Plaintiffs filed 150 lawsuits under Illinois' Biometric Information Privacy Act (BIPA) in 2025, down 65% from 427 in 2024, according to Duane Morris' Class Action Review 2026, published in January 2026. That reversal followed three straight years of growth and traces to a single legislative fix that changed how damages are calculated. Below is the full year-by-year filing trend, why 2025 broke the pattern, and how much biometric privacy litigation has cost the companies on the losing end.
How many BIPA lawsuits were filed in 2025?
BIPA filings rose every year from 2022 through 2024, then fell sharply in 2025. Duane Morris' Class Action Review, an annual analysis of class action rulings across state and federal courts, counted 362 BIPA filings in 2022, 417 in 2023, 427 in 2024, and only 150 in 2025.
Figure 1: Illinois BIPA lawsuit filings by year. Source: Duane Morris Class Action Review 2026, published January 2026.
| Year | BIPA lawsuits filed |
|---|---|
| 2022 | 362 |
| 2023 | 417 |
| 2024 | 427 |
| 2025 | 150 |
Table: Year-over-year BIPA filing counts. Source: Duane Morris Class Action Review 2026.
BIPA has generated more private litigation than any other US biometric statute since it took effect in 2008, mostly because it is the only one of its kind that lets individuals sue directly rather than routing enforcement through a state attorney general. Anyone collecting fingerprints, face scans, or voiceprints from Illinois residents, whether through a time clock, a security camera, or an app, should treat the statute as active law with real litigation exposure even after the 2025 drop. That litigation risk is rising alongside adoption: the biometrics market is projected to reach $59.7 billion in 2026, so more companies are collecting the exact data category BIPA and its sister laws regulate.
Why did BIPA lawsuit filings drop so sharply?
The decline traces to Illinois Senate Bill 2979, signed into law on August 2, 2024. Before the reform, courts had interpreted BIPA to allow a separate statutory violation, and a separate damages award, each time a company scanned or disclosed the same biometric identifier from the same person. SB 2979 amended the statute so that collecting or disclosing the same biometric identifier from the same person through the same method counts as a single violation, not one per scan.
Figure 2: BIPA filings before and after the 2024 damages reform. Source: Duane Morris Class Action Review 2026.
That change mattered because BIPA's statutory damages, $1,000 per negligent violation and $5,000 per reckless or intentional violation, had made per-scan claims extraordinarily lucrative against employers using fingerprint time clocks: a company scanning the same employee's fingerprint twice a day for years could face millions of dollars in exposure from a single worker. Once courts began applying the per-person cap to cases filed after the reform, the math behind mass BIPA filings changed, and Duane Morris' 2026 review found filings fell by nearly two-thirds within a year. If you collect biometric identifiers from Illinois residents, publish a privacy policy that names biometric data as its own disclosed category rather than folding it into general "personal information" language, since BIPA's consent requirements are specific to that category and generic disclosures do not satisfy them.
How many privacy class actions were filed overall in 2025?
BIPA's decline did not mean privacy litigation slowed down generally. Duane Morris' Class Action Review 2026 counted 1,822 data-privacy class actions filed across all US state and federal courts in 2025, an 18% increase over an estimated 1,544 in 2024, works out to more than 150 filings a month and over seven filings every business day.
Figure 3: Total US data-privacy class action filings, 2024 versus 2025. Source: Duane Morris Class Action Review 2026. The 2024 figure is calculated from the review's reported 18% year-over-year growth rate.
Plaintiffs' firms did not stop filing privacy suits, they redirected them. Duane Morris' 2026 report describes a shift toward website pixel-tracking claims under state wiretapping statutes like the California Invasion of Privacy Act, alongside continued activity under the Video Privacy Protection Act, which drew 116 filings in 2024 and 137 in 2023. Biometric claims remain a smaller slice of a growing overall caseload rather than a disappearing one.
What are the largest biometric privacy settlements?
Five settlements account for most of the money paid out over biometric privacy claims to date, and the newest one dwarfs the rest. Texas Attorney General Ken Paxton finalized a $1.375 billion settlement with Google on October 31, 2025, resolving two 2022 lawsuits: one alleging deceptive tracking of geolocation and Incognito-mode browsing data, the other alleging Google collected voiceprints and facial geometry through Google Photos, Google Assistant, and Nest Hub Max in violation of the Texas Capture or Use of Biometric Identifier Act (CUBI). It is the largest state-level privacy settlement in US history, though most of that total covers non-biometric claims alongside the CUBI count.
