Illinois requires consent to collect biometrics
On 3 October 2008 Illinois's Biometric Information Privacy Act (BIPA) took effect: a private company may collect a face scan, fingerprint or voiceprint only after written notice of the purpose and term and a written release from the person, and each violation gives the person a right to sue - 1,000 dollars if negligent, 5,000 if intentional.
Why it matters
The act gave individuals their own action against collection of their faces without consent, with no regulator in between. That is why, fourteen years later, a face database scraped from the web was restricted by an Illinois court on a suit by civil society groups rather than by an agency.
Under section 10 a biometric identifier is a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry; photographs are excluded. Section 15: a public written policy on retention and destruction within 3 years of the last interaction; before collection, written notice that data are collected, written notice of the purpose and term, and a written release, all three together; selling or otherwise profiting from biometrics is forbidden. Section 20: per violation, 1,000 dollars or actual damages if greater when negligent, 5,000 when intentional or reckless, plus attorneys' fees. The act covers only private persons and companies: state and local government bodies are not private entities. The record claims no sum from later settlements: none is in the sources read. The General Assembly's site answered neither the shell nor the browser; the text and bill status were read in archived copies of that site.