What is AI regulation in Illinois?
AI regulation: countries and regions
Illinois does not have one comprehensive AI statute. It regulates AI through targeted, rights-based laws: the Biometric Information Privacy Act (BIPA), which controls facial, fingerprint and voice data and carries a powerful private right of action; the Artificial Intelligence Video Interview Act, which governs AI analysis of job interviews; and a 2024 amendment to the Illinois Human Rights Act, effective 1 January 2026, that bans discriminatory AI in employment and requires notice. Courts and two state agencies enforce these.
What this means
Illinois is one of the most consequential US states for anyone deploying AI, but not because it passed a single sweeping AI law. Instead, it has built a sectoral, rights-based model over more than fifteen years. The centrepiece is the Biometric Information Privacy Act of 2008, which regulates how private companies collect and handle biometric identifiers such as face geometry, fingerprints and voiceprints. Because so much modern AI touches biometric data, BIPA has become the single most litigated technology-privacy statute in the country.
Two further instruments target AI in the workplace directly. The Artificial Intelligence Video Interview Act, in force since 2020, sets notice, explanation, consent and data-handling duties when employers use AI to analyse recorded job interviews. A 2024 amendment to the Illinois Human Rights Act, effective 1 January 2026, makes it a civil rights violation for employers to use AI in ways that discriminate against protected classes, and requires employers to tell workers when AI is used in employment decisions.
The distinctive feature is enforcement. BIPA lets individuals sue directly and recover fixed statutory damages, which has produced a wave of class actions and settlements running into hundreds of millions of dollars. The employment laws, by contrast, run through state agencies and the existing discrimination-complaint process. Together they make Illinois a high-exposure jurisdiction that other states and litigants watch closely.
Why it matters
For organisations, Illinois is where abstract AI-governance risk becomes concrete financial exposure. BIPA's private right of action means a single non-compliant biometric workflow, such as a fingerprint time clock or a face-matching feature, can trigger a class action without any plaintiff having to prove actual harm. Statutory damages of 1,000 US dollars per negligent violation and 5,000 US dollars per intentional or reckless violation, multiplied across thousands of employees or users, have driven landmark settlements: Facebook resolved its face-tagging case for 650 million US dollars, with the court noting it would put at least 345 US dollars into the hands of every class member. Even after a 2024 amendment that limits damages to a single recovery per person, large classes still produce material liability.
The employment rules raise the stakes for any business that screens, hires, promotes or disciplines workers in Illinois using algorithmic tools. The Human Rights Act amendment imposes liability for discriminatory effects regardless of intent, and adds notice duties. Vendors of hiring technology are equally affected, because their tools must be explainable and capable of supporting deletion and consent. For governance leads, Illinois is the clearest US example of why biometric and employment AI need consent records, retention schedules, vendor contracts and bias testing built in from the start, not retrofitted after a complaint.
How it works
The Illinois model: sectoral and rights-based, not comprehensive
Illinois has deliberately not enacted a single, EU-style horizontal AI statute. Instead it regulates specific harms in specific contexts: biometric data, AI in video interviews, and AI-driven discrimination in employment. This sectoral approach is anchored in pre-existing civil rights and privacy frameworks rather than a new AI regulator. What gives the Illinois model its force is not breadth but the strength of its remedies, above all BIPA's private right of action, which is unique among US biometric laws. Texas and Washington have biometric statutes, but only their attorneys general can enforce them; Illinois lets individuals sue.
BIPA: the Biometric Information Privacy Act (740 ILCS 14)
BIPA regulates private entities that collect or possess biometric identifiers, defined as retina or iris scans, fingerprints, voiceprints, and scans of hand or face geometry, plus biometric information derived from them. It excludes writing samples, photographs, demographic data, physical descriptions and certain health and genetic data. Section 15 imposes the core duties: publish a written retention and destruction policy with a schedule (data destroyed when the purpose is met or within three years of the last interaction, whichever is first); obtain informed written consent before collection, after telling the subject in writing what is collected, why, and for how long; never sell or profit from biometric data; restrict disclosure; and protect the data using a reasonable standard of care.
Section 20 provides the private right of action. Any person aggrieved may sue in state or federal court and recover the greater of liquidated or actual damages: 1,000 US dollars per negligent violation and 5,000 US dollars per intentional or reckless violation, plus attorneys' fees, costs and injunctive relief. A 2024 amendment also confirmed that a written release can be given by electronic signature.
The AI Video Interview Act (820 ILCS 42)
In force since 1 January 2020, this Act applies when an employer asks applicants for positions based in Illinois to record video interviews and uses AI to analyse them. Before the interview, the employer must: notify the applicant that AI may be used to analyse the video and assess fitness for the role; explain how the AI works and what general types of characteristics it evaluates; and obtain the applicant's consent. An employer may not evaluate applicants who do not consent. Videos may be shared only with persons whose expertise or technology is needed to evaluate the applicant. On request, the employer must delete the video within 30 days and instruct anyone else holding copies, including backups, to do the same. A 2022 amendment added a demographic-reporting duty: employers that rely solely on AI analysis to decide who gets an in-person interview must collect and report applicants' race and ethnicity to the Illinois Department of Commerce and Economic Opportunity, which reports on possible racial bias.
