On April 1, 2026, the Seventh Circuit reversed three district court decisions and held that the Illinois legislature’s 2024 amendment to the Biometric Information Privacy Act (BIPA)—which limits plaintiffs to a single recovery of statutory damages per person, per method of collection—applies retroactively to all cases pending when the amendment took effect. The decision in Clay v. Union Pacific Railroad Co. resolves a question with billions of dollars in consequences for Illinois employers.
District courts had unanimously held that the amendment was substantive and applied only prospectively, leaving employers exposed to potentially thousands of per-scan damages claims per plaintiff. The Seventh Circuit rejected that consensus. The court held that the amendment is a remedial change that modifies available damages without altering BIPA’s substantive liability standards, and that under longstanding Illinois law, remedial changes apply retroactively.
The Decision
The case traces back to the Illinois Supreme Court’s 2023 decision in Cothron v. White Castle System, Inc., which held that BIPA claims accrue each time a private entity collects or transmits biometric data without consent. Because BIPA provides $1,000 to $5,000 in statutory damages per violation, this per-scan theory produced staggering liability. The defendant in Cothron estimated class-wide damages exceeding $17 billion. The Illinois Supreme Court acknowledged the problem and invited the legislature to clarify its intent regarding damages.
The legislature responded in August 2024, amending BIPA Section 20 to provide that collecting or disclosing the same biometric identifier from the same person using the same method constitutes a single violation, entitling the individual to “at most, one recovery.” But the legislature did not include an express retroactivity clause, and every district court to consider the question held the amendment applied only prospectively.
The Seventh Circuit disagreed. Writing for a unanimous panel, Chief Judge Brennan reasoned that the amendment is remedial because: (1) the legislature placed it in Section 20, the provision governing damages, and left Section 15’s substantive liability standards untouched; and (2) its plain language focuses on remedies, limiting plaintiffs to “at most, one recovery.” The court rejected the argument that converting thousands of per-scan “violations” into one constituted a substantive change, finding that Cothron addressed claim accrual under Section 15 for statute-of-limitations purposes, not Section 20’s damages framework. Because the amendment “simply changed the statutory award of damages available to plaintiffs, cabining the discretion of trial court judges when they fashion the remedy,” it is procedural under Illinois law and applies retroactively.
What This Decision Does and Does Not Do
It does apply the amendment retroactively to all pending BIPA cases. Plaintiffs alleging thousands of per-scan violations are now entitled to, at most, a single recovery per person, per violation type, per method of collection, regardless of whether the underlying conduct predates August 2024.
It does not eliminate BIPA liability. Section 15’s substantive requirements—written consent, notice, retention and destruction policies—remain fully intact. Employers who collected biometric data without consent still face liability. The amendment limits the multiplication of damages. It does not create a safe harbor.
It does not bind Illinois state courts. As a federal Erie prediction, the decision represents the Seventh Circuit’s assessment of how the Illinois Supreme Court would rule. That court has not yet addressed retroactivity and could reach a different conclusion, though the Seventh Circuit expressed “a high degree of confidence” in its prediction.
What Employers Should Do Now
Reassess exposure in pending cases. The per-scan damages model that drove settlement values to historic levels is no longer viable in federal court. The plaintiff in Clay alleged roughly 1,500 fingerprint scants, exposure of up to $7.5 million under the per-scan theory, now capped at $5,000. Employers should recalculate their exposure and revisit settlement posture immediately.
Monitor for Illinois Supreme Court review. Plaintiffs may seek to present the retroactivity question to the Illinois Supreme Court through a pending state case or by seeking certification. Until that court addresses this issue, some uncertainty remains in state court proceedings. The Seventh Circuit’s thorough analysis will carry significant persuasive weight, but it is not the final word.
Evaluate jurisdictional implications. The court noted that reduced damages exposure may require district courts to “reevaluate” subject matter jurisdiction. For cases in federal court on diversity grounds, lower damages figures could bring claims below the amount-in-controversy threshold.
Looking Head
This decision provides the authoritative guidance the BIPA litigation landscape has needed. But it should not be mistaken for an all-clear signal. BIPA’s substantive requirements remain in full force, plaintiffs’ attorneys continue to push the statute into new territory such as AI meeting tools and voice recognition systems, and the broader regulatory environment for biometric privacy continues to evolve. This decision reduces the cost of past mistakes. It does not eliminate the cost of future ones.
For more information about this decision or BIPA compliance, please contact Sam Mitchell in Smith, Gambrell & Russell’s Chicago office.