The BIPA Ruling Every HR Leader Rolling Out a Biometric Time Clock Needs to Read Correctly

The BIPA Ruling Every HR Leader Rolling Out a Biometric Time Clock Needs to Read Correctly

If you searched for anything about the Seventh Circuit's April 2026 BIPA ruling and landed on a law firm's client alert, you probably came away with one takeaway: damages are capped now. Per-scan liability is dead. The "$5,000 per fingerprint punch" math that turned a single distribution center into a billion-dollar exposure is gone.

All of that is true. None of it means what most HR and payroll leaders who aren't currently being sued will assume it means.

Every piece of coverage on Clay v. Union Pacific Railroad Co. — and there's a lot of it — is written for general counsel managing active litigation. That's the right audience for a ruling about damages calculation. But if your actual question is "we're about to roll out biometric time clocks at our Illinois distribution centers, does this change anything for us," the litigation-defense framing answers a question you're not asking and skips the one you are.

What the Court Actually Decided

Illinois's Biometric Information Privacy Act has required written consent, a public retention and destruction policy, and specific notice before collecting a fingerprint, hand geometry, or face scan since 2008. In 2023, the Illinois Supreme Court's Cothron v. White Castle decision held that a violation accrues every time a company scans biometric data without proper consent — not once per employee, but once per punch. For an hourly employee clocking in and out daily for years, that math produced the kind of numbers that make headlines: White Castle faced a theoretical exposure north of $17 billion before settling. 

You might also like to read: Who's Liable When an AI Safety Platform Misclassifies an OSHA-Recordable Injury?

In August 2024, the Illinois legislature amended the statute (SB 2979) to cap recovery at one violation per person per collection method, regardless of how many times the scan happened. What the amendment didn't say was whether that cap applied to lawsuits already filed before it took effect — leaving companies facing pre-2024 claims in limbo for nearly two years while district courts split on the answer.

On April 1, 2026, the Seventh Circuit resolved that split in Clay, holding that the amendment is a remedial change to how damages are calculated, not a substantive change to what conduct is unlawful — and remedial changes apply retroactively under Illinois law. The court's reasoning turned on a specific distinction: the legislature amended BIPA's damages provision (Section 20), not its liability provision (Section 15), which defines what counts as a violation in the first place. Practically, that means every pending case, no matter when it was filed, now gets recalculated on a per-person basis instead of a per-scan basis.

The Part That Doesn't Change — and Why It's the Part That Matters to You

Section 15 is untouched. Every requirement that determines whether your company is violating BIPA in the first place — written consent before the first scan, a publicly available retention and destruction schedule, a stated purpose for collection, a prohibition on selling or profiting from the data — is exactly as strict on April 2, 2026 as it was on March 31. The Seventh Circuit didn't say collecting fingerprints without consent is fine now. It said that if you did it wrong, the bill for having done it wrong just got a lot more predictable and a lot smaller.

That distinction matters enormously depending on where your company sits. If you're already a defendant in a BIPA suit, the ruling is unambiguously good news — your damages exposure just became finite instead of open-ended, and settlement conversations that were stalled on nine-figure demands can now proceed on realistic numbers. Every law firm alert on this ruling is written for exactly that audience, and for that audience, the advice is sound.

You might also like to read: How Healthcare IT Teams Are Accelerating Internal App Development Without Violating HIPAA

If you haven't been sued yet and you're evaluating, piloting, or expanding biometric time clocks, the ruling changes almost nothing about your compliance obligations and arguably raises the stakes on getting rollout right the first time. Here's the mechanism: a lower, more predictable per-person damages figure makes plaintiffs' firms more willing to bring claims on behalf of an entire facility's workforce at once, rather than betting on a handful of named plaintiffs in a slower-moving class action strategy built around uncapped exposure. A capped, certain number per employee, multiplied across a thousand-person distribution center that never obtained proper written consent, is still a very large number — and it's now a number a plaintiff's firm can model with confidence before filing, which tends to accelerate filings rather than slow them.

