BIPA & biometrics: the highest statutory stakes.
Biometric identifiers carry the highest statutory-damage regimes in privacy. Per-scan theories and class actions under Illinois’ BIPA have produced nine-figure settlements.
The law in brief.
Illinois Biometric Information Privacy Act (740 ILCS 14), plus similar laws in other states
Yes
Liquidated damages per violation, higher for intentional or reckless violations
Notice, written consent and a published retention policy before collecting biometrics
Voiceprints, face geometry, fingerprints and similar
What creates the exposure.
Call-tracking platforms that capture or derive voiceprints
Biometric SDKs embedded in the site
Facial or voice features in customer tools
Rated critical from the start.
Report indicators
Risks tied to this law
- Biometric SDK detected
- Voiceprint-capable call tracking detected
Voiceprint-capable call tracking detected
Example finding. Vendor names are withheld.
How to respond.
“Does any tool on the site capture or analyze voice, face or fingerprints?”
“Is written consent collected before biometric data is captured?”
“Confirm written biometric consent and a published retention policy, or remove the technology, verified by CyRisk rescan.”
Refer, with exclusion review for Illinois exposure.
Keep exploring.
Other laws
Why is biometric detection rated critical by default?
Biometric laws carry per-violation statutory damages and a private right of action, which drives some of the largest privacy settlements.
Does BIPA apply outside Illinois?
It protects Illinois residents. Other states have biometric laws of their own, though most lack BIPA’s private right of action.
What triggers a finding?
Biometric SDKs and call-tracking platforms that can capture or derive voiceprints.
Find the biometric exposure before bind.
Send five past submissions you’ve already bound, conditioned or declined. We score them blind, then put our disposition next to the call you made.
Severity and placement shown are CyRisk defaults and can be tuned per account. A detected exposure indicates a fact pattern common to privacy litigation, not a confirmed violation. Litigation theories explain why a finding is tracked; they are not legal advice.