What you'll learn
- Two Separate Illinois Laws, Often Confused
- What BIPA Specifically Requires
- Why BIPA's Private Right of Action Changes the Risk Calculus
- Vendor Due Diligence for AI Video Interview Tools
- Building a Combined AIVIA and BIPA Compliance Process
Illinois employers deploying AI video interview tools are often unaware they face two separate, independently enforced state laws rather than one: the Artificial Intelligence Video Interview Act's notice-and-consent requirement, and the much higher-stakes Biometric Information Privacy Act, which governs any collection of facial geometry or voiceprint data and — unlike most AI hiring laws — grants individuals a private right of action backed by real statutory damages. This guide covers exactly what each law requires, why BIPA's private right of action and litigation history make it a materially higher risk category than AIVIA alone, what to ask an AI video interview vendor about biometric data handling, and how to build one combined compliance process that satisfies both laws for Illinois candidates.
Two Separate Illinois Laws, Often Confused
Quick answer
Illinois employers deploying AI video interview tools need to track two distinct statutes that are frequently treated as a single requirement. The Artificial Intelligence Video Interview Act (AIVIA), effective January 1, 2020, requires employers to notify candidates before using AI analysis on video interviews, explain how the AI works and what characteristics it evaluates, obtain the candidate's consent before the interview, and limit sharing of the video to those whose expertise is necessary to evaluate the candidate's fitness.
The Biometric Information Privacy Act (BIPA), enacted in 2008 and predating AIVIA by over a decade, is a separate and substantially broader law governing the collection, use, storage, and disclosure of biometric identifiers and biometric information generally — not specifically in the hiring or video interview context. If an AI video interview tool captures facial geometry, voiceprint data, or other biometric identifiers as part of its analysis, BIPA's consent, notice, and data-handling requirements apply independently of whatever AIVIA itself requires.
This means an employer can satisfy AIVIA's specific video-interview notice and consent requirement while still being out of compliance with BIPA's separate and more demanding biometric-specific consent, written policy, and data retention requirements — the two laws need to be addressed as genuinely separate compliance obligations, not treated as a single combined 'Illinois AI interview law' checklist.
What BIPA Specifically Requires
Quick answer
BIPA requires a private entity that collects a person's biometric identifier or biometric information to first inform the person in writing that the data is being collected, specify the purpose and length of time the data will be collected, stored, and used, and obtain a written release from the person before collection. 'Biometric identifier' under the statute includes a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry — meaning an AI video interview tool analyzing facial features or voice patterns to generate evaluation output is very likely handling biometric identifiers within BIPA's scope, not just conducting a general video analysis.
BIPA also requires the entity to develop a publicly available written policy establishing a retention schedule and destruction guidelines for the biometric data, generally requiring destruction when the initial purpose for collection has been satisfied or within a defined maximum period, whichever comes first — an AI interview vendor or employer that retains candidate biometric data indefinitely, without a documented destruction schedule, is very likely violating this specific provision even if the initial collection and consent process was itself fully compliant.
The consent requirement under BIPA is also more specific than a general acknowledgment — it requires informed, written consent tied to the specific purpose, meaning a generic employment application waiver that doesn't specifically address biometric data collection, its purpose, and its retention period is unlikely to satisfy BIPA's actual consent standard, even if the candidate technically signed something before the interview took place.
Illinois employers using AI video interview tools face two separate, independently enforced Illinois laws that are frequently conflated: the Artificial Intelligence Video Interview Act (AIVIA), which governs notice and consent for AI-analyzed video interviews, and the Biometric Information Privacy Act (BIPA), which separately governs any collection of biometric identifiers like facial geometry — and satisfying one does not automatically satisfy the other.
