinois employee using a face-verification tool every shift has a concentrated, repeated, well-documented set of Illinois-located events, which is the opposite of the incidental contact the presumption is designed to exclude.

Does a choice-of-law clause selecting our home state solve this?

Not reliably, and relying on it is a common and expensive mistake. Courts asked to enforce a contractual choice of law generally will not apply the chosen law where doing so would be contrary to a fundamental public policy of a state with a materially greater interest in the issue, and a statute that creates a private right of action with liquidated damages, fee-shifting and no requirement of separate injury is close to the paradigm of such a policy. There is also a scope problem that arises before the policy question: many of these claims are brought by people who are not parties to the contract containing the clause at all — job applicants, contractors, customers of your customer — so there is nothing to enforce against them. Keep the clause for the disputes it was written for, and build the biometric compliance path on the assumption it does no work here.

Our processing happens on servers outside Illinois. Does that help?

Much less than teams expect. The regulated events are collecting, capturing, obtaining, storing, disclosing and profiting from a biometric identifier, and the first cluster of those is located where the subject is standing. A template computed on a machine in another state from an image captured at an Illinois workstation is still a capture that occurred in Illinois, and the individual who was not given notice was not given it in Illinois. Server location can matter at the margins — it is one of the circumstances in the weighing, and it is more relevant to storage and disclosure questions than to collection — but as a primary defence it inverts the statute's focus. The corollary is also worth knowing: hosting in Illinois does not by itself pull a transaction between two out-of-state parties into the Act, so this is not a factor that cuts cleanly in either direction.

Can we simply disable biometric features for Illinois users?

Geographic gating is a legitimate and common control, and it fails in practice for three reasons worth designing around. The first is signal: many gates key off an administrative work location or a billing address, which for a remote workforce is systematically wrong for exactly the people the gate exists to protect. Use the residence or physical work location, refreshed when it changes. The second is history: a gate deployed today says nothing about templates collected before it, so the control has to be paired with deletion evidence and a record of the deployment date, because the litigated question is always about a past period. The third is drift: a gate is a special case, special cases are not exercised by normal testing, and a refactor or a new capture surface routes around it without anyone noticing. Where the compliant flow is workable for all users — notice, purpose, retention schedule, written release before capture — running one path is usually cheaper and far more defensible than proving a gate was correct on every day of a class period.

We are the software vendor, not the employer. Are we exposed?

Directly, on two independent tracks. On the substantive track, the duties attach to a private entity in possession of biometric identifiers rather than to whoever collected them, so a vendor holding templates on behalf of customers is subject to the retention and destruction schedule, the disclosure limits and the profit prohibition in its own right. On the jurisdictional track, a vendor that markets into Illinois, contracts with Illinois customers and knowingly processes Illinois residents' biometric data is defending a purposeful-availment argument on unhelpful facts, and the individuals bringing these claims are not bound by the forum or arbitration terms in your customer agreement. The practical consequences are that your compliance programme has to be yours rather than inherited — your own retention schedule, your own subprocessor position, your own record of what you hold for whom — and that customer-facing indemnities drafted only for claims brought against the customer will not respond to the claim shape that actually arrives.

The Headcount Query

Run one query against your HR system: employees and contractors whose home address is in Illinois. Run a second against your product analytics: sessions from Illinois that reached a capture surface.

Neither number needs to be large. The statute is enforced per person by people who do not have to show any injury beyond the violation itself, and both queries return a list with dates attached — which is the same list a plaintiff would build.

Your Company Is Not in Illinois. Your Employee Is.