Biometric Privacy

State of play.

• The Seventh Circuit has structurally reset BIPA damages exposure. In Clay v. Union Pacific Railroad Co., the court unanimously held that Illinois's 2024 per-person damages cap applies retroactively to all pending cases, eliminating the per-scan multiplier that had generated billion-dollar class exposure .
• Voiceprint collection via AI phone systems is now the leading BIPA frontier. The Walmart voiceprint class action filed in the Northern District of Illinois tests whether routine customer service calls trigger the same written-consent and disclosure requirements as facial recognition and workplace scanning—extending BIPA's reach into every enterprise that deploys voice-analysis AI for fraud prevention or caller identification .
• Connecticut has enacted the most expansive state biometric and privacy regime outside Illinois, with its July 1, 2026 CTDPA amendments lowering applicability thresholds to 35,000 residents—or a single resident's sensitive data—and explicitly covering biometric inferences, neural data, and algorithmic profiling .
• Smart glasses are producing a dual-liability gap in workplace policy, with state eavesdropping and BIPA statutes applying to wearable AI devices that most employers have not addressed in existing technology policies, and New York having barred them from state courtrooms .
• For counsel advising employers and consumer-facing enterprises, the practical baseline is: BIPA's damages architecture has shifted but its consent and notice obligations remain fully live, voiceprint collection is the next high-volume exposure vector, and Connecticut's expanded regime requires immediate compliance re-audit for any business touching Connecticut residents' data.

Where things stand.

• BIPA's damages architecture has shifted from per-scan to per-person. The Seventh Circuit's Clay decision classifies the 2024 amendment (P.A. 103-0769) as procedural and remedial—making it retroactive to all pending federal cases. Section 15 compliance obligations (notice, consent, data handling) remain intact; only Section 20 damages are capped .
• The Seventh Circuit's ruling binds federal courts in Illinois, Indiana, and Wisconsin but does not bind Illinois state courts. State court BIPA litigation may reach different retroactivity conclusions, preserving a forum-selection variable for plaintiffs .
• Voiceprint collection via AI phone systems is the emerging BIPA expansion vector. The Walmart complaint alleges AI systems isolated vocal characteristics and created mathematical templates from customer service calls without written consent—a theory that, if sustained, applies to any enterprise using voice-analysis AI for caller identification or fraud prevention .
• Connecticut now ranks among the nation's strictest privacy regimes. The July 1, 2026 CTDPA amendments cover biometric inferences, neural data, financial account information, and government-issued IDs as sensitive data; data broker registration begins January 1, 2027; profiling impact assessments apply to processing activities created after August 1, 2026 .
• Smart glasses are creating a systemic workplace policy gap. Meta Ray-Bans and similar devices enable silent continuous recording and facial recognition without visible cues—capabilities that existing cell phone policies do not address. Illinois BIPA and the Eavesdropping Act create strict liability; New York has barred smart glasses from state courtrooms; the NLRB has cautioned against blanket bans that could infringe on NLRA-protected activity .
• Biometric privacy defense has become a specialized platform-litigation discipline. The volume and complexity of class actions under BIPA, the federal Wiretap Act, CIPA, and the Video Privacy Protection Act are driving demand for dedicated defense counsel at major firms (→ Rising Star: Mayer Brown's Sophie Mancall-Bitel).
• AI training data pipelines are a distinct and growing biometric exposure vector. The Mercor litigation tests whether data brokers supplying AI companies can collect and share facial biometric data from contractors without adequate consent, and what downstream liability attaches to AI firms that receive that data .
• Government biometric surveillance is expanding through commercial data broker purchases, exploiting a legal gap in which consent-based loopholes in user agreements allow DHS and FBI to acquire biometric records without warrants .
• Biometric verification is now a law enforcement tool in professional licensing fraud prosecutions. Florida's prosecution of a proxy-testing scheme used palm-vein biometric analysis to identify a defendant who evaded detection through disguise across multiple exam sites—signaling that regulators and prosecutors will push for mandatory biometric verification in high-stakes credentialing contexts .

Latest developments.