Why BIPA's Private Right of Action Changes the Risk Calculus
Quick answer
Unlike NYC Local Law 144 or most state pay transparency laws, which are enforced through a government agency's administrative process, BIPA grants a private right of action — any individual whose biometric data was collected in violation of the statute can sue directly, without needing a regulator to first investigate or bring an enforcement action. This structural difference is what has made BIPA the subject of extensive class action litigation in Illinois since the state supreme court confirmed in 2019 that a plaintiff need not show actual injury beyond the statutory violation itself to have standing to sue.
BIPA's statutory damages structure compounds this exposure: $1,000 per negligent violation, or $5,000 per intentional or reckless violation, with each instance potentially treated as a separate violation. For an employer using an AI video interview tool across a large applicant pool without proper BIPA consent and retention practices, the per-candidate violation count in a class action can scale into a very large aggregate damages exposure quickly, which is precisely why BIPA compliance has become a top-tier legal risk category for any company deploying biometric-adjacent AI hiring technology with Illinois candidates.
This risk profile means BIPA compliance deserves a materially higher level of legal diligence than the general 'AI hiring notice and consent' framework that satisfies most other states' requirements — a compliance program built to a lower bar elsewhere in the country will very likely fall short of what BIPA specifically demands for Illinois candidates.
Vendor Due Diligence for AI Video Interview Tools
Quick answer
Employers evaluating an AI video interview vendor for use with Illinois candidates should confirm specifically whether the tool's evaluation process involves biometric identifiers as BIPA defines them — facial geometry or voiceprint analysis in particular — since a vendor that markets its tool as analyzing only 'transcript content' or 'response structure,' without any facial or vocal biometric processing, may fall outside BIPA's scope entirely, while a vendor whose evaluation model does rely on facial or voice biometric signals brings the full weight of BIPA's requirements into the relationship.
Request the vendor's specific data retention and destruction schedule for any biometric data processed, and confirm it aligns with BIPA's requirement to destroy data once the initial purpose is satisfied — a vendor contract that's silent on this point, or that defaults to indefinite retention for 'model improvement' purposes without a specific Illinois-compliant carve-out, is a meaningful compliance gap regardless of how the rest of the vendor relationship is structured.
Build BIPA-specific written consent language — addressing the type of biometric data collected, its specific purpose, and its retention period — directly into the Illinois candidate application and interview scheduling flow, rather than relying on a generic employment consent form that predates the AI interview tool's deployment and was never updated to address biometric data collection specifically.
Related reading
Building a Combined AIVIA and BIPA Compliance Process
Quick answer
Because AIVIA and BIPA impose separate but overlapping obligations for the same AI video interview event, the most efficient compliance approach is a single combined notice and consent flow that satisfies both: AIVIA's requirement to explain how the AI works and what it evaluates, alongside BIPA's requirement to specifically disclose biometric data collection, its purpose, and retention schedule — addressed together in one clear, specific consent step rather than two disconnected compliance artifacts.
For a broader view of how Illinois's AI hiring and employment law landscape fits together — including the state's separate pay transparency requirement — see our guide on Illinois's pay transparency law, and pair this work with the compliance evaluation criteria covered in our guide on AI video interview platforms, since vendor selection and Illinois-specific legal compliance are most effectively addressed together during procurement, not as a separate legal review after a tool is already in production use.
BIPA's private right of action is what makes it uniquely high-stakes among state biometric and AI hiring laws — unlike most pay transparency or AEDT-style statutes enforced through a state or city agency, BIPA allows individuals to sue directly, and statutory damages of $1,000 per negligent violation or $5,000 per intentional or reckless violation compound quickly across a large applicant pool.
Frequently asked questions
Common questions about ai recruiting and how InCruiter helps teams solve them.
InCruiter Editorial Team
AI Hiring Research · Interview Intelligence · Enterprise Talent Strategy
The InCruiter editorial team covers AI-driven hiring, interview intelligence, and modern talent acquisition strategy. Our guides draw on platform data from 2,000+ hiring teams, conversations with talent leaders, and published research in industrial-organizational psychology.
