Illinois BIPA — Biometric Information Privacy Act
Illinois BIPA applies to any AI system processing biometric identifiers: facial recognition, voiceprint, fingerprint. AI video interviews, facial emotion analysis, AI proctoring, and employee time-tracking with face ID all trigger BIPA. Class actions are accelerating in 2025-2026.
The Developer Problem
Any SaaS product using facial recognition, emotion detection from video, or voice analysis that processes Illinois residents must obtain written consent, disclose retention policy, and provide a deletion mechanism. Most B2B HR tech skips all three.
What You Must Build
These are the exact technical components regulators will check for:
Written informed consent collection before any biometric data capture
Biometric data retention policy (3 years or end of employment, whichever first)
Biometric data deletion mechanism on request
Audit log of all biometric data collected and destroyed
Consequences of Non-Compliance
$5,000 per intentional/reckless violation — per person, per occurrence
Class action: 1,000 employees = $5M minimum exposure
Illinois AG enforcement actions
Drop-In Code Solution
Instead of building this from scratch (2–6 weeks of engineering time), use this production-ready package that implements all the required components above.
A serverless Next.js edge middleware that automatically intercepts all LLM API calls, extracts required metadata (model, prompt hash, completion hash, timestamp, user context), and writes cryptographically signed audit records to the client's own storage bucket — never to VektorIndex servers.
// audit-logger.middleware.ts
import { withAuditLog } from './audit-logger.middleware'
export const POST = withAuditLog(
async (req: Request) => {
// Your existing AI API route — unchanged
const response = await openai.chat.completions.create({ ... })
return Response.json(response)
},
{
storage: 'supabase', // or 'r2', 's3'
tableName: 'ai_audit_logs',
hashPrompts: true, // SHA-256 hash, never stores raw prompts
includeUserContext: true,
complianceMode: 'eu-ai-act' // or 'colorado', 'both'
}
)