• Walmart sued in the Northern District of Illinois for allegedly converting customer service callers' voices into biometric voiceprints via AI without written consent, extending BIPA's reach to routine phone interactions .
• Connecticut's CTDPA amendments took effect July 1, 2026, lowering the applicability threshold to 35,000 residents (or any single resident's sensitive data), adding biometric inferences and neural data as sensitive categories, and imposing new LLM-training disclosure requirements .
• Smart glasses entering workplaces at scale, with employment attorneys warning of dual liability under state eavesdropping and biometric statutes; New York barred smart glasses from state courtrooms effective July 20, 2026 .
• Seventh Circuit unanimously holds that the 2024 BIPA damages amendment applies retroactively to pending cases, capping statutory damages at one award per biometric identifier per collection method .
• Florida AG prosecution of proxy-testing scheme used palm-vein biometric analysis to identify defendant across multiple exam sites, signaling regulatory pressure for mandatory biometric verification in professional credentialing .
• Law360 Pulse names Mayer Brown's Sophie Mancall-Bitel a 2026 Rising Star for defense of TikTok, Google, and YouTube in biometric privacy and wiretapping class actions, reflecting the scale of platform-side defense demand (→ Rising Star: Mayer Brown's Sophie Mancall-Bitel).

Active questions and open splits.

• Federal court vs. Illinois state court retroactivity. The Seventh Circuit's Clay ruling binds federal courts but not Illinois state courts, which may treat the 2024 damages cap as prospective only—creating a live forum-selection question for plaintiffs' counsel and a split-track risk for defendants with cases in both venues .
• Whether voice-analysis AI for customer service triggers BIPA's written-consent requirement. The Walmart litigation will test whether AI systems that isolate vocal characteristics and generate mathematical templates from phone calls constitute biometric data collection under BIPA—a ruling with enterprise-wide implications for any company using voice AI for fraud prevention or caller identification .
• Class certification viability under the per-person damages cap. With per-scan multipliers eliminated, amount-in-controversy thresholds and class action economics are materially altered—whether courts will decertify pending classes or plaintiffs will restructure claims remains unresolved .
• Smart glasses and bystander consent. Whether product terms of service satisfy disclosure obligations to third parties filmed without knowledge, and whether existing cell phone and recording policies extend to wearable AI devices, is unsettled across jurisdictions—with the NLRB constraint on blanket bans adding a further compliance variable for employers .
• Connecticut "sensitive data" scope and "surveillance pricing" definition. The CTDPA amendments introduce categories—biometric inferences, neural data, algorithmic profiling—whose precise scope courts have not yet interpreted, and the prohibition on "surveillance pricing" lacks settled definitional boundaries as enforcement begins .
• AI training data as biometric collection triggering BIPA and analogues. The Mercor litigation tests whether facial biometric data collected through contractor monitoring software and shared with AI model developers constitutes a BIPA-cognizable collection—and what downstream liability attaches to the AI firms receiving it .
• Commercial data broker sales to government as Fourth Amendment workaround. DHS's biometric data purchases from brokers exploit a consent-loophole gap that no court has definitively closed—whether Carpenter v. United States extends to biometric broker purchases remains unresolved .

What to watch.

• Whether Illinois state courts follow the Seventh Circuit's retroactivity holding in Clay or treat the 2024 damages cap as prospective—a split would create parallel litigation tracks with divergent settlement economics.
• Early motions practice in the Walmart voiceprint case—particularly whether the court accepts that AI-generated mathematical voice templates constitute biometric identifiers under BIPA's statutory definition.
• Whether Connecticut's AG initiates enforcement actions under the expanded CTDPA, particularly against businesses that cleared the prior 100,000-resident threshold but fall within the new 35,000-resident trigger.
• Whether additional states follow New York in banning smart glasses from courtrooms or enact wearable-specific biometric disclosure requirements, and whether any employer faces the first BIPA or eavesdropping prosecution arising from employee smart-glass use.
• Discovery in the Mercor class actions for what contractual language governed biometric data sharing with AI developers, and whether AI firms face direct liability as downstream recipients.
• Whether the Florida proxy-testing prosecution prompts Pearson VUE or other credentialing bodies to mandate palm-vein or facial biometric verification—and whether states enact regulations requiring it—creating a new consent-and-collection compliance obligation for testing administrators.