BIPA and Video Analytics: Where Biometric Collection Starts

Any camera analytics rollout at an Illinois site reaches legal review carrying one question: whether the cameras over the dock will collect biometric data. The Biometric Information Privacy Act answers that with a short list, not a camera type. Where BIPA video analytics risk actually sits is in specific features, and a site that audits for the feature instead of the footage can deploy with a clear answer.

The problem: the risk gets assigned to the camera

BIPA was written around a list. Section 10 of the Act defines a biometric identifier as “a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry.” It then lists what is not one: writing samples, signatures, photographs, demographic data, physical descriptions such as height or hair colour, and several medical categories. Biometric information is anything based on one of those identifiers that is used to identify an individual.

Two features of that text matter to anyone running cameras. Video is not named in the exclusions — photographs are — so “video is exempt” is not what the statute says. And the thing it does name, a scan of face geometry, is not the footage. It is something computed from the footage.

The duties that follow are specific. Under Section 15(b), a private entity may not collect a biometric identifier unless it first informs the person in writing, states the purpose and length of term in writing, and receives a written release. Section 15(a) requires anyone in possession of biometric data to publish a retention schedule and destroy the data when its purpose is satisfied or within three years of the person’s last interaction, whichever comes first. Section 20 sets liquidated damages of 1,000 dollars per negligent violation and 5,000 dollars per intentional or reckless one.

The stakes behind those numbers were set out by the Seventh Circuit this April. In Clay v. Union Pacific Railroad Co., decided 1 April 2026, a truck driver alleged the railroad scanned his fingerprints about 1,500 times as he entered and left its facilities; on intentional violations, the court noted, that could have meant 7.5 million dollars for one plaintiff. The two companion cases involved fingerprint and hand-geometry time clocks. None of the three involved a camera.

That is worth sitting with. All three cases were about the gate and the time clock. A site’s existing BIPA obligations may well sit there, already running, while the legal review argues about analytics on the dock.

Why the usual approach falls short

Two reflexes dominate, and they point in opposite directions.

“Cameras are just video.” This treats BIPA as irrelevant to anything with a lens. It fails because the statute does not care what captured the image. It cares whether a scan of face geometry was taken from it. A camera running a face recognition feature is squarely within the Act, whatever the camera cost and whatever else it does.

“Any AI on a camera is biometric.” This treats every analytics feature as face recognition and quietly shelves the deployment for Illinois sites. It fails in the other direction. A detector that reports a pedestrian inside a forklift’s path, or a missing hard hat in a marked zone, produces a location and a label. Refusing it on biometric grounds forfeits the safety case to avoid a risk that feature never created.

Between the two sits the vendor questionnaire, which usually contains some version of “is your product BIPA compliant?” A yes to that question tells you nothing, because compliance is a property of how a site collects, notifies, releases and retains, not of a product. What legal review needs is a feature-level answer: which operations in this system produce a face template, can they be turned off, and who holds the output.

BIPA does not regulate the camera. It regulates the template.

What good looks like: auditing BIPA video analytics risk feature by feature

A biometric identifier under Illinois BIPA is one of the items the statute lists by name: a retina or iris scan, a fingerprint, a voiceprint, or a scan of hand or face geometry. Photographs are expressly excluded. For camera analytics, its reach turns on whether a feature computes facial geometry that can identify a person.

Detection, classification and recognition are different operations

The confusion starts with vocabulary. “Computer vision,” “AI analytics” and “facial recognition” get used interchangeably in sales material and in legal memos, and they describe different computations.

The clearest technical description comes from NIST. In NISTIR 8280, its December 2019 report on demographic effects in face recognition, NIST explains that recognition algorithms run a face detector and then a feature extractor that turns images of a person into what the report calls “a vector of values that relate to the identity of the person.” Recognition then compares two such vectors and scores their similarity. The report contrasts this with classification and estimation, which it describes as single-shot operations on one sample using different machinery.

That distinction maps directly onto what a camera analytics system can do.

Operation	What it outputs	Creates a reusable identity record?
Object detection	A box and a class label: person, forklift, vehicle	No
Attribute or condition classification	A label about that object or scene: hard hat absent, exit obstructed	No
Face detection	The location of a face in the frame	Not by itself, but it is the first stage of recognition, so ask what runs next
Face recognition or verification	A face template compared against stored templates	Yes, and this is the scan of face geometry the statute names

The table is a technical map, not a legal ruling. Its use is that it turns a vague question — “does this system do biometrics?” — into a concrete one that a vendor can answer and an engineer can check.

“Can it identify?” is the test courts keep applying

The statutory term contains a word courts have taken seriously: identifier. In Zellmer v. Meta Platforms, decided on 17 June 2024, the Ninth Circuit held that if biometric data “cannot identify an individual, it is not an identifier,” and that face signatures Facebook generated for people who were not users could not identify them on the record before it. The court described that reading as joining other courts that had considered the question.

The same opinion records the other side of the line. Discussing an earlier Illinois federal case against Apple, it noted that BIPA applies if face scans could identify a person, even when a company does not use them to. Capability is the test, not intent.

Two cautions belong here. Zellmer is a federal appeals court outside Illinois interpreting Illinois law, so it persuades rather than binds Illinois state courts. And “we do not use it to identify anyone” is not a defence if the data could be used that way.

