Biometric Timeclocks Across Illinois BIPA SB 2979, Texas CUBI, and Colorado HB 24-1130

Why Vendor "Encrypted Template" Claims Fail Every Biometric Statute

Every timeclock brochure claiming "we only store a mathematical vector, not a fingerprint photo" misstates statutory text. Illinois, Texas, and Colorado all regulate mathematical geometry templates derived from fingers, hands, or faces.

Walk into an acquired distribution center in Joliet, Aurora, or Fort Worth and ask the plant manager when employees signed biometric releases before enrolling at the wall clock. Eight times out of ten, you hear the exact line the hardware sales rep gave Facilities three years ago: "The clock doesn't save an image of a fingerprint—it converts ridge points into a mathematical number string, so privacy laws don't apply."

Open the statutory definitions and watch that defense evaporate in thirty seconds. Under the Illinois Biometric Information Privacy Act (740 ILCS 14/10), "biometric identifier" covers a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry, and "biometric information" covers any information, regardless of how it is captured, converted, stored, or shared, based on an individual's biometric identifier used to identify an individual. Colorado (Colo. Rev. Stat. § 6-1-1303(2.4)) and Texas (Tex. Bus. & Com. Code § 503.001(a)) sweep in finger, hand, voice, and facial geometry templates on identical logic.

Nor does outsourcing payroll save you. When your wall clock syncs biometric templates to a cloud workforce-management server without prior written disclosure and consent, both the employer collecting the scan at the wall (§ 15(b)) and the cloud transfer (§ 15(d)) trigger independent statutory duties.

Post-Clay BIPA Arithmetic: Per-Person Caps Still Produce Seven-Figure Exposure

Illinois SB 2979 and the Seventh Circuit’s April 2026 Clay ruling ended Cothron’s existential per-scan math, not class-action economics. Turnover across three to five years still compounds per-person liquidated damages fast.

Let us do the exact Illinois arithmetic so Finance and people operations see the real post-amendment numbers. In August 2024, Illinois enacted SB 2979 (amending 740 ILCS 14/10 and 14/20), doing two concrete things: first, explicitly confirming that an electronic signature satisfies BIPA's "written release" requirement; second, overturning Cothron v. White Castle's per-punch accrual rule by specifying that repeated collection or disclosure of the same biometric identifier from the same person using the same method constitutes a single collective violation entitling an aggrieved person to at most one recovery under § 20. On April 1, 2026, the Seventh Circuit held in Clay v. Union Pacific Railroad Co., No. 25-2185 (7th Cir. Apr. 1, 2026), that SB 2979's per-person damages rule is remedial and applies retroactively in pending federal cases.

Does that mean you can relax? Run the cohort denominator on a 350-person Illinois warehouse with 60% annual hourly turnover across Illinois's five-year BIPA limitations period (Tims v. Black Horse Carriers):

• Total Unique Workers Scanned Over 4 Years: 350 initial staff + (210 annual replacements × 3 years) = 980 unique individuals.
• Statutory Liquidated Damages Floor: Under 740 ILCS 14/20, each aggrieved person recovers $1,000 per negligent violation or $5,000 per intentional or reckless violation, plus mandatory reasonable attorneys' fees and litigation costs.
• Single-Count vs. Multi-Section Exposure: Even at $1,000 negligent damages for 980 workers on a single § 15(b) collection count, baseline statutory exposure is $980,000 plus plaintiff fees; if recklessness ($5,000) or separate § 15(a) (missing public retention policy) and § 15(d) (unauthorized cloud-vendor disclosure) theories attach, exposure climbs into the multi-million-dollar band—consistent with post-amendment settlements such as the October 2025 $12.1 million Speedway timeclock class settlement covering roughly 7,700 workers.

Comparing Illinois BIPA, Texas CUBI, and Colorado HB 24-1130

A single national biometric form fails if it ignores Texas’s one-year post-purpose destruction deadline or Colorado’s strict four-purpose cap on mandatory employee consent. Map the strictest denominator across all three states.

When managing multi-site AI and changing work timekeeping hardware, three state statutes impose distinct operational tripwires—with zero minimum headcount or revenue floor exempting small sites in Colorado:

1. Illinois BIPA (740 ILCS 14/15): Publish a written retention schedule mandating permanent destruction when the initial purpose ends or within 3 years of last interaction, whichever comes first. Deliver written purpose/duration notice and collect a signed written or electronic release before Scan #1, plus consent for cloud-vendor hosting.
2. Texas CUBI (Tex. Bus. & Com. Code § 503.001): Inform the worker and obtain consent before capture. Destroy the identifier within a reasonable time, not later than 1 year after the collection purpose expires (upon termination). Texas Attorney General penalties reach $25,000 per violation.
3. Colorado HB 24-1130 (Colo. Rev. Stat. § 6-1-1314, Effective July 1, 2025): Covers every employer collecting biometrics in Colorado with zero revenue floor. Under § 6-1-1314(6), mandatory condition-of-employment consent is restricted strictly to four purposes: secure physical/IT access, recording workday and meal/rest break punches, workplace safety/security, and public safety/security. Any secondary use requires voluntary opt-in. Delete templates at the earliest of purpose completion, 24 months from last interaction, or 45 days after an annual audit.

