In a unanimous decision with sweeping implications for employers and companies across Illinois and beyond, the U.S. Court of Appeals for the Seventh Circuit ruled on April 1, 2026, that the 2024 amendment limiting damages under the Illinois Biometric Information Privacy Act (BIPA) applies retroactively to all pending cases.
The ruling in Clay v. Union Pacific Railroad Company (No. 25-2185, 7th Cir. 2026), which consolidated three interlocutory appeals, represents one of the most significant developments in BIPA litigation since the Illinois Supreme Court’s 2023 decision in Cothron v. White Castle. It dramatically reduces potential exposure in hundreds of ongoing class actions and individual claims involving fingerprint scanners, facial recognition, and other biometric technologies.
From “Per-Scan” Damages to Legislative Intervention
Enacted in 2008, BIPA was the nation’s first comprehensive biometric privacy law. It imposes strict requirements on private entities that collect, capture, or otherwise obtain biometric identifiers (such as fingerprints, voiceprints, or facial geometry) or biometric information. Violations of key provisions — particularly Section 15(b) (informed consent before collection) and Section 15(d) (prohibitions on disclosure) — carry statutory damages of up to $1,000 for negligent violations or $5,000 for intentional or reckless ones, plus attorney fees and injunctive relief.
In 2023, the Illinois Supreme Court held in Cothron that a separate claim accrues under BIPA with every scan or transmission of biometric data without proper consent. This “per-scan” interpretation opened the door to potentially astronomical damages in class actions. For employees scanned multiple times daily over months or years, liability could reach tens or even hundreds of millions of dollars per case — a threat that prompted widespread concern among Illinois businesses.
In direct response, the Illinois General Assembly passed Senate Bill 2979 (Public Act 103-0769), signed into law by Governor J.B. Pritzker on August 2, 2024. The amendment clarified that when the same biometric identifier or information is collected from the same person using the same method, it constitutes a single violation — not a new violation with every scan. Plaintiffs are therefore entitled to, at most, one recovery per statutory subsection violated, regardless of the number of instances.
The amendment was silent on whether it applied retroactively, leading to a split among federal district courts in the Northern District of Illinois. Some judges applied it only prospectively; others reached the opposite conclusion. This uncertainty created significant challenges for defendants in pending litigation and complicated settlement negotiations.
The Seventh Circuit’s Reasoning: Remedial, Not Substantive
In Clay v. Union Pacific Railroad Company, plaintiff Reginald Clay alleged that his employer violated BIPA by requiring fingerprint scans for facility access without adequate notice and consent. Similar issues arose in the consolidated cases Gregg v. Central Transport LLC and Willis v. Universal Intermodal Services.
The Seventh Circuit panel, in an opinion authored by Judge Brennan, held that the 2024 amendment is a remedial change rather than a substantive one. Under longstanding Illinois law, remedial or procedural amendments apply retroactively unless the legislature clearly indicates otherwise.
The court explained that the amendment does not alter BIPA’s underlying standards of liability or the right to sue. It simply limits the scope of available statutory damages by redefining when a “violation” occurs and cabining the discretion of trial courts in awarding liquidated damages. Because the plain language of the amendment focuses exclusively on remedies, it qualifies as procedural and must be applied to cases pending when it took effect.
This ruling reverses several district court decisions that had treated the amendment as substantive and therefore prospective only. The decision provides much-needed clarity and uniformity across the Seventh Circuit, which covers Illinois, Indiana, and Wisconsin.
How This Changes Pending BIPA Litigation Cases
The retroactive application of the damages limitation is a major victory for businesses. Many pending BIPA class actions that previously carried catastrophic per-scan exposure — sometimes calculated in the hundreds of millions or billions — now face far more manageable liability caps. This development is expected to:
- Facilitate more reasonable settlements in ongoing cases;
- Lead to dismissals or significant reductions in damages claims;
- Potentially affect federal subject-matter jurisdiction in some diversity cases where the amount in controversy no longer meets the threshold;
- Encourage companies to strengthen biometric compliance programs without the overhang of unlimited historical exposure.
However, the ruling does not eliminate liability entirely. Companies can still face statutory damages up to $5,000 per person per violation type, plus attorney fees. The decision also leaves intact BIPA’s other requirements, including data security safeguards, retention limits, and prohibitions on profiting from biometric data.
For employers using time clocks, access control systems, or any biometric technology, this decision underscores the importance of robust informed consent practices. While the damages risk has been curtailed for past conduct in pending cases, future violations remain fully enforceable under the clarified framework.
Compliance professionals should review existing biometric policies, ensure clear written notices and consents (including the validity of electronic signatures, as clarified by the same amendment), and maintain detailed records of collection practices. The ruling also highlights the value of monitoring legislative and judicial developments in biometric privacy, as other states continue to consider or expand their own BIPA-style laws.
From a national perspective, the decision reinforces Illinois’ role as the epicenter of biometric litigation while demonstrating that legislative corrections can meaningfully address judicial interpretations that create disproportionate liability.
Clay Decision in BIPA Claims
The Clay decision is likely to influence ongoing settlement discussions and may prompt additional appeals or requests for Illinois Supreme Court review, though the Seventh Circuit’s thorough analysis of Illinois retroactivity principles makes reversal less probable.
Businesses with active or threatened BIPA claims should promptly consult counsel to evaluate how this ruling affects their specific exposure. For companies not yet sued, the decision serves as a timely reminder to audit biometric data practices before the next wave of litigation.
As biometric technologies become more prevalent in workplaces, retail, and consumer services, clear and predictable legal rules — like those reinforced by the Seventh Circuit — are essential for balancing innovation with individual privacy rights.
