AI Regulation · Illinois
Biometric Information Privacy Act (BIPA)
SB 2400 - enacted in Illinois.
- Enacted
- Status
- 2008
- Enacted
- 6
- States with ai regulation laws
- 62/100
- Illinois strictness
The bottom line
Biometric Information Privacy Act (BIPA) is an enacted law in Illinois, part of a still-emerging ai regulation landscape.
- Enacted
- effective 2008-10-03
- 6
- states have ai regulation laws
- 10/10
- ai regulation laws enacted nationally
- 62/100
- Illinois strictness score
Data compiled 2026-03-18 from the official Illinois legislative record linked below; laws can be amended or repealed after this date.
Regulatory Snapshot: Biometric Information Privacy Act (BIPA)
Biometric Information Privacy Act (BIPA) (SB 2400) is an enacted law in Illinois under the AI Regulation category. It was enacted on 2008-10-03 and becomes effective on 2008-10-03. Illinois currently reports 9 tracked regulations with 8 already in force, giving the state a regulatory strictness score of 62/100 relative to the national baseline. PlainRegWatch compiled this entry's data on 2026-03-18; consult the linked official source for the current, authoritative text.
Nationally, 10 ai regulation statutes have been enacted and 0 additional bills remain pending - 6 distinct jurisdictions have codified rules in this area so far. That places Illinois within a still-emerging ai regulation landscape where compliance programs typically hinge on definitions in SB 2400 itself.
Applicability under Biometric Information Privacy Act (BIPA): Any private entity collecting biometric identifiers in IL. Penalty exposure is documented as: $1,000/negligent, $5,000/willful. Private action + attorney fees. Settlements: $650M Facebook, $228M TikTok. Notable exemptions: Government agencies, GLBA, HIPAA entities..
Summary
Pioneering biometric privacy with private right of action. Major AI litigation driver.
Key Requirements
Written consent for biometric collection. Retention/destruction policy. No profit from biometric data. Private action.
Penalties
$1,000/negligent, $5,000/willful. Private action + attorney fees. Settlements: $650M Facebook, $228M TikTok.
Applicability
Any private entity collecting biometric identifiers in IL.
Exemptions
Government agencies, GLBA, HIPAA entities.
Official Source
https://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=3004How Illinois compares on ai regulation
6 states regulate ai regulation - Illinois ranks #4 by overall regulatory strictness. Bar = state strictness score (0–100).
| # | State | Strictness |
|---|---|---|
| 1 | California | 100 |
| 2 | Colorado | 76 |
| 3 | Texas | 69 |
| 4 | Illinois (this state) | 62 |
| 5 | New York | 62 |
| 6 | Utah | 55 |
Frequently Asked Questions
Which states have ai regulation regulations?
As of the last verification, 6 states have enacted ai regulation regulations, with 0 additional bills pending across other states. Illinois is among the states that has enacted such legislation. Browse all ai regulation regulations at plainregwatch.com for the complete state-by-state comparison.
When was Biometric Information Privacy Act (BIPA) enacted?
Biometric Information Privacy Act (BIPA) was enacted on 2008-10-03 and became effective on 2008-10-03. It was introduced as SB 2400.
What are the penalties for violating Biometric Information Privacy Act (BIPA)?
$1,000/negligent, $5,000/willful. Private action + attorney fees. Settlements: $650M Facebook, $228M TikTok. Note that enforcement mechanisms and penalty structures may vary. Consult the official statute and qualified legal counsel for specific compliance requirements.
Does Biometric Information Privacy Act (BIPA) apply to small businesses?
Any private entity collecting biometric identifiers in IL. Many state regulations include thresholds or exemptions for smaller organizations. Review the full applicability criteria and consult legal counsel to determine your obligations.
How does Illinois compare to other states on ai regulation?
Illinois has a regulatory strictness score of 62/100, based on 8 enacted regulations out of 9 tracked. Nationally, 6 states have enacted ai regulation laws. Visit our state comparison page for a full ranking.
Where can I read the full text of Biometric Information Privacy Act (BIPA)?
The official text of Biometric Information Privacy Act (BIPA) (SB 2400) is available from the Illinois legislature. PlainRegWatch links to the official source for every tracked regulation. We recommend reviewing the full statute alongside qualified legal counsel for compliance planning.
Regulation Guides
Plain-language guides to help you understand the broader regulatory landscape.
Explore Regulations
Disclaimer: This summary is provided for informational purposes only and does not constitute legal advice. Regulation details may have changed since this data was compiled (2026-03-18). Always consult official sources and qualified legal counsel for compliance guidance.
More Illinois Regulations
The bottom line
This law is already in force - here's what matters for ai regulation compliance.
- Biometric Information Privacy Act (BIPA) is enacted in Illinois, effective 2008-10-03. Official source
- 6 states now regulate ai regulation; Illinois ranks #4 by strictness - compare requirements before you operate across state lines. Compare states
- See every regulation Illinois tracks across all five policy areas. Illinois profile
Summaries are general information, not legal advice; always confirm against the official statute and qualified counsel.
Read our methodology - how this data is sourced, computed, and verified.
Related
Verify with the official Illinois source →
Every figure on PlainRegWatch is rendered directly from state source data, no number is typed in by an editor. This page draws directly on federal and state source data, no figure is typed in by an editor. See our editorial standards & corrections policy, the methodology behind these numbers, or report a data error.