BIPA, Flock Cameras, and Facial Recognition: What Illinois Residents Need to Know

Illinois has one of the strongest biometric privacy laws in the country: the Biometric Information Protection Act (BIPA). Originally enacted in 2008, BIPA has become a powerful tool for holding companies accountable when they collect or use biometric data without proper consent.

At the same time, cities across Illinois have increasingly adopted Flock Safety cameras and other Automatic License Plate Reader (ALPR) systems to assist law enforcement investigations. As these technologies become more sophisticated, many residents are asking an important question:

Can ALPR cameras and facial recognition systems trigger liability under BIPA?

The answer is more nuanced than many people realize.

What Is BIPA?

BIPA is an Illinois law that regulates the collection, storage, and use of biometric identifiers and biometric information.

Biometric identifiers include:

• Fingerprints

• Voiceprints

• Retina or iris scans

• Hand or face geometry

The law generally requires private entities to:

• Provide written notice before collecting biometric data.

• Explain the purpose and duration of collection.

• Obtain informed written consent.

• Maintain a publicly available retention and destruction policy.

• Protect the data from unauthorized disclosure.

One of the reasons BIPA is so significant is that it allows individuals to sue for statutory damages even without proving actual financial harm.

Why BIPA Has Been So Powerful

Illinois courts have interpreted BIPA broadly.

In Rosenbach v. Six Flags, the Illinois Supreme Court held that a person can be considered “aggrieved” simply by having their biometric data collected in violation of the statute.

Later, in Cothron v. White Castle, the court held that damages may accrue for each unlawful scan or transmission, dramatically increasing potential exposure for companies that repeatedly collect biometric data.

These decisions transformed BIPA from a technical compliance statute into one of the most consequential privacy laws in the United States.

What Are Flock and ALPR Cameras?

Automatic License Plate Readers (ALPRs) are camera systems that capture images of vehicles and extract license plate numbers using optical character recognition.

Flock Safety is one of the most widely used ALPR vendors in Illinois and throughout the United States.

A typical Flock system may capture:

• License plate numbers

• Vehicle make and model

• Vehicle color

• Time and location of travel

• Images of the vehicle and surrounding area

Flock generally describes its product as a vehicle-focused investigative tool rather than a facial recognition platform.

Where Facial Recognition Enters the Conversation

The legal issue becomes more complicated when ALPR systems are paired with facial recognition technology.

There are several ways this can occur:

Direct facial recognition

A camera captures a person’s face and software analyzes facial geometry to identify or verify identity.

Indirect integration

An ALPR system shares footage with another platform that performs facial recognition analysis.

Future feature expansion

A vendor initially deploys vehicle-recognition technology but later adds biometric capabilities through software updates or third-party integrations.

This is where BIPA becomes highly relevant.

Does BIPA Apply to Facial Recognition?

Potentially, yes.

BIPA specifically includes scans of face geometry within the definition of a biometric identifier.

If a private company:

• captures facial images,

• extracts facial measurements or geometry,

• converts that information into a biometric template, and

• stores or uses it for identification,

BIPA may apply.

The key distinction is between ordinary photographs and biometric analysis of facial geometry.

A standard image is not automatically biometric data. The legal risk increases when software analyzes the face in a way that creates a measurable biometric identifier.

The Critical Question: Who Is the “Private Entity”?

BIPA applies primarily to private entities, not directly to government agencies.

This creates an important distinction:

A municipality may have constitutional or statutory privacy obligations, but BIPA litigation typically focuses on the conduct of the private company involved in collecting or processing biometric data.

Could a Flock Vendor Face BIPA Liability?

A plaintiff would generally need to show that the vendor:

• Collected a biometric identifier (such as facial geometry);

• Did so as a private entity;

• Failed to provide the required notice and obtain written consent; and

• Stored, used, or disclosed the biometric data in violation of BIPA.

As of now, public reporting has focused primarily on Flock’s vehicle-recognition capabilities, not on widespread deployment of facial-recognition identification through its standard ALPR product. However, the legal concern is less about current marketing language and more about what the system actually does with captured images.

Why Municipalities Should Still Be Concerned

Even if a city is not directly liable under BIPA, it may face other forms of exposure.

Contractual risk

If a vendor violates BIPA, litigation may draw the municipality into discovery, indemnification disputes, or public controversy.

Constitutional claims

Plaintiffs may pursue claims under:

• the Fourth Amendment,

• the Illinois Constitution’s privacy protections,

• due process theories, or

• state civil rights statutes.

Public records and transparency

FOIA requests often seek:

• vendor contracts,

• data retention policies,

• integration documents,

• audit logs,

• and any facial-recognition capabilities.

A lack of transparency can become a significant political and legal issue.

The Most Important Technical Distinction

Many people assume that any camera capable of seeing a face is automatically using facial recognition.

That is not legally accurate.

Consider the difference:

That second step, extracting and using facial geometry for identification—is the point at which BIPA concerns become much more substantial.

What Illinois Residents Should Ask Their Local Government

If your municipality uses Flock or other ALPR systems, reasonable public questions include:

• Does the system perform facial recognition or facial geometry analysis?

• Can captured images be exported to facial-recognition platforms?

• What data is retained, and for how long?

• Who has access to the footage?

• Are there audit logs of searches and data access?

• What contractual restrictions apply to biometric use?

• Has the city conducted a BIPA compliance review of its vendors?

These are governance questions, not anti-technology questions.

The Bottom Line

Illinois’ Biometric Information Protection Act is one of the strongest biometric privacy laws in the nation, and it has created substantial liability for private companies that collect biometric identifiers without proper consent.

Flock and other ALPR systems do not automatically violate BIPA simply because they capture images of vehicles or people. The key legal issue is whether a private entity is collecting and using facial geometry or other biometric identifiers for identification purposes.

As surveillance technologies continue to evolve and integrate with AI-driven analytics, the line between vehicle recognition and biometric identification may become increasingly important. For Illinois residents, municipalities, and vendors alike, understanding that distinction is essential to navigating the intersection of public safety technology and biometric privacy rights.

If you have questions about Illinois privacy law, BIPA, public records requests involving surveillance technology, or municipal transparency issues, contact the Law Office of Jonathan W. Cole P.C. at (708) 529-7794 “Your Neighborhood Law Firm”.