- Tell you, in writing, what they’re collecting and why.
- Say how long they’ll keep it and when they’ll destroy it.
- Get your written consent first.
BIPA also creates a private right of action—meaning everyday people can sue. Statutory damages can reach $1,000 per negligent violation and $5,000 per reckless or intentional one, plus attorneys’ fees. Multiply that across thousands of shoppers and the numbers escalate quickly. For retailers, the combination of self-checkout cameras and AI-assisted analysis is a legal tripwire if notice and consent are not airtight.
Expect a fight over what the cameras were actually doing. A bounding box on a screen suggests face detection(software noticing “a face-shaped thing” to center an image), which retailers may argue does not equal a “scan of facial geometry” under BIPA. Plaintiffs will counter that the system measured and stored unique facial data points to identify or track individuals—squarely within BIPA’s scope.
That hairline distinction—detection vs. recognition vs. analysis—often decides whether a case survives the first round of motions.