The Human Rights Act AI amendment (HB 3773, effective 1 January 2026)
Signed on 9 August 2024 as Public Act 103-0804, HB 3773 amended the Illinois Human Rights Act. From 1 January 2026 it is a civil rights violation for an employer to use AI that has the effect of subjecting employees to discrimination on the basis of a protected class, or to use zip codes as a proxy for a protected class, across recruitment, hiring, promotion, renewal of employment, training or apprenticeship selection, discharge, discipline, tenure, and other terms and conditions. Employers must also notify employees and applicants when AI is used for these purposes. The law defines AI broadly as a machine-based system that infers from input how to generate outputs such as predictions, content, recommendations or decisions, and expressly includes generative AI. Liability turns on discriminatory effect, not intent.
The institutions: courts, IDHR and the Attorney General
Three sets of institutions matter. The courts, especially the Illinois Supreme Court and the federal Seventh Circuit, have shaped BIPA more than any regulator, through a series of rulings on standing, limitation periods, accrual and damages. The Illinois Department of Human Rights (IDHR) administers and enforces the Human Rights Act, including its AI provisions, and is responsible for the implementing rules. The Illinois Attorney General does not enforce BIPA, which is private only; the AG's AI footprint is consumer protection, sponsoring legislation on AI-generated child sexual abuse material, election-misinformation guidance, multistate advocacy on AI harms, and defending Illinois laws against federal preemption.
How the employment laws are enforced
HB 3773 does not create a BIPA-style direct right to sue. It runs through the existing Human Rights Act process: a person files a charge with the IDHR, which investigates and decides whether there is substantial evidence; the complainant may then either proceed before the Illinois Human Rights Commission or file a civil action in circuit court. Remedies are designed to make the complainant whole and can include back pay, reinstatement or front pay, clearing of records, damages, and attorneys' fees and costs. This is why some commentators describe a private right of action while others say there is none: the right to sue exists, but only after the administrative charge, not as an immediate court filing.
Examples
Biometric time clocks. The most common BIPA fact pattern, illustrated by Cothron v White Castle, involves employees scanning a fingerprint or hand to clock in and out. White Castle had collected such data without the required consent; the plaintiff argued every scan was a fresh violation. The Illinois Supreme Court agreed in 2023, in a 4-3 decision, that a claim accrues with each scan, and the majority acknowledged White Castle's estimate that, on behalf of as many as 9,500 current and former employees, damages might exceed 17 billion US dollars. This drove the 2024 legislative fix limiting recovery to one violation per person.
Facial recognition in consumer products. In the Facebook "Tag Suggestions" litigation, Illinois users alleged the platform scanned their faces to suggest tags without consent. The case settled for 650 million US dollars; the court granting final approval in February 2021 called it a landmark result, roughly 1.6 million class members received initial checks of about 397 US dollars, and it ranks among the largest privacy settlements in US history. Google reached a comparable 100 million US dollar Illinois settlement over the Google Photos face-grouping feature, covering roughly 420,000 Illinois residents at about 154 US dollars each, while related BIPA cases produced a 35 million US dollar Snapchat settlement and a 68.5 million US dollar Meta/Instagram settlement.
AI video hiring. An employer using a vendor that analyses recorded interviews for word choice, tone or facial expressions must, before the interview, tell each Illinois applicant AI will be used, explain what it evaluates, and obtain consent; honour deletion requests within 30 days across the vendor and all backups; and, if AI alone decides who advances to an in-person interview, report applicant race and ethnicity to the state. From 1 January 2026, the same employer must also ensure the tool does not produce discriminatory effects and give workers the required Human Rights Act notice.
Common misunderstandings
"Illinois has a comprehensive AI law." It does not. It has separate, targeted statutes covering biometrics, AI video interviews and AI in employment, layered onto existing civil rights and privacy law.
"You must suffer harm to sue under BIPA." False. In Rosenbach v Six Flags the Illinois Supreme Court held that a bare violation of BIPA rights makes a person aggrieved; no separate injury is needed.
"The 2024 amendment gutted BIPA." It limited damages so that repeated collection of the same identifier from the same person by the same method is a single violation with one recovery, and confirmed electronic-signature consent. The notice, consent and retention duties, and the private right of action, all remain.
"BIPA is enforced by the Attorney General." No. BIPA is enforced solely through private lawsuits. This is what distinguishes it from biometric laws in Texas and Washington.
"HB 3773 only bans intentional discrimination." No. Liability attaches to discriminatory effects regardless of intent, and a separate violation arises from failing to give the required notice.
Risks and boundaries
The Illinois model is powerful but bounded. BIPA applies only to private entities, not to state or local government agencies or the courts, and excludes several data categories including certain health, genetic and photographic data. It is a biometric privacy law, not a general AI safety statute: it says nothing about model accuracy, transparency of non-biometric systems, or automated decision-making generally.
