Does AI Interview Proctoring Have to Comply With Illinois' BIPA?
TL;DR: Yes. If even one candidate you interview is physically located in Illinois and your proctoring tool captures facial geometry (for ID-to-selfie matching) or a voiceprint, the Illinois Biometric Information Privacy Act (BIPA) applies. BIPA requires written, informed consent before collection, a published retention/destruction schedule, and it gives candidates a private right of action — they can sue you directly. A 2024 amendment (Public Act 103-769) caps statutory damages per person rather than per scan, which reduced runaway exposure, but consent and disclosure obligations are unchanged.
The claim
Any employer that uses facial recognition or voice biometrics on an Illinois-based candidate — including a candidate calling in from Illinois for a remote interview with an out-of-state company — falls under BIPA. This includes AI interview proctoring's core identity layer: matching a selfie to a government ID and running continuous face verification through the call.
The evidence
BIPA (740 ILCS 14) has been Illinois law since 2008, but litigation exploded after Rosenbach v. Six Flags (2019) held that plaintiffs don't need to prove actual harm — a bare statutory violation is enough to sue. That ruling turned BIPA into the most litigated biometric privacy law in the U.S. Facebook settled a BIPA class action for $650 million in 2021 over photo-tagging facial recognition; Clearview AI, TikTok, and Google have all faced BIPA suits.
For years, courts read BIPA as allowing damages to accrue per scan — meaning a company that face-scanned a worker every day for two years could theoretically face thousands of separate violations from one person. In August 2024, Illinois passed Public Act 103-769, clarifying that a company can only be liable for one negligent violation and one intentional/reckless violation per person, per method of collection — regardless of how many times the biometric data was collected. The Seventh Circuit later confirmed this amendment applies retroactively. That materially lowered catastrophic exposure but didn't touch the underlying requirement: get consent first.
BIPA requirements at a glance
| Requirement | What it means for interview proctoring |
|---|---|
| Written notice | Tell the candidate, before the interview, that facial/voice biometrics will be collected and why |
| Written consent | Get an affirmative opt-in (checkbox + signature or clickwrap) — silence or a general terms-of-service link isn't enough |
| Retention policy | Publish a written schedule for how long biometric data is kept and when it's destroyed |
| No sale of data | Biometric identifiers can never be sold, leased, or traded |
| Reasonable security | Store and transmit biometric data with the same care as other sensitive PII |
| Statutory damages (post-2024) | $1,000 per negligent violation, $5,000 per intentional/reckless violation — capped once per person per method, not per scan |
Step-by-step: staying BIPA-compliant with interview proctoring
- Identify Illinois exposure. Flag any req where candidates may be Illinois residents or dialing in from Illinois — remote roles make this nearly every req.
- Get consent before the session starts, not buried in an offer letter. A short, plain-language screen ("This interview uses AI proctoring that verifies your identity using facial recognition. By continuing, you consent.") satisfies the notice-and-consent requirement if the candidate has to actively click through.
- Publish a retention schedule. Neuroxa's trust reports and session recordings should have a defined deletion window — document it and give candidates the number if asked.
- Confirm your vendor's data handling. Ask any proctoring vendor for their BIPA compliance posture in writing, including whether they act as a "private entity in possession of" biometric data (which triggers direct BIPA obligations for the vendor too).
- Train recruiters to never skip the consent screen to "save time" — a single unconsented scan is enough to trigger a claim under the current law.
FAQ
Does BIPA apply if my company isn't based in Illinois? Yes. BIPA applies based on where the person whose biometrics were collected is located, not where the employer is headquartered.
Does typing a password or using a webcam without face-matching count as "biometric"? No. BIPA covers biometric identifiers — scans of face or voice geometry used for identification — not general video recording. A proctoring tool that only records video without deriving a facial geometry template is a different legal analysis (though still subject to general recording consent laws in two-party-consent states).
Can I use blanket consent in an offer letter instead of a per-interview prompt? Courts have generally required consent to be specific and informed at the time of collection — a buried clause in an unrelated document is legally risky. Get consent at the point of the interview.
Do other states have laws like BIPA? Yes — Texas (CUBI) and Washington have biometric privacy statutes, though neither currently offers a private right of action as broad as Illinois'. California's CCPA also treats biometric data as sensitive personal information requiring disclosure.
Does this mean I should avoid facial verification in proctoring altogether? No — identity verification is the strongest defense against proxy interviewees and deepfakes, and BIPA doesn't ban it. It just requires you to ask first and be transparent about retention, which most compliant AI proctoring vendors, including Neuroxa, are built to support.
By Pinal Dave Last updated: August 4, 2026