The statute requires informing the subject in writing that biometric data is being collected, stating the specific purpose and retention period, and obtaining a written release before collection.
Employment context releases have distinct requirements.
Alternative Names:
BIPA Consent Requirement|Informed Written Consent
Why it Matters?
Each disclosure element is independently required, and a release obtaining consent without stating the retention period or specific purpose fails the statute regardless of the subject's actual agreement. That element-by-element structure makes technical compliance failures common even where organizations sought consent. Retroactive consent does not cure collection that already occurred, which limits remediation after a claim surfaces.
Frequently Confused with
Related terms
Frequently asked questions
What must the release contain?
Does later consent cure prior collection?
