BIPA workplace facial recognition apps: vendor terms and audit file

What to take away

The duty under 740 ILCS 14/1 et seq. sits with the entity that collects the face. Hiring a vendor to run the app moves the work, not the duty.
Vendor contracts should carry matching deletion, no-sale, disclosure limits, security, breach notice and audit terms for each duty in §15(a)-(e).
Consent belongs in the app flow itself, and the notice version, timestamp, device and exact text are the evidence.
Deletion logs are reviewed quarterly, and features that trigger collection are reviewed annually.
Statutory damages are $1,000 for a negligent violation and $5,000 for an intentional or reckless one, so the file has to be ready before the first scan.

Why the vendor does not carry the duty

The employer that collects a worker's face owes the notice, the release and the retention schedule, whoever runs the servers. Outsourcing storage does not transfer those obligations, though it can create indemnity claims between the parties. The contract allocates the cost of a failure, not the duty itself.

The Illinois Biometric Information Privacy Act, passed in 2008, regulates private entities that collect, store or use biometric identifiers. That covers private employers, staffing agencies, app vendors and any contractor processing faces on their behalf. A face scan is a biometric identifier, whatever the app calls its output.

Employers have sued timekeeping and facial recognition vendors, and vendors have sued each other, over who owed the notice and release. Contract language rarely settles the question, because the statutory duty sits with the entity collecting the data. The contract is where you recover cost, and the file is where you prove compliance.

The Illinois Supreme Court's 2019 opinion in Rosenbach shows why the file matters. The court found that no additional consequences need be pleaded or proved, because a violation is itself enough to support the statutory cause of action. A worker therefore needs no data breach to bring a claim.

Duty by duty: what the contract should say

Each duty in §15(a)-(e) needs a matching clause and a matching piece of evidence. If a duty has a clause but no evidence, you cannot show that the vendor kept its side. If it has evidence but no clause, you cannot make the vendor fix a gap.

Duty	What the vendor contract should require	Evidence to hold
§15(a) retention and destruction	Deletion on the same schedule as the published policy, and proof of deletion on request	Deletion logs, reviewed quarterly
§15(b) notice and release	A consent step inside the app flow, blocked until a release is recorded	Notice version, timestamp, device and exact text shown
§15(c) no sale or profit	No selling or profiting from templates, by the vendor or anyone it uses	The clause, plus the vendor's written confirmation
§15(d) disclosure	Disclosure or redisclosure only where the statute permits	Access records and a list of every recipient
§15(e) safeguards	Reasonable care at least as protective as the care for other confidential information	Security terms, breach-notice terms, audit rights

Treat the table as a drafting list, not a substitute for counsel. A short clause that names the section it serves is easier to enforce than a general promise to comply with the law.

Retention is the clause vendors drift on

Section 15(a) requires a publicly available written policy with a retention schedule and guidelines for permanent destruction. Destruction is due when the purpose for collecting the data ends, or three years after the individual's last interaction with the entity, whichever comes first.

Destruction Trigger: Whichever Comes First

Enrollment scan
template collected
Last interaction
three-year clock starts
Purpose ends
delete templates
Three years after last interaction
delete templates

The three-year clock is often misread. It is not three years from collection. It runs from the last interaction, which for a payroll app can be years after the enrollment scan. A vendor that stores templates on its own servers will not know that date unless you tell it.

So the contract should say which trigger applies, who computes it and how deletion is proven. Both deadlines should be coded into the app, not left to a manual review. If a facial recognition vendor keeps templates after your schedule says they are gone, the employer still owes the retention duty.

Workplace policy documents often promise retention limits that the app does not enforce. That gap is where claims start. Ask the vendor to show a deletion run against the published schedule, and keep the evidence beside the policy it supports.

Notice and release belong in the flow

Under §15(b), before an app collects a face, the entity must give written notice that biometric data is being collected or stored, state the specific purpose, and explain how long it will be kept. A general privacy policy paragraph does not meet that duty.

Notice and Release Sequence

Written notice: collection, purpose, retention
Written release: signature or e-signature
Log notice version, timestamp, device, text
Refresh if purpose, vendor or app changes

Section 15(b) also requires a written release. A signed consent form, an electronic signature, or a checked consent box tied to a signed record can qualify. A collective bargaining agreement can stand in for the release in a unionized workplace, provided it clearly covers the biometric collection.

The release must be informed. If an employee signs a form that never mentions the face-scanning feature, the release does not cover that feature. Consent captured in the app flow is easier to prove than consent captured on paper, because the app can log what the worker saw.

Consent is not a one-time event. If the purpose changes, from timeclock verification to door access, the notice and release should be refreshed. A new vendor or a new app version can also require a new round, so the contract should oblige the vendor to flag changes before they ship.

Terms to put in the vendor contract

Eight terms cover the duties above. Each is short enough to negotiate, and each maps to a row in the table.