Figure 4: Largest biometric-privacy settlements by amount. Note: the Texas v. Google total also covers geolocation and Incognito-mode claims, not biometric identifiers alone. Sources: Bracewell LLP (2025), Robbins Geller Rudman & Dowd (2021), FeganScott/BusinessWire (2021), ClassAction.org (2025).
| Settlement | Year finalized | Amount | Statute |
|---|---|---|---|
| Texas v. Google | 2025 | $1.375 billion | Texas CUBI, Texas DTPA (combined claims) |
| 2021 | $650 million | Illinois BIPA | |
| TikTok / ByteDance | 2021 | $92 million | Illinois BIPA and other privacy claims |
| Clearview AI | 2022 | $51.75 million (cash and equity) | Illinois BIPA (multidistrict litigation) |
| Motorola Solutions / Vigilant Solutions | 2025 | $47.5 million | Illinois BIPA |
| Google Workspace for Education | 2025 | $8.75 million | Illinois BIPA |
Facebook's $650 million settlement, approved in February 2021 over the Tag Suggestions facial-recognition feature, remains the largest payout tied to biometric claims alone. Two of the six settlements above, the Motorola Solutions FaceSearch case and the Google Workspace for Education case, both received final court approval in the second half of 2025, showing that BIPA litigation filed in earlier, higher-volume years is still working its way through resolution even as new filings have slowed.
Which types of claims drive the most biometric lawsuits?
Employment-related fingerprint scanning generates more BIPA litigation than any other single use case. The nonprofit Surveillance Technology Oversight Project's litigation tracker, which catalogs 182 notable BIPA cases rather than every filing ever made, found that more than 100 involve employees suing employers over fingerprint-based timekeeping systems, 51 involve facial-recognition technology, and the remainder cover uses like remote test proctoring and Clearview AI's photo-scraping database.
Figure 5: Claim-type breakdown of a curated set of notable BIPA cases, not a comprehensive filing count. Source: Surveillance Technology Oversight Project, BIPA Litigation Tracker.
Employers remain the most exposed defendant category because time-clock fingerprint scanners are common, cheap, and easy to deploy without a BIPA-compliant written consent process. Illinois has also seen a related but distinct surge under its Genetic Information Privacy Act (GIPA), which covers family medical history rather than biometric identifiers: more than 50 GIPA class actions were filed in 2023 alone, and Ford Motor Company agreed to pay $17.5 million to settle claims it collected genetic information from job applicants during pre-employment physicals.
How do biometric privacy laws differ by state?
There is no federal biometric privacy law, so exposure depends entirely on which state or city a business operates in and whether that jurisdiction's statute lets individuals sue directly. Only two of the four biometric-specific laws below give people that option.
| Law | Enacted | Private right of action | Statutory damages or penalty |
|---|---|---|---|
| Illinois BIPA | 2008 | Yes | $1,000 per negligent violation, $5,000 per reckless violation (capped at one per person since 2024) |
| Texas CUBI | 2009 | No, AG only | Up to $25,000 per violation |
| Washington H.B. 1493 | 2017 | No, AG only | Not individually specified; AG enforcement |
| New York City Local Law 3 | 2021 | Yes | $500 per negligent violation, $5,000 per intentional or reckless violation |
Illinois and New York City both allow an individual to bring a lawsuit, which is why nearly all of the litigation volume and settlement dollars covered above trace back to those two jurisdictions. Texas and Washington regulate the same underlying conduct, collecting fingerprints, face geometry, or voiceprints without consent, but route enforcement exclusively through the state attorney general, which produces occasional large actions like the Texas v. Google settlement rather than a steady stream of private class actions.
Figure 6: A quick jurisdiction test for US biometric privacy exposure. Source: PrivacyTerms.io analysis of the four state and local statutes above.
This same patchwork applies to related biometric use cases that generate far less litigation but far more day-to-day data collection, including airport facial-scanning programs and phone-based fingerprint or face unlock, both of which raise their own consent and retention questions beyond what this post covers.
