Residents of Illinois are protected by one of the strictest state privacy laws in the nation - the Biometric Information Privacy Act, a 2008 measure that imposes financial penalties for using an Illinoisan’s fingerprints or face scans without consent. Because of it, major companies that use the facial-recognition database called MegaFace could be facing a slew of lawsuits in the coming years.

The law in Illinois strictly forbids private entities to collect, capture, purchase or otherwise obtain a person’s biometrics — including a scan of their “face geometry” — without that person’s consent.

Professor Faye Jones, an expert in privacy and security law, spoke to the New York Times about the law.

“Photos themselves are not covered by the Biometric Information Privacy Act, but the scan of the photos should be. The mere use of biometric data is a violation of the statute,” she said. “Using that in an algorithmic contest when you haven’t notified people is a violation of the law.”

Illinois residents whose faceprints are used without their permission have the right to sue, said Ms. Jones, and are entitled to $1,000 per use, or $5,000 if the use was “reckless.” 

Read the full story at nytimes.com.