Control decides who is holding the data

The newest development came on 7 August 2026. In G.T. v. Samsung Electronics America, the Seventh Circuit considered a phone gallery app that, according to the complaint, grouped photos by facial geometry and built face templates on the user’s own device. The court held that the Act’s key verbs — possess, collect, capture, obtain — all require the company to have some degree of control over the biometric data. Templates that stayed on the user’s device, with no allegation that Samsung could access, modify or use them, fell short; in the court’s words, the case strayed “too far afield from the statute’s heartland.” Read the G.T. v. Samsung opinion for the full reasoning.

A workplace deployment is a different fact pattern, and it would be a mistake to read G.T. as a shield for one. An employer chooses the cameras, configures the analytics and operates the system. If any feature in that system produces face templates, someone controls them. The audit question is who: the site, the vendor’s cloud, or both.

A five-question feature audit

Run these against every analytics product on the camera estate, including anything bundled in camera firmware or the video management system.

1. Which features extract a face template or any vector used to match the same person across images? Face recognition, face-based identification of drivers or visitors, watchlists and “find this person” search are the usual candidates. Get the list in writing.
2. Are those features switched off on Illinois sites, and can they be disabled per camera or per site? A feature that is licensed but disabled is a configuration fact to document, not an assumption.
3. If templates exist, where are they stored and who can access them? This is the control question G.T. turned on. Name the servers, the accounts and the vendor’s own access.
4. If any biometric collection is intended, are the Section 15 steps in place before it starts? Written notice, a written statement of purpose and term, a written release, and a public retention and destruction schedule.
5. Does the data-flow diagram show it? The same document that closes the IT review should name every destination for analytics output. If a template leaves the site, it should appear on that diagram.

Then walk to the entrance and check the time clock. In all three cases the Seventh Circuit decided in April, that is where the claim started.

What this audit does not settle

Clay and G.T. were decided by a federal court predicting how the Illinois Supreme Court would rule, and the Illinois Supreme Court has the final word on Illinois law. G.T. also concerned a consumer device, not a workplace system. The amendment in P.A. 103-769 changed how damages are counted — repeated collection of the same identifier from the same person by the same method is one violation — and the Seventh Circuit held it applies to pending cases. It did not change what counts as an identifier or what a site must do before collecting one. BIPA is also one statute in one state; the rules for camera placement and recording in California are a separate question with separate answers. None of this is legal advice.

Where Nsightify fits

The detections on Nsightify’s two solutions report conditions. On the Physical Safety side they cover PPE compliance, forklift–pedestrian proximity, a blocked exit or obstructed egress path, a person down, and entry into a restricted machine area. On the Perimeter Security side they cover intrusion into a restricted zone, loitering and after-hours zone entry. Each one answers whether a condition exists at a place and a time.

Each of those sits on the detection and classification rows of the table above. Nsightify runs on the IP and CCTV cameras a site already operates, with real-time alerts, delivered through Nsightify Cloud or a Zero Trust on-premises deployment in which video stays inside the site’s own network.

Two limits belong in the same paragraph. Nsightify is an alerting layer and does not make a site BIPA compliant; notices, releases and retention schedules are steps no product completes on a site’s behalf. And the five audit questions apply to Nsightify exactly as they apply to any other vendor. Detection quality still depends on camera placement, sightlines and lighting.

Frequently asked questions

Does video analytics violate BIPA?

Not by itself. BIPA regulates biometric identifiers — retina or iris scans, fingerprints, voiceprints, and scans of hand or face geometry — and information based on them that is used to identify someone. Analytics that detects a person, a hard hat or a forklift outputs locations and labels, not a face template. Exposure starts when a feature extracts facial geometry that can identify a person. Confirm your own position with counsel.

What is the difference between computer vision and facial recognition in BIPA?

Facial recognition is one computer vision task among many. NIST describes it as extracting a feature vector that carries identity-related information and comparing it with other vectors, while classification works from a single image without a persistent identity record. BIPA names the scan of face geometry, so a recognition feature is where the statute’s notice and written-release duties come into play.

How did SB 2979 change video surveillance liability?

SB 2979, enacted as Public Act 103-769 and effective 2 August 2024, changed how damages are counted, not what triggers the Act. Repeated collection of the same identifier from the same person by the same method is now a single violation with at most one recovery. The Seventh Circuit held on 1 April 2026 that the change applies to cases pending when it was enacted.

Can employers use AI cameras in Illinois?

Yes. Illinois does not prohibit camera analytics. BIPA requires written notice, a stated purpose and retention term, and a signed written release before a private entity collects a biometric identifier, plus a public retention and destruction schedule. Detections that never create a face template do not collect one. Features that do — face-based identification in particular — need those steps first.

---

What to put in front of legal review this week

Replace the question “is this system biometric?” with a one-page feature inventory. List every analytics product on the Illinois camera estate, mark each feature against the four operations in the table, and attach the vendor’s written answer to the five audit questions. Add the biometric time clock and any fingerprint readers at the gate while you are at it, because they are the more likely source of an existing obligation.

That page gives counsel something to rule on. It also belongs next to the stream inventory and data-flow diagram IT asks for before approving video analytics, and it answers several of the video analytics RFP questions vendors cannot bluff. Sites operating in more than one state should run the same exercise against California’s limits on where workplace cameras can go, which turn on rooms rather than templates.

If you want to see which safety conditions your existing Illinois cameras can report, talk to us about Physical Safety.