BIPA reforms edge lawsuits down, shift plaintiffs’ targets

Editor's note: This is the first in a series of stories discussing the legal landscape surrounding the Illinois Biometric Information Privacy Act in the wake of the 2024 BIPA law reform. In coming stories, The Record will discuss the continuing big-money court fight over how to interpret BIPA and the challenges posed by the law on Illinois' push to attract new tech development and infrastructure.

CHICAGO - The Chicago Cubs have joined a different and growing league among businesses operating in Illinois:

The targets of class action lawsuits filed under the state's unique and stringent biometrics privacy law.

The new lawsuits, while not unique, however, could signal a key shift in how year-old reforms to that law may be shifting the legal landscape surrounding the law commonly known as BIPA.

In coming months, Chicago's popular Major League Baseball club owned by the Ricketts family billionaires will be forced to defend itself in court against at least three lawsuits. All of the lawsuits - two filed in Chicago federal court and the third in state court in Cook County - accuse the Cubs and some of the contractors they have hired to provide security at Wrigley Field of allegedly improperly scanning the faces of people attending games at the Friendly Confines.

The Cubs have denied the claims, telling Crain's Chicago Business that the Cubs "do not use this technology" at Wrigley Field and the claims in the lawsuits are "false." The Cubs said the franchise will "vigorously defend ourselves against these claims."

However, while the fate of those lawsuits - and of the Cubs' ability to escape a potential jam in court - remains to be decided, the legal actions demonstrate how trial lawyers may begin adapting their years-long controversial quest for big paydays under Illinois' Biometric Information Privacy Act (BIPA).

Just over a year ago, Illinois Democratic state lawmakers and Gov. JB Pritzker delivered a rare loss for trial lawyers in Illinois' state capitol, limiting trial lawyers' ability to demand massive statutory damages from businesses hit with lawsuits under the BIPA law.

Since 2015, a growing number of trial lawyers have used the BIPA law to lodge thousands of class action lawsuits against employers and other businesses.

Some of the lawsuits have famously resulted in high profile settlements worth hundreds of millions of dollars from tech giants, like Google and Facebook- and Instagram-parent company Meta.

To this point, the overwhelming bulk of BIPA lawsuits have come down on Illinois employers of all sizes and types. Those lawsuits have typically accused such employers of violating the law by scanning workers' fingerprints, voices, faces and other so-called biometric identifiers, without first obtaining written consent or providing notices about how that information might be stored, used, shared and ultimately destroyed.

Typically, such lawsuits have claimed employers improperly required workers to scan fingerprints to verify their identities when punching in and out of work shifts or to access secure or sensitive areas in a workplace, or to monitor workers' actions while on the job to ensure workplace and public safety.

To coerce compliance, the law gave plaintiffs the so-called right of private action, allowing them to sue businesses accused of violating the BIPA law. Those sued can face potentially steep payment demands of $1,000-$5,000 per violation.

Under Illinois Supreme Court rulings, the law was interpreted broadly, as plaintiffs could bring their lawsuits against businesses without showing they were ever actually harmed, and they could demand payment for each and every allegedly illegal biometric scan.

When multiplied across entire workforces, for instance, with each worker scanning a fingerprint multiple times per day, damages under this interpretation could quickly climb up to what even the Illinois Supreme Court called "annihilative damages" of many millions or even billions of dollars.

After years of calls for reform from the business community, Illinois Democrats took action in the spring of 2024 to rein in those potential payouts, revising BIPA to explicitly remove the potential for "per scan" damages and instead limiting the claims basically to $1,000 to $5,000 per alleged victim.

While business leaders had hoped for more substantial reforms, they still welcomed the change, which they also hoped could help to slow the flood of BIPA lawsuits, particularly against employers.

Preliminary data appears to show the reforms have accomplished some of those goals.

According to information supplied by the defense law firm of Duane Morris, which tracks such privacy litigation trends, 107 BIPA lawsuits were filed in Illinois courts through September 2025.

It is not yet known what the actual annual total may be for 2025. But at this point, the total projects to be significantly reduced from 2024, when 427 BIPA lawsuits were filed, according Duane Morris' data.

That number had represented yet another year-over-year increase, as had generally been seen each year since 2017. That year, just 57 BIPA lawsuits were filed, according to Duane Morris' data.

