Guides
Face Match App Illinois Law: The Biometric Question to Ask First
Face match app Illinois law hinges on whether the app scans face geometry. BIPA requires a written release before collection, not just a checkbox.
What to take away
- The first question is whether the app measures face geometry or only matches image files.
- BIPA treats a scan of face geometry as a biometric identifier, not just a stored photo.
- A face match app must get a separate written release before collecting that scan.
The biometric question to ask first
The Illinois Biometric Information Privacy Act, 740 ILCS 14/1 et seq., applies to private entities that collect or obtain a biometric identifier.
A face match app raises one threshold question: does the app collect a scan of face geometry, or only compare ordinary image files? A facial recognition system typically builds a face template from distances between landmarks. That template, not the selfie, is the biometric identifier BIPA regulates.
What BIPA written consent requires
BIPA Section 15(b) bars a private entity from collecting a biometric identifier without first giving a written disclosure. The disclosure must state the specific purpose and the length of term, and the entity must receive a written release executed by the subject. A checkbox next to terms of service does not satisfy that rule.
Section 15(a) requires a written retention schedule that is available to the public. The schedule sets destruction of the data when the initial purpose is satisfied, or within three years of the person's last interaction, whichever comes first.
A parallel question under Canadian federal law appears in Face Match App Privacy Law.
A checklist for Illinois face match apps
- Does the app collect a scan of face geometry, not just an image file?
- Does the written disclosure name the specific purpose?
- Does it state how long the biometric data will be stored?
- Does the user execute a separate written release?
- Is the release obtained before the first scan?
Example: an onboarding flow that fails BIPA
An Illinois resident downloads a face match app that shows a privacy policy with a single Accept button. The app extracts a face template and compares it to celebrity images. No separate written release names the scan, its purpose, or its retention period. FTC guidance on data security sets a federal baseline, but it does not replace BIPA's consent rules.
The FTC's 2023 order against Rite Aid required the company to delete collected images and facial recognition models and banned its use of the technology for five years.
Enforcement: the consequence of getting it wrong
BIPA includes a private right of action, statutory damages, injunctive relief, and attorney fees. A face match app that skips the written release faces court orders and money judgments in Illinois.
Statutory damages are $1,000 for each negligent violation and $5,000 for each intentional or reckless violation.
Two more checks before you rely on a match
The app result does not transfer any right of publicity or create a binding promise from the performer. A face template is sensitive because it can be linked to other databases.
The written consent issue affects how the app handles your face. A written release for one purpose does not cover another.
If the app later sells face geometry scans to an advertiser, that new purpose needs its own disclosure and release, and Illinois law treats each collection or disclosure as a separate event. Ask the app operator to show the written release before you rely on its output.
The app may have scraped photos or collected face geometry without the releases BIPA requires.
