Illinois businesses that capture biometric data can breathe easier. In Clay v. Union Pacific Railroad Co., No. 25-2185 (7th Cir. Apr. 1, 2026), a unanimous Seventh Circuit panel held that the 2024 amendment to BIPA — capping damages at one recovery per person, rather than per scan — applies retroactively to all cases pending when the amendment was enacted on August 2, 2024. This drastically limits exposure in BIPA litigation; instead of potentially massive per-scan damages, recovery is limited to $1,000 per person for negligent violations and up to $5,000 for intentional ones.

The Clay Decision

Clay consolidated three cases certified for interlocutory appeal from the U.S. District Court for the Northern District of Illinois. In each, plaintiffs claimed their employers violated BIPA by collecting biometric data — fingerprints and hand geometry — without complying with BIPA's notice and consent requirements under subsections 15(b) and/or 15(d). Plaintiffs argued that the 2024 amendment is substantive (i.e., it changes the scope of liability) and that every instance of data collection constituted a separate, recoverable violation. The defendants countered that the amendment affects only remedies, not liability.

The Seventh Circuit unanimously agreed with the defendants and held that the 2024 amendment is a remedial, not substantive, change that applies retroactively to all cases pending when it was enacted. The court reasoned that the amendment does not alter BIPA's substantive obligations; it merely limits the available damages. 

What This Means for Illinois Businesses

The Clay decision carries immediate, practical consequences for businesses across Illinois:

1. The ruling confirms that all pending BIPA cases are subject to the per-person damages cap, not just cases filed after the amendment's effective date.
2. Class action exposure is dramatically reduced. Under the old per-scan model, a class action involving thousands of employees scanning in and out daily over several years could generate billions of dollars in potential liability. The per-person cap significantly reduces that figure.
3. Companies evaluating settlement offers based on per-scan liability calculations may need to revisit those figures in light of the new per-person framework.

A Word of Caution

While Clay is undoubtedly a significant win for businesses, it is not a reason to let one’s guard down. The decision reduces the per-case damages ceiling but does nothing to reduce the volume of BIPA claims. BIPA’s substantive requirements, providing notice, obtaining written consent, and maintaining data retention and destruction policies, remain unchanged. Companies still need a comprehensive biometric privacy framework to achieve and maintain compliance.