Navigating the Financial-Institution Exemption under the Illinois Biometric Information Privacy Act

The Illinois Biometric Information Privacy Act (“BIPA” or “the Act”) is one of the most restrictive biometric privacy laws in the United States. Consumers have obtained over $800 million in BIPA settlements from Meta, Google, and TikTok alone.¹ However, a recent decision from the U.S. Court of Appeals for the Third Circuit, and another pending in the U.S. Court of Appeals for the Seventh Circuit, shed light on how much leeway the Act may give to defendants facing BIPA lawsuits under its so-called “financial-institution” exemption.

This article provides background on BIPA’s enforcement, including recent developments in how courts interpret its financial-institution exemption. Further, it provides insights on potential litigation risks for companies handling individual biometric data or working with business partners who do so.

I. BIPA is enacted in 2008, and an explosion of litigation follows.

The Illinois legislature enacted BIPA to protect consumer privacy by regulating the collection and use of biometric data.² Biometric data is information that describes and classifies certain human biological, physical, or behavioral characteristics, such as fingerprints and facial recognition. Its use is ubiquitous in modern society. Billions of consumers worldwide rely on the convenience of biometric data. The appeal is unsurprising: placing your thumb on a screen is faster and easier than entering a complex password. But with convenience comes heightened risk. Unlike passwords or social security numbers, biometric data is effectively immutable; a social security number can be changed, a fingerprint cannot. As a result, a data breach affecting consumer biometric information creates a substantial risk of identity theft.³

BIPA obligates private entities that collect or use biometric data to adopt a public retention-and-destruction policy, obtain informed written consent before collecting biometric identifiers, protect data using reasonable security measures, and take other actions to safeguard biometric data.⁴ Further, it bars entities from selling, profiting from, or disclosing biometric data without informed consent or a statutory exemption.⁵ BIPA allows recovery of $1,000 per negligent violation and $5,000 per reckless or intentional violation.⁶

Before BIPA was amended in 2024, Illinois courts considered each instance of biometric data collection or use as an independent violation under the Act.⁷ This exposed defendants to hundreds of billions of dollars in damages, particularly through class actions.⁸ In 2021, TikTok’s parent company, ByteDance, settled a BIPA class action for $92 million, based on its use of face and voice data through the TikTok app.⁹ In 2022, Google settled an Illinois BIPA class action for $100 million in connection with its use of facial recognition technology recognition without express consent.¹⁰

II. In 2024, the BIPA tide turns toward defendants.

In 2024, the Illinois legislature, by amendment,¹¹ and the Illinois Supreme Court, in Mosby v. Ingalls Memorial Hospital,¹² reined in BIPA’s exceedingly plaintiff-friendly apparatus.¹³ The amendment limited damages under BIPA to one violation per person,¹⁴ and Mosby declined to extend BIPA’s protections to patients and healthcare workers whose information is governed under HIPAA.¹⁵

Most recently, McGoveran v. Amazon Web Services,¹⁶ a May 2026 decision from the U.S. Court of Appeals for the Third Circuit, suggests that another defendant-friendly shift under BIPA is on the horizon.

III. Recent developments under BIPA’s financial-institution exemption create uncertainty and risk for defendants outside the financial industry.

a. BIPA Section 25(c): the financial-institution exemption.

Under Section 25(c) of BIPA, financial institutions subject to Title V of the federal Gramm-Leach-Bliley Act of 1999 (the “GLBA”) are exempt from BIPA liability.¹⁷ The GLBA, like BIPA, obligates financial institutions to protect their customers’ privacy and nonpublic personal information.¹⁸ The GLBA defines “financial institution” as “any institution the business of which is engaging in financial activities as described in section 4(k) of the Bank Holding Company Act of 1956 [12 USCS § 1843(k)].”¹⁹ In turn, the Bank Holding Company Act recognizes several activities that are “financial in nature,” including lending, exchanging, insuring, and dealing in securities,²⁰ providing financial, investment, or economic advisory services,²¹ and engaging in any activity that the Federal Reserve Board determines is “closely related to banking or managing or controlling banks.”²²

b. Defendants face mixed results when moving to dismiss BIPA claims under Section 25(c) at the pleadings stage.