Several questions remain genuinely unsettled. The 2024 BIPA amendment is silent on retroactivity. On 1 April 2026 the Seventh Circuit held in Clay v Union Pacific Railroad that the damages limit applies retroactively to cases pending when the amendment was enacted, treating it as remedial and cutting the plaintiff's exposure from up to 7.5 million US dollars to the 5,000 US dollar single-recovery cap; but that ruling is a federal prediction of state law and is not binding on Illinois state courts, which have split, with cases generally treated as retroactive in Will County and prospective in Cook County. The Illinois Supreme Court has not finally resolved it. Insurance coverage is also contested: in West Bend v Krishna Schaumburg Tan the Illinois Supreme Court found a duty to defend a BIPA claim under a general liability policy, but a later Illinois appellate decision (Visual Pak) reached the opposite result on different policy wording, so coverage depends heavily on the exact exclusions.
The employment rules carry their own uncertainty. The IDHR's implementing rules for HB 3773 are not final: the "Subpart J: Use of Artificial Intelligence in Employment" rules were published in the Illinois Register on 15 May 2026, triggering a 45-day public comment period ending 29 June 2026, but the agency confirmed on 2 June 2026 that the public hearing scheduled for 10 June 2026 had been temporarily postponed while it reviews the rulemaking and collaborates with other state agencies. So the substantive ban and notice duty are in force from 1 January 2026, but the detailed compliance mechanics are still moving. Finally, a federal executive order signed on 11 December 2025 directs challenges to "onerous" state AI laws; commentators agree it does not by itself override Illinois law, which remains enforceable unless a court or Congress says otherwise.
What to do next
Map your biometric footprint first. Inventory every system that touches face, fingerprint, voice or similar data, including time clocks, security access, customer features and any AI that generates biometric templates. For each, confirm you have a public retention and destruction policy, written informed consent before collection, no sale or improper disclosure, and reasonable security. This is the single highest-exposure area in Illinois.
Treat hiring AI as a regulated activity. If you use AI to analyse video interviews of Illinois-based roles, build pre-interview notice, plain-language explanation and consent into the flow, and confirm your vendor can delete videos and backups within 30 days. If AI alone screens candidates for in-person interviews, stand up the demographic-reporting process.
Prepare for the Human Rights Act amendment. From 1 January 2026, audit AI used across the employment lifecycle for discriminatory effects, remove zip code proxies, and prepare worker notices. Watch the IDHR rulemaking, which is in flux, and align notice content and record retention to the proposed rules once finalised. The thresholds that should change your plan are: any new biometric workflow (trigger a BIPA consent review), any AI tool influencing an employment decision (trigger notice and bias testing), and final IDHR rules or an appellate ruling on retroactivity (trigger a policy update). Review insurance for biometric and privacy exposure, and keep monitoring federal preemption developments without assuming they suspend Illinois duties.
FAQs
Does Illinois have a single AI law?
No. Illinois uses a sectoral, rights-based model with separate statutes for biometrics (BIPA), AI video interviews and AI in employment, rather than one comprehensive AI act.
What makes BIPA so distinctive?
Its private right of action. Individuals can sue directly and recover fixed statutory damages of 1,000 or 5,000 US dollars per violation without proving actual harm, which has produced thousands of class actions and very large settlements.
How much can a BIPA violation cost?
The greater of liquidated or actual damages: 1,000 US dollars per negligent violation and 5,000 US dollars per intentional or reckless violation, plus attorneys' fees and costs. A 2024 amendment limits this to one recovery per person for repeated identical collections.
What does the AI Video Interview Act require?
Before using AI to analyse a recorded interview, employers must notify the applicant, explain how the AI works, and obtain consent. They must limit sharing, delete videos within 30 days on request, and, if AI alone screens for in-person interviews, report applicant demographics to the state.
What changes on 1 January 2026?
The Human Rights Act amendment (HB 3773) takes effect. It makes discriminatory use of AI in employment a civil rights violation, bans zip codes as a proxy for protected classes, and requires employers to notify workers when AI is used in employment decisions.
Who enforces these laws?
BIPA is enforced by private lawsuits only. The Human Rights Act AI rules are enforced through the Illinois Department of Human Rights and the Human Rights Commission, with an eventual option to sue in circuit court. The courts have shaped BIPA heavily; the Attorney General does not enforce BIPA.
How does Illinois differ from other states?
Illinois leads on biometric privacy because of BIPA's private right of action, which Texas and Washington lack. Its employment-AI rules are narrower than Colorado's comprehensive AI Act or New York City's mandatory bias audits, focusing on notice and discriminatory effect.
Does the federal push against state AI laws override Illinois rules?
Not on its own. The December 2025 federal executive order directs litigation and funding pressure against state AI laws, but commentators agree Illinois law remains in force unless a court or Congress changes it.