The Bottom Line
BIPA filings fell 65% in a single year, but that drop reflects a change in the economics of mass litigation, not a retreat from biometric privacy enforcement. Illinois and New York City still let individuals sue directly, Texas and Washington attorneys general are still willing to pursue nine and ten-figure settlements, and the underlying conduct, collecting biometric identifiers without proper consent, remains just as regulated as before SB 2979. Businesses that scan fingerprints for time clocks, run facial-recognition features, or store voiceprints should treat 2025's lower filing count as a change in litigation strategy by plaintiffs' firms rather than a signal that biometric compliance no longer matters.
Frequently Asked Questions
How many BIPA lawsuits were filed in 2025? 150 lawsuits invoking Illinois' Biometric Information Privacy Act were filed in 2025, down 65% from 427 in 2024, according to Duane Morris' Class Action Review 2026, published in January 2026.
Why did BIPA lawsuit filings drop so much in 2025? Illinois Senate Bill 2979, signed into law on August 2, 2024, amended BIPA so that repeated collection of the same biometric identifier from the same person through the same method counts as one violation rather than one violation per scan. That change removed most of the incentive behind the high-value mass filings that drove 427 lawsuits in 2024, and filings fell to 150 in 2025, per Duane Morris' 2026 review.
What is the largest biometric privacy settlement to date? The 1.375 billion dollar settlement Texas Attorney General Ken Paxton reached with Google, finalized October 31, 2025, is the largest state-level privacy settlement in US history, though it combines biometric claims under the Texas Capture or Use of Biometric Identifier Act with separate geolocation and Incognito-mode claims. The largest settlement over biometric claims alone remains Facebook's 650 million dollar BIPA settlement, approved in February 2021.
Which states have a biometric privacy law with a private right of action? Illinois' BIPA and New York City's Local Law 3 both let individuals sue directly over biometric privacy violations. Texas' Capture or Use of Biometric Identifier Act and Washington's H.B. 1493 regulate biometric data collection but reserve enforcement exclusively for the state attorney general, so individuals cannot bring their own lawsuits under those two laws.
Where the Numbers Come From
- Duane Morris LLP. (2026). "Duane Morris Class Action Review 2026." Published January 6, 2026. 1,822 data-privacy class actions filed nationwide in 2025, up 18% year over year.
- Duane Morris LLP. (2026). "DMCAR Trend #4: The Landscape of Privacy Class Actions Continued To Shift." January 13, 2026. BIPA filing counts of 362 (2022), 417 (2023), 427 (2024), and 150 (2025).
- Legal Newsline. (2025). "Reforms Sliced BIPA Class Actions in 2025, New Report Says." Cook County Record.
- Bracewell LLP. (2025). "Google Agrees to $1.375 Billion Settlement as Texas Attorney General Continues Data Privacy Push." Settlement finalized October 31, 2025.
- Robbins Geller Rudman and Dowd LLP. (2021). "Landmark $650 Million Settlement in Facebook Biometric Class Action Approved." Approved February 26, 2021.
- FeganScott via BusinessWire. (2021). "TikTok and Parent Company ByteDance, Inc. Hit with $92 Million Settlement for Users' Privacy Issues."
- ClassAction.org. (2025). "$47.5M Motorola Solutions Settlement Resolves Class Action Lawsuit Over Alleged FaceSearch BIPA Violations." Final approval September 15, 2025.
- ClassAction.org. (2025). "$8.75M Google Settlement Resolves Class Action Lawsuit Over Alleged Chromebook Privacy Violations." Final approval October 17, 2025, covering roughly 660,000 Illinois students.
- Surveillance Technology Oversight Project (S.T.O.P.). "BIPA Litigation Tracker." A curated catalog of 182 notable BIPA cases by claim type, not a comprehensive filing count.
- Davis Wright Tremaine LLP. (2021). "New York City Biometrics Law Takes Effect in July 2021." Local Law 3 statutory damages and private right of action.
- Recording Law. (2026). "Biometric Privacy Laws by State: BIPA, CUBI and Consent." Texas CUBI and Washington H.B. 1493 enforcement structure and penalty ranges.
Note: All figures verified as of July 2026. BIPA filing counts and the 1,822 national data-privacy filing figure come from Duane Morris' Class Action Review 2026, published January 2026 and covering calendar year 2025 activity. This post will be refreshed at least twice a year to track new class-action review editions and settlement developments.