What a Pre-Rollout Compliance Sequence Actually Looks Like Now

None of the legal commentary on Clay is wrong to focus on litigation strategy for pending cases. But if you're the HR or payroll leader deciding whether to move forward with biometric clocks this quarter, the operative question was never "how much would we owe per scan" — it was always "did we get consent right before the first scan happened." That sequence hasn't moved:

Written, informed consent has to be collected before any biometric identifier is captured — not folded into an onboarding packet an employee signs without reading, but a standalone disclosure that names the specific identifier being collected (fingerprint, hand geometry, or facial geometry), states the purpose (time and attendance), and is signed before enrollment. A publicly available retention and destruction policy has to exist and actually be public — posted somewhere employees can find it, not sitting in an HR drive — stating how long the data is kept and how it's destroyed when the purpose for collecting it ends, which for most employers means at termination or within a fixed window afterward. Employers using a third-party vendor (which is nearly everyone) remain on the hook for that vendor's handling of the data; the statute doesn't recognize outsourcing biometric collection as outsourcing the compliance obligation, so the vendor contract needs to address sub-processors, breach notification, and destruction on the same terms you're promising employees. And employees who object on religious or disability grounds need a genuine non-biometric alternative — a PIN or badge fallback — because a system that functionally requires biometric enrollment with no accommodation path invites a second claim under Title VII or the ADA layered on top of a BIPA claim.

None of this is new because of the Seventh Circuit's ruling. It's the same sequence that was correct before Clay was decided. What the ruling actually changes is the incentive structure on the plaintiff's side — and that's worth knowing before you assume a damages cap is the same thing as reduced urgency.

You might also like to read: Why Your AI Coding Tools Are Creating a Compliance Blind Spot — And How to Close It Before Your Next Audit

The One Real Update Worth Acting On

If your company already has biometric time clocks deployed in Illinois, this is a reasonable moment to run an actual audit rather than assume existing paperwork is fine: confirm every current employee using the system has a signed consent form on file (not just new hires since your last policy update), confirm the retention and destruction policy is dated recently enough to reflect current practice, and confirm your time clock vendor's contract terms match what your public policy promises employees. That audit was worth doing before April 2026. It's worth doing now specifically because a more litigable damages number, sitting behind a workforce that's never been properly consented, is exactly the fact pattern the next wave of BIPA claims is likely to target.

Comments

Post a Comment

Popular Posts

How Healthcare IT Teams Are Accelerating Internal App Development Without Violating HIPAA

Image
Healthcare IT leaders are caught between two pressures that don't naturally resolve. On one side: clinical operations, administrative departments, and business units that need internal tools faster than the traditional development cycle can deliver. Scheduling applications, patient communication workflows, compliance reporting dashboards, care coordination tools — the demand for internal software in healthcare organizations has never been higher, and the clinical and operational teams requesting it don't have much patience for long development timelines. On the other side: HIPAA. Specifically, the parts of HIPAA that apply to any software development process that touches protected health information — and in a healthcare organization, most internal apps eventually do. Those two pressures don't have to be in direct conflict. But they are in direct conflict at a lot of healthcare organizations right now, because the tools available to development teams have outpaced the...
Read more

Why Your AI Coding Tools Are Creating a Compliance Blind Spot — And How to Close It Before Your Next Audit

Image
Your developers are moving faster than ever. AI coding assistants are everywhere now — writing boilerplate, suggesting completions, generating entire modules from a comment. Productivity is up. Backlogs are shrinking. Your team is shipping internal apps and automations at a pace that would have been impossible two years ago. And none of it shows up cleanly in your compliance documentation. That gap — between what your AI tools are producing and what your auditors will expect to trace, verify, and approve — is the compliance blind spot that most enterprise IT leaders don't see until they're sitting across from an auditor who's asking questions nobody prepared for. This isn't a hypothetical. It's happening right now in healthcare organizations, financial services firms, manufacturers, and logistics companies across North America. Teams that adopted AI coding tools for the productivity gains are discovering, sometimes at the worst possible moment, that they don't...
Read more

Is Cursor AI Safe for HIPAA-Compliant Healthcare App Development?

Image
If you've landed on this article, there's a good chance someone on your team is already using Cursor — or has asked whether they can. It's a fair question, and it deserves a direct answer rather than the usual hedged non-answer that most compliance content provides. Here it is: Cursor, in its standard configuration, is not designed for HIPAA-compliant software development. That doesn't mean your team can't use AI coding tools in a healthcare environment. It means that Cursor specifically, as a general-purpose AI development tool, introduces compliance considerations that need to be worked through before it touches systems handling protected health information. This article goes through exactly what those considerations are — what Cursor does with your code, where HIPAA creates friction, and what a compliant path to AI-assisted development in healthcare actually looks like. What Cursor Actually Does With Your Code Understanding the compliance question starts ...
Read more

Who's Liable When an AI Safety Platform Misclassifies an OSHA-Recordable Injury?