Deletion on the employer's published schedule, with proof of deletion on request.
A ban on selling, leasing or profiting from the biometric data, which §15(c) prohibits.
Disclosure or redisclosure only as §15(d) permits, with every recipient listed.
Security at least as protective as the care taken with other confidential information, as §15(e) requires.
Breach notice, with enough detail for the employer to act.
Cooperation with audits and with requests for logs, templates and deletion evidence.
A duty to flag any change in purpose, feature or app version before release.
Allocation of indemnity between employer and vendor for a failure on either side.

The last term matters least to the statute and most to the budget. Insurance may not respond either. Many general liability and cyber policies exclude statutory privacy penalties or biometric claims, so check coverage before a scan goes live, not after.

Penalty exposure and why the file comes first

BIPA §20 sets statutory damages at $1,000 for each negligent violation and $5,000 for each intentional or reckless violation. A prevailing party can also recover attorneys' fees, costs and injunctive relief. There is no cure period, so fixing the app after a complaint does not erase earlier violations.

BIPA Statutory Damages

$1,000per negligent violation
$5,000per intentional or reckless violation
No capno cure period in the statute

How violations are counted has been contested in the courts, and the rule can change. Ask counsel to confirm the current counting rule before you price the risk. The file does not depend on that answer, because it proves notice, release and deletion whichever way the count falls.

Penalties are not the only cost. Litigation freezes product roadmaps, forces vendor renegotiation and pulls engineering time into discovery. For a small team, that is the larger damage, and a complete file shortens it.

What the audit file holds

The file is the set of records that shows each duty was met on a given day. Keep it for the retention period. Log the notice version, the timestamp, the device and the exact text the worker saw, because that is what a release rests on.

Written notice text drafted and versioned under §15(b)
Written release captured with signature or electronic record under §15(b)
Public retention and destruction schedule published under §15(a)
App deletes templates at purpose end or three years after last interaction
No sale, lease, trade or other profit from biometric data under §15(c)
Access and disclosure controls prevent unauthorized disclosure or redisclosure under §15(d)
Reasonable safeguards protect biometric data under §15(e)
Vendor contract requires matching deletion, security and audit evidence
Deletion logs retained and reviewed quarterly
Annual review of features that trigger collection

The NIST Privacy Framework is a tool to help organizations improve individuals' privacy through enterprise risk management. It can help translate §15(e)'s reasonable-safeguards requirement into controls, though it does not replace BIPA's statutory requirements.

Employers keep other records too. The guide to what US employers must document shows how to keep a file orderly, and the biometric file can follow the same habits.

A sequence for the file

Work through these steps before the feature reaches production. The order matters, because the contract and the logs both depend on knowing where faces are collected.

Pre-Production Compliance Sequence

Map every face collection point
Write and version the notice
Capture written release before scanning
Publish retention and destruction schedule
Fix vendor deletion and audit terms
Build audit trail of scans and deletions
Train operations and HR deployers

Map every collection point. List each app, camera, kiosk and vendor that captures a face, plus where the template is stored, who can read it and where it may be disclosed.
Build the notice and release into the flow. Tie them to a notice version, store the signature or electronic record, and block the feature until consent is recorded.
Publish the retention schedule, and match the app's deletion logic to the published terms.
Put the eight terms in the vendor contract, alongside deletion, audit, breach-notice and cooperation duties.
Switch on the logsnotice views, consents, scans, deletions and access.
Review deletion logs quarterly and collection features annually, and refresh the notice when purpose, vendor or version changes.
Train the people who deploy it. Operations and HR teams should know that adding a camera is a legal event, not a configuration change.

How the work runs from first estimate to closeout is set out in how compliance work runs, and the government regulation checklist fits the launch review in step 7.

A warehouse operator that deploys a facial recognition timeclock across three Illinois sites shows the gap. The app collects templates for 400 workers and stores them on the vendor's cloud, with no written release. The fix costs a fraction of the defense, but it had to happen before the first scan.

Scope of this file

The file covers workplace apps in Illinois. For an app deployed outside Illinois, review the other state's biometric rules separately rather than assuming BIPA controls everywhere. A consumer-facing question, such as whether a face match app measures geometry at all, is a different threshold from the employer file described here.

For apps that combine face matching with age checks, keep biometric controls separate from age-restriction policy. The age restrictions guide concerns a different app-policy issue, and a monitoring default is not consent for facial recognition.

Common questions

Can we avoid BIPA by using a vendor's cloud?

No. The duty follows the entity collecting the data. Outsourcing storage does not transfer the notice, release or retention obligations, though it can create indemnity claims between the parties.

Can a signed employee handbook serve as the written release?

Usually not on its own. The release must be informed and specific to the biometric collection, and courts have rejected general handbook acknowledgments that never mention the face-scanning feature.

Does collective bargaining change anything?

Yes. A collective bargaining agreement can serve as the written release if it clearly covers the biometric collection. The notice and retention duties still apply.

How long can we keep a facial template?

Until the purpose for collecting it ends, or three years after the person's last interaction with the entity, whichever comes first. The schedule must be published and the app should enforce it.

What should the vendor hand over at an audit?

Deletion logs, the notice versions in use, consent records, access records and the security terms. If the vendor cannot produce them, the contract has no real audit term.