BIPA Compliance for Adtech
Tags: Regulatory, Case Studies
TL;DR
- Illinois’ BIPA imposes strict notice-and-consent rules for collecting or processing biometric identifiers and information.
- Scraping and facial recognition uses have triggered major litigation and settlements.
Why it matters for HK marketers: Any U.S. campaign or in‑store tech that infers or stores face/voice/iris data risks BIPA liability and costly remedies.
What BIPA covers
- Biometric identifiers: Retina/iris scans, fingerprints, voiceprints, scans of hand or face geometry.
- Biometric information: Any data derived from a biometric identifier.
- Requirements: Written policy, informed consent, limited retention/disclosure, and security safeguards.
Adtech risk zones
- Emotion/cognitive inference from in‑store cameras or retail beacons.
- Face/voice analytics in kiosks, experiential activations, or call recordings.
Case signal
- A 2023 class action settlement with Clearview AI addressed alleged scraping of facial images to build a face database that was then sold, highlighting BIPA’s teeth.
So what for marketers
Avoid biometric features in U.S. deployments unless you can meet BIPA’s consent and retention rules; disable face/voice analytics in retail pilots targeting Illinois users.
← Back to Knowledge Base