Does an electronic checkbox satisfy BIPA's written release requirement?

A checkbox can be part of a valid release, and on its own it usually is not one. The statute asks for three things to happen before collection: the subject is informed in writing that a biometric identifier is being collected or stored, informed in writing of the specific purpose and the length of term for which it will be collected, stored and used, and executes a written release. Electronic execution is not the weak point — Illinois recognises electronic signatures, and a well-built flow produces a better record than paper. The weak point is content and sequence. Most checkbox flows attest to a privacy policy rather than disclosing a purpose and a term, and many of them appear after the camera has already captured a template.

Can we bundle biometric consent into the employee handbook acknowledgement?

It is the most common design and the weakest one. A handbook acknowledgement usually says the employee has received and will comply with a set of policies — which is an acknowledgement of receipt, not a release of a claim, and the statute uses the word release deliberately. Bundling also destroys the evidentiary value of the record: when a single signature covers forty policies, nothing in the artefact shows the person was informed of the biometric purpose and term specifically. Stand the biometric release alone, make it a distinct document with its own signature, and keep it separate in the file. The cost of doing so is a few minutes per hire, which compares favourably with the per-violation exposure.

We already collect fingerprints from existing staff. Can we paper it now?

You should obtain a release going forward, but understand what it does and does not do. The obligation runs before collection, so a release signed today does not retroactively authorise collections that already occurred, and Illinois law treats prospective releases of unknown future claims and retrospective releases of accrued ones very differently. Papering the program is still worth doing: it stops the exposure accruing forward, it demonstrates a good-faith remediation, and the 2024 amendment limiting recovery to a single accrual per person per method makes the difference between a program fixed early and one fixed late very large in aggregate. Get counsel involved before you send anything that asks employees to release existing claims, because a document that reads as a settlement has its own requirements.

What has to be in the purpose and term disclosure?

Enough specificity that a reader could tell whether a later use was covered. A purpose stated as business purposes or security is not a purpose; timekeeping authentication at company facilities is. A term stated as as long as necessary is not a term; the statute pairs the disclosure with a destruction obligation at the earlier of the purpose being satisfied or three years after the last interaction, so the natural drafting is to state the retention rule and the trigger for destruction. Where a vendor holds the template, say so and name the category of recipient. The test to apply in drafting is simple: read the disclosure, then read your actual data flow diagram, and mark every arrow the disclosure does not describe.

Does the vendor need consent too, or only the employer?

Section 15(b) is written in terms of a private entity collecting, capturing or otherwise obtaining a biometric identifier, and a vendor whose software captures the scan is doing that even though the employer arranged the relationship. Courts have allowed claims to proceed against vendors on that basis, which is why vendor contracts in this space now routinely allocate the consent obligation to the customer and carry indemnity in the other direction. From the deploying business's side, two practical asks: require the vendor to confirm in writing that it does not collect or store templates outside the contracted purpose, and get its retention and destruction schedule in the contract rather than in a datasheet. From the vendor's side, an allocation clause is not a defence to a statutory duty — it is a route to recovery after one is enforced.

What record should we be able to produce for a given employee?

The exact text of the disclosure that person saw, the version identifier of that text, the timestamp of execution, the authentication method that ties the signature to the individual, and evidence that the release preceded the first collection event. That last item is the one most programs cannot produce, because the consent record and the biometric event log live in different systems and nobody ever joined them. Run the join once as an audit: for every person with a stored template, is there a release with an earlier timestamp? The rows that come back empty are your actual exposure, and they are usually concentrated in a predictable place — a location that went live before the policy, a temp cohort onboarded by an agency, or a device rolled out during an acquisition.

BIPA Section 15(b) Written Release 2026: Does a Checkbox Count?

Written Is Not the Hard Word. Release Is.

Compliance teams spend their energy on the wrong word. Whether an electronic record counts as written is a settled and unremarkable question — Illinois gives legal effect to electronic signatures, and a properly instrumented digital flow produces a stronger evidentiary record than a filing cabinet of paper forms ever did. Timestamped, version pinned, tied to an authenticated identity: that is a better artefact than a photocopy.

The word that does the work is release. An acknowledgement that you have read a policy is a different legal instrument from a release, and the statute pairs the release with a specific antecedent disclosure of purpose and term. A flow that presents a privacy policy link and a box reading "I agree to the terms" has produced an agreement to terms. Whether it has produced an informed, purpose-specific release is the question a claim will be about.

The Six Failure Modes

Sequence. The camera or scanner enrols first and the consent screen appears at the end of onboarding — so the collection preceded the release.
Bundling. One signature covers the handbook, the arbitration agreement and the biometric policy, leaving nothing that shows purpose-specific notice.
Generic purpose. "Security and business operations" tells a reader nothing about which uses are authorised and which are not.
Missing term. The retention rule sits in an internal policy nobody disclosed, so the term element is simply absent.
Pre-ticked or unavoidable. A box that is checked by default, or a flow with no path to decline, undermines the voluntariness a release depends on.
No version pinning. The policy text changed three times and the system stores a pointer to the current version, so nobody can reconstruct what any individual actually saw.

