BIPA Compliance for E-Signatures: What Illinois Requires

Yes, an electronic signature can satisfy the Illinois Biometric Information Privacy Act (BIPA). Since August 2, 2024, the statute says so explicitly. But the signature is only the last step. BIPA compliance depends on what the person saw, in writing, before they signed: that you collect biometric data, why you collect it, and how long you keep it. This guide explains what the law requires, how to build an e-signature flow that proves it, and where the risk still sits.

TL;DR

• BIPA now defines an “electronic signature” and counts it as a valid “written release” for collecting biometric identifiers, so a click-to-sign or drawn signature can work.
• Consent is valid only if the person first received written notice of the collection, its specific purpose, and the retention period.
• The 2024 amendment limits repeat collection from the same person by the same method to a single violation, but damages of $1,000 (negligent) or $5,000 (intentional or reckless) per violation still apply.
• BIPA applies to Illinois residents’ data wherever your company is based, so a national workflow should default to the Illinois standard.
• Keep proof: the disclosure version shown, the timestamp, the signer’s identity and an audit trail in the same session.

Table of Contents

• What BIPA regulates, and what it does not
• What the 2024 amendment changed
• The three requirements before you collect
• Building a BIPA-ready e-signature workflow
• A worked example: employee onboarding in Illinois
• Beyond Illinois: other states
• Our perspective: signing is the easy part
• Running this workflow in BeeSign
• Common mistakes to avoid
• FAQ
• Sources

What BIPA regulates, and what it does not

BIPA is codified at 740 ILCS 14. It covers “biometric identifiers”: a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry. The statute’s definitions exclude writing samples and written signatures, among other items.

That exclusion matters for e-signature software. A drawn or typed signature is not a biometric identifier, so signing a contract does not by itself trigger BIPA. The trigger is what else happens in the workflow. Examples:

• A selfie is matched against a government ID to verify the signer, which involves face geometry.
• An employee onboarding packet is combined with a fingerprint or face scan for timekeeping.
• A voice recording is captured during a remote signing session.

If your workflow collects any of these from an Illinois resident, BIPA applies, and the e-signature becomes your vehicle for consent. Our guide to document signing with identity verification shows where those checks sit in a signing flow.

What the 2024 amendment changed

On August 2, 2024, Governor Pritzker signed SB 2979, which changed BIPA in two ways.

Electronic signatures are written releases

Before the amendment, BIPA required a “written release” and left open whether a click or an e-signature qualified. Public Act 103-0769 defines an electronic signature as an electronic sound, symbol, or process attached to or logically associated with a record and executed or adopted by a person with the intent to sign it. It then includes that definition in “written release.” Greenberg Traurig’s analysis describes the change as clarifying electronic consent for biometric data collection.

The key words are “intent to sign.” A pre-checked box buried in terms of service is a weak way to show intent. A deliberate signing action on a dedicated consent record is a strong one.

Repeat scans count as one violation

In 2023, the Illinois Supreme Court held in Cothron v. White Castle that a claim accrues with every scan or transmission made without prior informed consent. That created enormous theoretical exposure for employers who scanned workers daily. The amendment answers it: collecting the same biometric data from the same person using the same method is a single violation, not one per scan.

This reduces damages exposure. It does not remove the consent requirement.

The three requirements before you collect

Under Section 15(b), a private entity must do three things first (see also the Section 20 damages provision on that page):

1. Inform the person in writing that biometric data is being collected or stored.
2. Inform them in writing of the specific purpose and length of time for which it is collected, stored and used.
3. Receive a written release from the person or their legally authorized representative.

Section 20 sets liquidated damages of $1,000 per negligent violation, or actual damages if greater, and $5,000 per intentional or reckless violation, or actual damages if greater. A person aggrieved can sue in state circuit court or as a supplemental claim in federal court. That private right of action is why BIPA litigation looks different from other states’ biometric laws.

Order matters. Legal analysts quoted in our research make the same point: you cannot simply “get a signature.” The signature should come after the person has acknowledged the disclosures about retention and purpose, as one compliance guide on biometric time clocks also explains for employers.

Building a BIPA-ready e-signature workflow

A compliant flow has four parts. Treat this as a checklist for your own review, and have Illinois counsel confirm the final wording.

1. Show the notice before the signature prompt

The written disclosure must appear before the signer reaches the signature step. Put it on its own page or as the first block of the document, not behind a link. State plainly:

• which biometric identifier you collect (for example, face geometry from a selfie used to match a government ID);
• the specific purpose (for example, confirming the signer is who they say they are for this agreement);
• the retention period, and when the data is destroyed;
• whether you share it with any third party.

A clear notice does not need to be long. If you ever need the notice to reach people away from a desk, such as at a front counter or on a job site, a QR code consent flow can send them to the same disclosure and signing page. Whatever the entry point, the signer must see the notice before any capture begins.

2. Capture the release as a deliberate signing act

Use a signature field tied to the consent text, so the signature is “logically associated with” the record, which is the language of the statute. Our post on adding signature fields the right way covers placement and required-field settings. Avoid bundling the biometric release into a general agreement. A separate consent document is easier to defend and easier to revoke or update.

3. Keep the evidence in the same session

A frequent pitfall is storing the signature without proof that the disclosure was presented in that session. Your record should show:

• the exact disclosure text and version the person saw;
• the signer’s name, email and the time of signing;
• IP address and device details;
• the signed document, sealed against later edits.

A full electronic signature audit trail gives you this in one record. If a claim arrives years later, the version history of your notice is often the difference between a short response and a long dispute.