BIPA’s financial-institution exemption was first examined by the U.S. District Court for the Southern District of Illinois in the 2020 case, Stauffer v. Innovative Heights Fairview Heights, LLC.²³ In Stauffer, an employee sued her employer, Innovative Heights, for collecting, storing, and using employee fingerprint data in violation of BIPA.²⁴ During discovery, the employee learned that another company, Pathfinder, controlled and operated the system containing employees fingerprint data.²⁵ The employee then amended her complaint to assert a BIPA claim against Pathfinder. Pathfinder moved to dismiss the BIPA claim on several grounds, including Section 25(c)’s financial-institution exemption. The Court declined to conclude at the motion-to-dismiss stage that Pathfinder is a financial institution exempt under BIPA.²⁶ In denying Pathfinder’s motion, the Court explained that Pathfinder described itself as a “leader in the entertainment software industry,” not a financial institution, and did not engage in the type of activities that would subject it to the GLBA.²⁷

In a BIPA suit before the U.S. District Court for the Northern District of Illinois, defendant Northwestern University claimed it was exempt under BIPA’s financial-institution exemption.²⁸ As in Stauffer, the Court’s decision turned on whether the defendant’s activities were financial in nature.²⁹ Citing the Federal Trade Commission’s GLBA Privacy of Consumer Financial Information Rule, which recognizes colleges and universities as financial institutions if they “appear to be significantly engaged in lending funds to consumers[,]”³⁰ GLBA’s “broad definition”³¹ of financial institution, and publicly available documents confirming that Northwestern is significantly engaged in lending funds to consumers,³² the Court concluded that Northwestern is exempt from BIPA under section 25(c).³³

c. The Third Circuit upholds dismissal of BIPA claims against a technology company at the pleading stage, based on the Act’s financial-institution exemption.

In McGoveran, Illinois consumers filed a putative class action under BIPA against John Hancock in the Circuit Court for the Third Judicial Circuit in Madison County, Illinois.³⁴ Consumers alleged that when they called John Hancock, a financial services company, about their retirement accounts, their calls were routed through Amazon Connect, which employed Pindrop Security, Inc. (“Pindrop”) to authenticate callers using voiceprints without obtaining consent.³⁵ After an arduous procedural journey,³⁶ the plaintiffs filed a similar suit in the U.S. District Court for the District of Delaware.³⁷ The Court dismissed the BIPA claim against Pindrop, citing the financial-institution exemption.³⁸

The consumers appealed to the U.S. Court of Appeals for the Third Circuit, which upheld the district court’s dismissal of the BIPA claim against Pindrop based on the financial-institution exemption.³⁹ As in Doe v. Northwestern University,⁴⁰ where the Chicago federal district court relied in part on a Federal Trade Commission rule to conclude Northwestern is a financial institution,⁴¹ in McGoveran, the Third Circuit cited a Federal Reserve Board regulation,⁴² which provides that “authenticating the identity of persons conducting financial and nonfinancial transactions” is an activity “so closely related to banking as to be a proper incident thereto.”⁴³

The Third Circuit’s ruling is the most recent indication that BIPA’s financial-institution exemption may extend beyond traditional financial institutions like banks and insurance companies to entities outside the financial industry. McGoveran reflects that defendants can obtain dismissal of BIPA actions under the financial institution-exemption at the pleadings stage. Dismissal before discovery can spare businesses significant costs. However, the Third Circuit does not have the final say on the scope of BIPA’s financial-institution exemption. Businesses should be mindful that Illinois courts may decline to expand Section 25(c) beyond the GLBA’s traditional domain.

d. The Seventh Circuit may weigh in on the scope of BIPA’s financial institution-exemption later this summer.

The Seventh Circuit is considering the scope of BIPA’s financial-institution exemption in Cisneros v. Nuance Communications, Inc.⁴⁴ Like McGoveran, Cisneros concerns whether the defendant, an authentication provider that provides customer identity verification to Charles Schwab, is exempt under Section 25(c).⁴⁵ The U.S. District Court for the Northern District of Illinois held that the authenticator is exempt under BIPA because its services are used to authenticate consumers engaged in financial transactions.⁴⁶

IV. Prepare for Compliance

At this time, companies that do not fit the GLBA’s traditional definition of financial institution will continue to face litigation risk under BIPA. Illinois courts may decide to construe the financial-institution exemption narrowly to promote BIPA compliance. In light of the uncertainty around the exemption’s reach, businesses outside the financial industry should monitor developments in this area of law and examine their biometric data practices.

Even traditional financial institutions—such as banks, brokerage firms, and credit unions—should remain attentive to BIPA’s requirements and engage external business partners on how they collect, use, and safeguard biometric data. Litigation against an external business partner, such as an authentication service provider, may nevertheless expose your company to significant operational, financial, and reputational risks under BIPA.

V. How Dorsey Can Help

Dorsey has an experienced team dedicated to advising companies working with biometric data. Please contact Jose Lopez and Noor Hasan to discuss how Dorsey can help your company navigate compliance and litigation risk under BIPA and its evolving landscape.