The last one is quietly the most damaging, because it is invisible until you need the record. Storing consent as a boolean and a date, with the disclosure text resolved at read time from whatever is live today, means every historical consent in the system displays the current language. Store the text, or at minimum an immutable version identifier with an archive of every version.

Where AI Deployments Create New 15(b) Surface

The classic Illinois fact pattern is a fingerprint time clock. The 2026 fact patterns are different in a way that matters for consent design: the collection is often incidental to a feature nobody framed as biometric. A meeting tool that builds voice profiles to attribute speakers. A support platform that adds voice authentication. A workplace safety model that derives gait or posture signatures from existing camera feeds. A verification vendor that performs a face match during onboarding.

In each case the product decision was made on a functional basis and the consent flow, if there is one, was inherited from the surrounding product. That is why the audit that matters is not a review of your biometric consent form — it is an inventory of every feature that derives an identifier from a body, which will be longer than the list your privacy notice currently describes.

What a Defensible Release Looks Like

A standalone document or screen, not a clause inside a longer agreement.
Names the identifier collected in plain terms — a fingerprint scan, a facial geometry template, a voiceprint.
States the specific purpose in operational language a reader could check a later use against.
States the term and the destruction trigger, consistent with your published retention schedule.
Names the vendor or category of recipient that will hold or process the template.
Uses language of release and authorisation, not of receipt or acknowledgement.
Provides a genuine decline path with a stated alternative, such as a badge or PIN.
Captures identity, timestamp and the exact version of the text presented.

The decline path is the item most often cut for operational reasons and the one that costs least to build. An alternative authentication method for the small number of people who ask for one is an ordinary product requirement. Its absence converts every consent in the system into one obtained under a condition of employment, which is a worse position to argue from than the handful of PIN users would ever have cost.

Questions From Illinois Deployments

Our workforce is unionised. Does the collective bargaining agreement handle consent?

It may route the dispute rather than resolve the obligation. Where a biometric timekeeping program falls within the scope of a collective bargaining agreement, federal labour law preemption has been applied to send the claim to the grievance machinery instead of to court, and that is a meaningful procedural difference. It is not a substantive exemption, it turns on the specific agreement and the specific bargaining unit, and it does nothing for non-union staff, contractors, temps or applicants at the same site. Build the release program anyway and treat the preemption argument as a defence you might have rather than a reason not to comply — it is significantly cheaper to obtain releases than to litigate about which forum decides whether you needed them.

Does BIPA reach photographs and video we already have?

The statute excludes photographs and writing samples from the definition of a biometric identifier, and that exclusion is doing less work than defendants often hope. The argument that succeeds for plaintiffs is that the identifier at issue is not the photograph but the scan of face geometry derived from it. So the compliance question is not whether you hold images — nearly every business does — but whether any system in your stack converts them into a template used to identify a person. A security camera recording is one thing. The same recording processed by an analytics module that clusters and recognises individuals is another, and that module is frequently a checkbox in a vendor console that someone enabled without a review.

How does the 2024 single-accrual amendment change the urgency here?

It reduces the multiplier, not the obligation. Before the amendment, a scan-per-shift theory meant a single employee over a few years could support an extraordinary number of claimed violations, and that arithmetic is what made the statute existential for some defendants. Recovery is now limited to a single accrual per person per method, which brings exposure back into a range that can be reasoned about. But the per-person figures remain substantial, the statute still carries a private right of action with fee shifting, and class sizes at a mid-sized employer are in the hundreds. Read the amendment as making remediation economically sensible rather than as making non-compliance affordable.

Our vendor's SDK handles the consent screen. Are we covered?

You are covered for the screen and not for the content, and the content is what fails. Vendor-supplied consent UI is written to be deployable across every customer, so it describes the vendor's product in general terms rather than your specific purpose, your term, or your retention rule — precisely the elements the statute requires be specific. Take the vendor's flow as a rendering engine and supply your own text into it. Where the SDK does not permit that, the honest finding is that the product cannot be deployed compliantly in Illinois without a wrapper, and that is worth knowing before rollout rather than during discovery.

What is the single highest-value thing to do this quarter?

Run the join. Take the set of individuals with a stored template or an enrolment record, take the set of executed biometric releases, match them on person, and compare timestamps. The output is a list of names in three buckets: release before collection, release after collection, and no release at all. That list is more useful than any policy review because it is specific, it is countable, it tells you where the gaps cluster, and it converts an abstract compliance worry into a remediation project with a finish line. Most organisations have never produced it, which is why most organisations describe their exposure in adjectives.

Read Your Own Consent Screen Back

Open the flow a new hire sees. Find the sentence that names the purpose, and the sentence that names the term. If you cannot point at both in under thirty seconds, neither can the person signing it, and that is the whole argument.

Fix the text first, the sequencing second, and the historical reconciliation third — because the first two stop the exposure growing while the third measures it.