Only 1 of the 20 comprehensive US state privacy laws currently on the books, California's CCPA, gives consumers any right to sue a business directly, and even that right is limited to data breaches. Illinois's Biometric Information Privacy Act, a narrower sector-specific statute rather than a comprehensive privacy law, is the real outlier: it allows any aggrieved person to sue over a biometric-data violation with no comparable scope limit, and it has generated some of the largest privacy settlements in US history.
Which state privacy laws actually let a consumer sue?
CCPA's private right of action under Cal. Civ. Code 1798.150 applies only when a business fails to implement reasonable security and a consumer's unencrypted personal information is stolen or disclosed as a result. It does not cover most other CCPA violations, such as ignoring an opt-out request or publishing a stale privacy policy; those are enforced by the California Attorney General and the California Privacy Protection Agency, not by consumer lawsuits. Every other comprehensive state privacy law passed since CCPA, all 19 of them, denies a private right of action outright.
Figure 1: Almost every path leads to AG-only enforcement. Source: California Civil Code 1798.150, Illinois 740 ILCS 14, state AG enforcement pages.
How broad is BIPA's private right of action compared to CCPA's?
BIPA lets any person sue over the unauthorized collection, storage, or disclosure of a biometric identifier, such as a fingerprint or face scan, with no requirement to show a data breach or even a security failure. Damages are $1,000 per negligent violation and $5,000 per intentional or reckless violation, plus attorney's fees. CCPA's private right of action, by contrast, only exists for a narrow data-breach scenario and caps damages at $750 per consumer per incident.
Figure 2: BIPA's per-violation ceiling is more than six times CCPA's per-incident ceiling. Source: Cal. Civ. Code 1798.150, 740 ILCS 14/20.
For the states that instead rely entirely on Attorney General enforcement, our tally of state AG privacy actions shows what that enforcement has actually looked like in practice.
How much have BIPA lawsuits actually paid out?
Three settlements alone total more than $842 million: Facebook's $650 million settlement, approved February 2021, over its Tag Suggestions facial-recognition feature; Google's $100 million settlement, approved September 2022, over face-grouping in Google Photos; and TikTok's $92 million settlement, approved August 2022, over facial and body-feature data collected from user videos. All three were resolved as Illinois-only class actions because BIPA has no comprehensive-law equivalent anywhere else.
Figure 3: Facebook's settlement alone accounts for 77% of these three cases' combined total. Source: In re Facebook Biometric Info. Privacy Litig., Rivera v. Google LLC, In re TikTok Consumer Privacy Litig.
A privacy policy generator that flags when biometric or sensitive data categories require separate consent language is one of the more direct ways a site collecting any kind of scan or photo data can reduce this exposure before a claim is even filed.
What changed after Cothron v. White Castle?
The Illinois Supreme Court ruled in February 2023 that a BIPA claim accrues every time biometric data is collected or transmitted, not just the first time, meaning an employer scanning a worker's fingerprint daily could face thousands of separate claims from one employee. The Illinois legislature responded with Senate Bill 2979, signed August 2, 2024, which limits future violations to one claim per person per collection method rather than one claim per scan, though the amendment's application to cases already filed has itself been separately litigated.
Figure 4: Illinois has both created and later narrowed the country's broadest privacy private right of action. Source: 740 ILCS 14, Illinois Supreme Court, Illinois General Assembly SB 2979.
How does the private right of action compare state by state?
| State | Law | Private right of action | Cure period before AG action |
|---|---|---|---|
| California | CCPA | Yes, data breach only ($100-750/incident) | Discretionary since 2023 |
| Illinois | BIPA (sector-specific) | Yes, broad ($1,000-5,000/violation) | None |
| Virginia | VCDPA | No | 30 days |
| Colorado | CPA | No | 60 days |
| Connecticut | CTDPA | No | 60 days |
| Texas | TDPSA | No | 30 days |
Source: State statutes and AG enforcement guidance, as summarized by IAPP and Koley Jessen's state privacy law comparisons.
The Bottom Line
The state privacy law landscape has settled into a consistent pattern: every comprehensive law passed after CCPA has deliberately excluded a private right of action, leaving enforcement to a single Attorney General's office with a cure period built in. That makes CCPA's narrow data-breach right and BIPA's broad biometric right the exceptions, not the rule, and BIPA in particular remains the single largest source of nine-figure privacy settlements in the country specifically because it has no comprehensive-law-style limits on who can sue or what counts as a violation. A business handling biometric data anywhere, or Illinois residents' data specifically, carries meaningfully higher private litigation exposure than the same practices would create in any of the other 19 states.
Frequently Asked Questions
Which state privacy laws let consumers sue directly? Only California's CCPA among the 20 comprehensive state privacy laws, and only for data breaches, with statutory damages of $100 to $750 per consumer per incident under Cal. Civ. Code 1798.150. Illinois's BIPA, a narrower sector-specific biometric law rather than a comprehensive privacy statute, allows a much broader private right of action.
How much have BIPA lawsuits paid out in settlements? More than $842 million in disclosed class-action settlements from three cases alone: Facebook's $650 million settlement (2021), Google's $100 million settlement (2022), and TikTok's $92 million settlement (2022), all resolved under the Illinois Biometric Information Privacy Act.
Do Virginia, Colorado, and Connecticut let consumers sue over privacy violations? No. All three explicitly bar a private right of action and give enforcement exclusively to the state Attorney General, with cure periods of 30 days in Virginia and 60 days in both Colorado and Connecticut before the AG can bring an action.
What did the Cothron v. White Castle ruling change about BIPA damages? The Illinois Supreme Court ruled in February 2023 that a BIPA claim accrues each time biometric data is scanned or transmitted, not just once per person, dramatically raising potential damages. The Illinois legislature capped this in August 2024, limiting future violations to one claim per person per collection method.
Where the Numbers Come From
- California Civil Code. Section 1798.150. Private right of action, statutory damages $100 to $750 per consumer per incident, 30-day cure notice requirement.
- Lexology. "A Closer Look at the CCPA's Private Right of Action and Statutory Damages."
- Robbins Geller Rudman & Dowd. (2021). "Landmark $650 Million Settlement in Facebook Biometric Class Action Approved." Approved February 26, 2021.
- Bursor & Fisher. (2022). "$100 Million Google Photos Settlement Approved." Rivera v. Google LLC, approved September 28, 2022.
- IAPP. TikTok $92 million BIPA settlement, final approval August 22, 2022, cited alongside Facebook settlement context.
- WilmerHale. (2025). "Year in Review: 2024 BIPA Litigation Takeaways." Covers Cothron v. White Castle and the August 2024 damages amendment.
- Davis Wright Tremaine. (2024). "Illinois BIPA Biometrics Law Amended for Damages." Senate Bill 2979 signed August 2, 2024.
- Koley Jessen. State-by-state comparison of private right of action and cure period provisions across VCDPA, CPA, and CTDPA.
Note: All figures verified as of September 2026. BIPA settlement totals count only the three largest disclosed class-action settlements; smaller BIPA settlements (Clearview AI and others) are not included in the $842 million figure. This tally is refreshed as new state privacy laws and settlements are announced.
