Does BIPA apply to AI security cameras even if footage is never reviewed by a person?

Yes. BIPA regulates the collection of a biometric identifier, and Illinois courts have held that the scan itself — the moment an AI system algorithmically maps facial geometry to generate a template — is what triggers the statute, not whether a human later reviews the footage or whether the derived data is stored long-term. A fully automated system that scans faces in real time to compare against a watchlist collects biometric identifiers the instant the scan occurs.

Do we need consent from every person captured by an AI security camera?

BIPA requires written notice and consent before collecting biometric identifiers from any Illinois resident, which is workable for employees but nearly impossible to obtain from every customer, visitor, or passerby captured by a security camera. This is precisely why AI-driven facial recognition or face-matching security systems carry outsized BIPA risk compared to traditional passive-recording cameras — traditional cameras record images but don't algorithmically generate biometric identifiers from them.

Is there a difference between recording video and running AI facial analytics on it?

Under BIPA, yes, and it's the central distinction driving current litigation. Simply recording video, even of faces, generally does not by itself create a biometric identifier under BIPA. Running AI analytics that measure facial geometry to identify or re-identify a specific person — for a watchlist match, repeat-visitor tracking, or demographic analysis tied to an individual — creates a scan-derived biometric identifier that BIPA regulates, regardless of whether the underlying video is retained.

BIPA and AI Security Camera Analytics 2026: Facial Recognition Liability

The Scan Is the Violation, Not the Storage

Retailers and property managers adopting AI-powered video analytics for loss prevention often reason that because footage is auto-deleted after 30 days, or because no employee reviews it unless an incident occurs, they haven't really "collected" biometric data in a way that matters. BIPA doesn't work that way. The statute regulates the collection of a biometric identifier — and Illinois courts have consistently held that the algorithmic scan itself, the moment facial geometry is measured and converted into a comparable template, is the act of collection.

This means an AI security system that scans every face entering a store to check against a shoplifter watchlist, or that generates a facial signature to recognize repeat visitors, is collecting biometric identifiers continuously — for every person who walks past the camera, whether or not they match anything, and whether or not the resulting data is stored for more than a few seconds.

Passive Recording vs. AI Facial Analytics

The critical line under BIPA is between recording and analyzing:

Generally Outside BIPA: Passive Video Recording

Standard CCTV that records video of faces but performs no algorithmic identification, geometry measurement, or matching does not typically create a BIPA-regulated biometric identifier. The video contains images of faces, but nothing has scanned or measured them.

Inside BIPA: Watchlist and Face-Match Systems

AI systems that compare live camera feeds against a database of known individuals (banned customers, prior shoplifters, employees) to generate a match alert are performing a biometric scan on every face processed — including the overwhelming majority who never match anything.

Inside BIPA: Repeat-Visitor and Demographic Analytics

Systems that generate a unique facial signature to recognize the same person across multiple visits — for marketing attribution, dwell-time analysis, or de-duplicating foot traffic counts — create a biometric identifier for re-identification purposes, which is squarely what BIPA was written to regulate.

Who's Exposed: Retailers, Property Managers, and Their AI Vendors

Liability doesn't stop at the company operating the camera. BIPA plaintiffs' counsel have named both the deploying business and the AI analytics vendor as defendants, arguing each independently "collected" biometric data — the retailer by running the camera, and the vendor by processing the feed through its facial recognition model. Key exposure points:

Retail loss-prevention platforms using facial recognition to flag known shoplifters at store entrances
Apartment and office buildings using AI facial access control or visitor-recognition systems in common areas
Shopping malls and stadiums using AI camera analytics for banned-patron enforcement
Any AI camera vendor whose contract doesn't clearly assign BIPA notice-and-consent responsibility to one party
Systems where the AI model runs in the cloud, meaning biometric data crosses to a third-party processor

Compliance Checklist for AI Security Camera Deployments (2026)

Before Deployment

☐Confirm with your vendor whether the system performs facial geometry scanning or matching, not just recording
☐Post clear, conspicuous BIPA notice signage at all entrances where AI facial analytics operate
☐Build a written biometric data retention and destruction schedule — required under BIPA regardless of business purpose
☐Assign contractual BIPA responsibility (notice, consent, destruction) explicitly between you and your AI camera vendor

For Employee-Facing Systems

☐Obtain written, signed BIPA consent before enrolling any employee in facial recognition access control
☐Provide the mandatory written policy on biometric collection, storage, and destruction to employees before enrollment
☐Never rely on browsewrap or implied consent — BIPA requires affirmative written consent
☐Audit whether your AI camera vendor stores biometric templates outside Illinois — cross-border storage doesn't reduce BIPA exposure

Frequently Asked Questions

We only use AI cameras for general customers, not employees — does BIPA still apply?

Yes. BIPA protects any Illinois resident whose biometric identifiers are collected, not just employees. Customers, visitors, and even passersby captured by a facial-scanning security camera are covered. The practical difficulty is that written consent — required by the statute — is nearly impossible to obtain from every member of the public who walks past a storefront camera, which is why many retailers are moving away from face-matching analytics entirely in Illinois locations.

Can we anonymize or immediately discard the facial template to avoid liability?

Discarding the data quickly reduces some risk categories (breach exposure, retention violations) but does not eliminate liability for the collection itself. If a scan generated a biometric identifier without the required prior written notice and consent, the collection violation has already occurred regardless of how quickly the data was deleted afterward.

Does it matter that our AI vendor is based outside Illinois?

No. BIPA applies based on where the person whose biometric data is collected resides or where the collection occurs, not where the vendor or camera manufacturer is headquartered. A cloud-based AI facial recognition vendor processing video from an Illinois retail location is subject to BIPA for that processing regardless of the vendor's location.

Recording Is Safe. Analyzing Faces Is Not.

The line that matters under BIPA isn't how long you keep the footage — it's whether your AI system algorithmically measures faces. Watchlist matching and repeat-visitor tracking both cross that line on every scan, for every person, match or not.

Priority actions: confirm exactly what your camera vendor's AI does under the hood, post BIPA notice, and get consent workflows in place before expanding any facial-analytics deployment in Illinois.