Image
Every EHS software vendor on the market is now selling the same feature: AI that reads an incident narrative and tells you whether it's OSHA-recordable. Recordable versus first aid. DART versus non-DART. Days away, restricted, or transfer. The pitch is consistent across the category — faster classification, fewer inconsistent logs, less time spent arguing about 29 CFR 1904.7 in a conference room. What none of these vendors advertise is what happens when the model gets it wrong. And it will get it wrong. Not often, and not dramatically — but recordability determinations sit on judgment calls that even experienced safety managers disagree on: whether a restriction counted as "restricted duty," whether first aid crossed into medical treatment, whether a case is work-related at all under the geographic-presence and causation tests in 1904.5. An AI model trained to pattern-match incident narratives against those tests will occasionally land on the wrong side of a genuinely clo...
Read more

How to Add Employee Wellness Check-Ins to Your Time Clock (Without Adding More Work for HR)

Image
Most HR leaders track two things obsessively: attendance and turnover. What almost nobody tracks is the gap between them, the early warning signs that show up weeks before a good employee quietly checks out, calls in sick more often, or puts in their notice. By the time exit interviews happen, the useful data is gone. There is a touchpoint that already exists in every frontline workplace and gets used by every employee, every single day, often twice: the time clock. Clock-in and clock-out are the only moments HR can guarantee contact with deskless, hourly, and shift-based staff who rarely open a company email or log into an HR portal. And right now, that moment is wasted on nothing more than a timestamp. This article looks at how to turn that daily punch into a two-second wellness check-in, why it works better than surveys or EAP enrollment emails, what questions actually generate useful data without feeling invasive, and how to set it up without creating a new project for an already-s...
Read more

What Payroll Decision-Makers Must Know Before Configuring Payroll for Tipped Hourly Employees

Image
If you have recently inherited a multi-state payroll setup, you already know the feeling. You open the inbox and there is a stack of state tax notices going back months. Some accounts are locked. Some are in states you did not know the company had employees. A few are probably past due. And somewhere under all of it is a login spreadsheet with three different owners' email addresses and passwords that no longer work. This is not a small-company problem or a Controller-competence problem. It is a structural problem with how payroll compliance works in the United States — and it gets worse, not better, the more states you operate in. This article is for payroll decision-makers at service companies managing 20 or more active states, specifically the ones trying to build a process that actually holds up when people leave. Why Multi-State Payroll Tax Management Gets Out of Control State payroll tax compliance is not complicated in any individual state. It is complicated because you have...
Read more

The HR-Built AI Agent Compliance Gap: What Happens When Your Own No-Code Tool Makes an Employment Decision

Image
Every piece of "shadow AI" content written in the last two years follows the same template: an employee pastes confidential data into ChatGPT, IT has no idea it happened, a security incident follows. That's a real risk, and it's been covered from every angle by every security vendor with a blog. It's also not the risk that should worry an HR leader most right now. The more consequential blind spot is the AI agent HR itself builds — using a no-code platform like Copilot Studio, Glide, monday.com's AI agent builder, or a Zapier AI Action — to automate something genuinely useful: triaging PTO requests, flagging attendance patterns for a manager's review, drafting a first pass at a performance improvement plan, routing accommodation requests to the right specialist. None of this looks like "AI in hiring." It looks like workflow automation, built by the same person who used to build the spreadsheet macro that did the same job less elegantly. That...
Read more

The Best Facility Management Software for Small Businesses: A Practical Review

Facility management software promises a lot to small businesses — organized maintenance, tracked assets, fewer surprises — and most of it is genuinely useful. The catch is that the category was built for enterprises with dedicated facilities teams, and much of what is marketed to small operations is either overbuilt, overpriced, or both. This review cuts through it: what small businesses actually need, what to skip, and how to choose. What a Small Business Actually Needs Strip the category down and four capabilities carry almost all the value for a small operation. A maintenance request and work-order system so problems get logged, assigned, and closed instead of forgotten. A preventive maintenance scheduler that turns "we should service that quarterly" into automatic reminders. An asset and equipment register recording what you own, where it is, and its service history. And vendor and cost tracking so you know what maintenance actually costs and who to call. If a tool ...
Read more

Time Clock Integration With HR Software: How to Eliminate Errors, Speed Payroll, and Improve Compliance

The gap between where employees punch and where they get paid is one of the most expensive seams in any organization that runs on hourly labor. When the time clock and the HR or payroll system are not connected, that gap gets bridged by human hands — exporting files, re-keying totals, reconciling discrepancies — and every one of those hands is a place where money and compliance leak. Integrating the two closes the seam. Here is what that actually delivers and how to do it well. The Cost of the Disconnected Clock Unintegrated time capture fails in predictable ways. Hours are transcribed with typos. Exports run on a schedule that is stale by the time payroll processes. Corrections made in one system never reach the other. Managers approve totals they cannot fully see. Each error is small; in aggregate they produce over- and under-payments, a payroll close measured in days, and — most dangerously — a records trail that cannot survive a wage-and-hour audit. The disconnected clock is not ...
Read more