4. Set retention and destruction rules

The law requires a retention schedule, and your systems must follow it. Decide where the biometric data lives, who can access it, and when it is deleted. Then write that down in the same notice you showed at signing. Records of your own workflow, including who reviewed it and when, help here too; even digital record management practices in schools make the point that organized, retrievable records are easier to audit.

A worked example: employee onboarding in Illinois

Say an HR team hires a field technician in Chicago and uses face matching against a driver’s license to verify identity for remote onboarding.

1. The offer packet goes out as a normal signing request.
2. Before the identity step, the candidate sees a one-page biometric notice: face geometry will be collected from a selfie, the purpose is identity verification for onboarding, and it will be destroyed on a stated schedule.
3. The candidate signs the notice as a separate document. That is the written release.
4. Only then does the selfie capture begin.
5. HR stores the signed notice and audit trail with the employee file.

If step 4 came before step 3, the sequence would fail the Section 15(b) order, even though everything was eventually signed. For the surrounding hiring workflow, see our offer letter e-signature workflow.

Beyond Illinois: other states

BIPA reaches any private entity collecting biometric identifiers from Illinois residents, whatever its headquarters. Other states differ in enforcement. According to one state-by-state guide, Texas’s CUBI is enforced by the state attorney general rather than through private lawsuits, with penalties that can reach $25,000 per violation. Washington’s biometric law is likewise generally enforced by the attorney general, though newer health-data laws are changing that picture, as this analysis notes. Texas requires informed consent before commercial capture without explicitly mandating a written signature.

Because rules vary, many compliance advisors suggest a “BIPA-plus” baseline: comprehensive notice, explicit opt-in consent and strict retention limits everywhere you operate. One workflow for all states is simpler to run and to audit than a patchwork of variants. For the broader federal and state e-signature rules that sit underneath, read our guide to eSignature compliance requirements and the compliance checklist for teams.

Our perspective: signing is the easy part

We build e-signature software, and we see the same misunderstanding often: teams think a legally valid signature equals a compliant process. After the 2024 amendment, the signature question is settled. The harder question is whether your workflow can prove what the person knew when they signed.

That is why we treat identity verification, templates, audit trails and storage as one workflow rather than separate tools. A reusable template means the same disclosure goes to every signer, so there is no version drift. A complete audit trail ties the disclosure and the signature together. And where data lives matters as much as how it is collected. With bring-your-own-cloud storage, signed records and verification data can stay in your own infrastructure, which gives your retention and destruction policy a place to be enforced. Our pricing is flat-rate, without per-envelope fees, so you do not have to ration consent documents to control cost.

One caution from us: no software makes you compliant on its own. It gives you the controls. The notice wording, retention schedule and legal review remain your responsibility, ideally with an Illinois privacy attorney.

— Mustafa Abusharkh

Running this workflow in BeeSign

If you collect biometric data as part of signing, you can build the flow in one place. Electronic Signatures cover templates, fillable forms and audit trails, and Identity Verification adds government ID capture and biometric face matching. Teams that need their own domain, branding and storage can look at White Label & BYOC. The Individual plan is $9.99 per month, Enterprise and custom integrations are on the pricing page, and every plan starts with a 7-day free trial.

Common mistakes to avoid

• Treating a terms-of-service checkbox as the release. It is hard to show intent to sign, and the disclosure is easy to miss.
• Showing the notice after capture. Notice and release must come first.
• Vague purpose language. “Business purposes” is not a specific purpose.
• No retention date. The statute requires the length of time, so state one.
• Not saving the notice version. Without it you cannot prove what was shown.
• Ignoring signers’ representatives. A legally authorized representative can give the release, so your flow should allow for that.

FAQ

What is BIPA compliance?

BIPA compliance means meeting Illinois’s rules for collecting and handling biometric identifiers such as face geometry, fingerprints and voiceprints. You must give written notice, state the purpose and retention period, and get a written release before collection. You must also follow your retention and destruction schedule.

Does BIPA only apply to Illinois residents?

BIPA protects Illinois residents’ biometric data, but it applies to private entities wherever they are based. A company in another state that collects face or fingerprint data from someone in Illinois can be exposed. Many national companies therefore apply the Illinois standard to everyone.

Is an electronic signature valid consent under BIPA?

Yes. Since the August 2, 2024 amendment, an electronic signature counts as a written release. It must be a sound, symbol or process associated with the record and adopted with intent to sign. The required disclosures still have to come first.

What is a BIPA violation?

A violation happens when you collect, store or share biometric data without meeting the notice, purpose, retention or written release requirements. Damages are $1,000 for negligent violations and $5,000 for intentional or reckless ones, or actual damages if greater. After the 2024 amendment, repeat collection from the same person by the same method counts as one violation.

Sources

• Illinois BIPA definitions, 740 ILCS 14/10
• 740 ILCS 14/20, Right of action
• Public Act 103-0769
• Greenberg Traurig: BIPA Update
• Workplace Privacy Report: Illinois Governor Signs BIPA Amendment
• Byte Back: BIPA Amendment Bill Signed into Law
• Biometric privacy laws and time clocks: BIPA, CUBI, Washington
• Voice Biometric Data Laws by State: 2026 Guide
• Biometric Privacy Compliance for AI Security: 2026

Recommended

• Are Electronic Signatures Legally Binding? Everything You Need to Know
• How U.S. Lawyers and Businesses Prove Electronic Signatures in Court
• What Makes an eSignature Valid?
• Guide to eSignature Compliance Requirements