However, in 2019, 321 BIPA lawsuits were filed, and generally increased each year since.

To this point, reports say those lawsuits have largely allowed trial lawyers to claim hundreds of millions of dollars in legal fees through settlements from businesses seeking to avoid even worse potential payouts under a legal standard that doesn't require plaintiffs to prove anyone was actually harmed.

According to Duane Morris, 2022 marked the highest year for BIPA settlements, with payments totaling more than $252 million. However, BIPA settlements remained costly for businesses in 2023 and 2024, with settlements totaling $131.5 million and $139.1 million in those years, respectively.

Through September, businesses had agreed to pay $75.6 million in settlements to resolve BIPA cases, according to Duane Morris.

Prominent class action defense attorney Gerald Maatman, of the Duane Morris firm, said he believes the reforms have played a role in edging down BIPA lawsuit filings, generally.

"My sense is that the law has had an impact and has reduced the volume of BIPA cases," Maatman said in an email response to questions from The Record.

However, he and others said they believe the reforms have primarily led to plaintiffs' lawyers to recalibrate as they seek to find ways to continue to use the BIPA law to bring claims for potentially large damages.

John Ochoa, a defense attorney from the Chicago firm of Amundsen Davis, agreed the BIPA reforms have changed the game.

But Ochoa said the biggest difference is likely to come in the impact of the law on smaller employers and businesses.

Under the law's prior interpretation, trial lawyers could use BIPA to potentially seek big payouts even from modest employers, using the per scan multiplier.

Now, those lawsuits are likely to be significantly less profitable.

"In some ways, these lawsuits are really only slowing down because they are running out of people to sue," Ochoa said. "So now they're looking for new avenues of BIPA cases to fill."

Ochoa said the BIPA landscape has long been fluid, with changes coming "in waves."

For years, the lawsuits primarily targeted employers and others over fingerprint scans, particularly employers using biometric timeclocks to track employee work hours.

However, through the years, the lawsuits have adopted other targets, including claims against employers and other companies for allegedly improperly recording people's "voice prints."

And most recently, plaintiffs' lawyers have taken aim at face scans. Some lawsuits have targeted trucking companies who use cameras to monitor their drivers while in the cab of the truck and other lawsuits have targeted retailers like Target and Home Depot for allegedly improperly using facial recognition tech to scan customers' faces in the name of combating shoplifting and increase security.

Similar claims have now also engulfed the Chicago Cubs over allegedly similar crowd monitoring systems in place at Wrigley Field, again to increase security and reduce threats facing fans and Cubs employees alike at the ballpark.

Ochoa and Maatman said such filings could indicate trial lawyers are shifting strategies away from most employers to instead home in on bigger, richer and more high profile targets.

While the task of suing such large, potentially sophisticated targets may prove more difficult, the chance of extracting an ultimate big payday - or even a relatively quick settlement with so-called "go away money" - could prove too rich to pass up, particularly with most smaller targets taken off the field by the 2024 BIPA reforms.

The Cubs, for instance, welcome nearly 3 million fans into Wrigley Field each year for their 81 home games. While many of those attend multiple games per year, the potential for damages under the new BIPA lawsuits could still quickly multiply into a big payout by the Cubs and a big payday by plaintiffs' lawyers.

Those lawyers typically claim about one-third of all settlement funds as legal fees.

Ochoa said the lawsuit against the Cubs should serve as a warning for other potential lawsuit targets who may use facial recognition cameras.

"There's a lot of potential exposure, and in Illinois, it should be a concern," Ochoa said. "If the Cubs can get sued, it's just a matter of time before others get sued, too."

Maatman and Ochoa also warned BIPA could still be used to bring big damages claims against other businesses, should their websites in some way scan customers' faces or otherwise utilize biometrics.

"The change in the law has resulted in BIPA class actions targeting larger employers or organizations (e.g., operators of websites) where the class size numbers over 1,000 or more class members," Maatman said. "Hence, bigger cases still present the potential for significant recoveries for plaintiffs’ class action lawyers; smaller cases are less attractive from a financial metrics perspective."

Ochoa added the potential for such e-commerce-based lawsuits could further ensnare companies from throughout the U.S., otherwise based far from Illinois.

"Plaintiffs' attorneys always get more creative," Ochoa said. "We know that."