UK & EU Cross-Border Warning: Never export US biometric attendance policies to Europe. In February 2024, the UK ICO ordered Serco Leisure to halt facial and fingerprint attendance scans across 38 sites because swipe cards were a less intrusive option.

Religious and Disability Bypass Pins: The EEOC v. Consol Energy Mandate

Never argue theology with an employee who objects to a hand or facial scanner. Every biometric timeclock SOP must pre-configure a PIN or badge-swipe bypass on Day 1.

Even if 100% of your Illinois, Texas, and Colorado releases are signed, forcing every worker onto a biometric scanner without an accommodation lane triggers federal Title VII and ADA liability. Read EEOC v. Consol Energy, Inc., 860 F.3d 131 (4th Cir. 2017): an evangelical Christian coal-mine worker requested an alternative way to clock in because he sincerely believed using the biometric hand-geometry scanner conflicted with his religious beliefs regarding the biblical "Mark of the Beast." Although the company had already let two employees with physical hand injuries enter their personnel numbers on a keypad, management lectured the religious objector with a vendor letter claiming the scanner left no physical mark, refused the keypad bypass, and forced his constructive retirement. The Fourth Circuit affirmed nearly $587,000 in back pay, front pay, and compensatory damages.

Post-Groff v. DeJoy, 600 U.S. 447 (2023), proving that a four-digit PIN or RFID badge swipe imposes "substantial increased costs in relation to the conduct of its particular business" is virtually impossible—especially because every commercial timeclock already ships with a built-in badge/PIN fallback for bandaged fingers, dermatitis, worn dermal ridges, or amputations under the ADA.

Deploying the Unified Pre-Enrollment Release and Offboarding Purge Gate

Wire biometric consent into Workday or UKG onboarding BEFORE badge/clock enrollment opens, and trigger automatic template deletion inside 72 hours of termination. Use this unified multi-state form and SOP.

Harmonize your multi-state retention schedule to the strictest statutory clock: purge terminated workers' biometric templates from both the physical wall clock and the vendor cloud server within 14 calendar days of termination (beating Colorado's purpose-satisfaction rule, Texas's 1-year cap, and Illinois's 3-year ceiling with huge margin).

BIOMETRIC TIMEKEEPING WRITTEN NOTICE, RETENTION POLICY & E-SIGNED RELEASE
(Compliant with 740 ILCS 14/15 & SB 2979, Tex. Bus. & Com. Code § 503.001, and Colo. Rev. Stat. § 6-1-1314)

1. What Is Collected & Exact Purpose (Zero Secondary Use)
[Company Name] uses [Vendor Name & Clock Model] timeclocks at [Facility Locations]. When you enroll, the device scans [finger / hand / facial] geometry and converts measurements into an encrypted mathematical template ("Biometric Data"). Biometric Data is collected and used SOLELY to record the start and end of your workday and meal/rest breaks, prevent buddy-punching payroll errors, and secure timekeeping records. It is never sold, leased, traded, profited from, or used for emotion, health, or marketing tracking.

2. Cloud Vendor Disclosure
To process payroll, your encrypted template is transmitted to and hosted by our timekeeping processor, [Vendor Legal Name], under strict contractual security controls prohibiting any secondary disclosure.

3. Public Retention & Permanent Destruction Schedule
[Company Name]'s full Biometric Data Policy is publicly posted at [https://company.com/biometric-policy]. Your Biometric Data is permanently destroyed from all wall clocks, servers, and vendor backups upon the EARLIEST of:
   (a) Within fourteen (14) calendar days after your employment ends or you transfer to a non-clock role (satisfaction of initial purpose);
   (b) Following our annual retention necessity audit (within 45 days if no longer required); or
   (c) One (1) year in Texas / Twenty-four (24) months in Colorado / Three (3) years in Illinois from your last clock interaction.

4. Accommodation Bypass Right (Religious & Medical/Disability)
If you require an alternative non-biometric timekeeping method (RFID badge or keypad PIN) due to a sincerely held religious belief or a medical condition/disability, stop BEFORE enrolling at the clock and contact [[email protected]]—an alternative will be configured promptly without penalty.

5. Pre-Enrollment Written / Electronic Release
By signing electronically or in ink below BEFORE my first timeclock scan, I acknowledge receipt of this written notice and policy and consent/release [Company Name] and [Vendor Legal Name] to collect, store, use, and transmit my Biometric Data strictly as stated above.

Employee Signature: ___________________________   Date & Timestamp (Must Precede Enrollment Scan): _______________

Locking Physical Floor Controls Across Supervisors, IT, and Payroll

Every BIPA class action starts when a shift lead enrolls a new hire or staffing-agency temp at the wall clock before HR paperwork clears. Disable supervisor enrollment permissions on physical terminals so only Payroll/HRIS admins can activate clock templates after e-signature timestamps verify.