A Fingerprint-Clock Lawsuit Put His Exposure at $850,000. His Renewed Policy Excludes It by Name.

10 min read · Last updated September 28, 2026

A biometric information exclusion, added to many Employment Practices Liability Insurance and commercial general liability policies since 2023, blocks coverage for lawsuits filed under Illinois’ BIPA law over fingerprint scanners and similar biometric technology, so a business can carry an active insurance policy and still fund a class-action settlement entirely out of pocket.

In this article

• What Illinois’ Biometric Privacy Law Actually Requires
• Why Did One Court Ruling Multiply the Exposure Overnight
• How Insurers Closed the Door: the Biometric Information Exclusion
• What the 2024 Damages Cap Changed, and What It Didn’t
• Before You Renew, Check Three Things
• Frequently asked questions

A biometric-information exclusion has become a standard line in renewed Employment Practices Liability Insurance and commercial general liability policies across Illinois, written to block the exact lawsuits a fingerprint time clock invites under the state’s Biometric Information Privacy Act. Roland Petrosky found that out the hard way at his 210-employee auto-parts warehouse in Elgin, Illinois, where a fingerprint scanner installed at the time clock in 2019 to stop buddy-punching drew a former employee’s class-action demand letter in March 2026 putting his exposure at more than $850,000 under the law’s own damages formula. When Roland called his Employment Practices Liability Insurance carrier to open a claim, the adjuster pointed to an endorsement added at his last renewal: biometric-related claims, excluded by name.

Roland’s broker had assumed a “privacy” claim fell under employment-practices coverage. Nobody had flagged the rewritten form.

What Illinois’ Biometric Privacy Law Actually Requires

The Biometric Information Privacy Act, known as BIPA, is Illinois law codified at 740 ILCS 14 (ILCS is the citation format Illinois uses for its state statutes). Section 15(b) sets a three-part test before any private entity, including an employer, can collect a fingerprint, iris scan, voiceprint, or facial geometry record: written notice that the data is being collected, written notice of its specific purpose and retention length, and a signed written release, per the statute’s own text as quoted in the Illinois Supreme Court’s opinion in Cothron v. White Castle System, Inc.. Skip any one step and the business is out of compliance the day the scanner is switched on. BIPA is one of the few state privacy laws that lets the person whose data was taken sue directly, rather than waiting on a regulator.

Why Did One Court Ruling Multiply the Exposure Overnight

BIPA had existed since 2008 with modest litigation until the Illinois Supreme Court answered a certified question in 2023. In Cothron v. White Castle System, Inc., 2023 IL 128004, the court held, in its own words, that “a separate claim accrues under the Act each time a private entity scans or transmits an individual’s biometric identifier or information in violation of section 15(b) or 15(d).” That single sentence turned a fingerprint time clock into a running damages meter. A warehouse worker who clocked in and out twice a day for three years had generated more than 2,000 separate scans, and under Cothron, each one could theoretically support its own statutory claim.

BIPA’s own damages provision, section 20, allows the greater of actual damages or $1,000 per negligent violation and $5,000 per intentional or reckless violation, plus attorney’s fees, costs, and injunctive relief. Multiplied across thousands of scans instead of one collection event, the math stopped looking like a compliance fine and started looking like an extinction-level event for a mid-size employer.

How Insurers Closed the Door: the Biometric Information Exclusion

Coverage for biometric claims was never a settled question. In Twin City Fire Insurance Co. v. Vonachen Services Inc., a federal court in Illinois found in 2021 that an Employment Practices Liability Insurance policy’s “Employee Data Privacy Wrongful Act” language potentially reached a BIPA claim over a fingerprint-based timekeeping system, per the Pillsbury Insurance Recovery team’s writeup, which notes that “as courts apply EPLI coverage to biometric claims, insurers are increasingly adding specific terms and even exclusions in many policies to address these claims.”

That trend accelerated once Cothron raised the stakes. A 2026 client alert from the law firm Hunton Andrews Kurth documents a wave of Illinois federal court decisions built on three exclusion types: an access-or-disclosure exclusion, a statutory exclusion, and an employment-related-practices exclusion. Courts sided with insurers in Sentinel Insurance Company v. Majestic Auto Glass and JJM Group Limited v. West Bend Mutual Insurance Company; Thornley v. Citizens Insurance Company of America kept a $20 million dispute alive on procedural grounds. The alert also advises checking every line, not just general liability, since directors-and-officers, cyber, and tech errors-and-omissions coverage may pick up a claim a CGL exclusion denies. EPLI carries its own version of this fight, seen in the Vonachen litigation above, which is why Roland’s carrier pointed to his EPLI form instead. A related breach notification sublimit works the same way, capping what a policy pays per person notified.

What the 2024 Damages Cap Changed, and What It Didn’t

The Illinois legislature responded to Cothron‘s per-scan reading with Public Act 103-0769, effective August 2, 2024. The act’s own text states that a private entity that collects “the same biometric identifier or biometric information from the same person using the same method of collection” in more than one instance “has committed a single violation” for which the person can recover only once, capping recovery at one claim per person per collection method rather than one claim per scan. The same amendment lets a business satisfy written consent with an electronic signature.

Neither change touches the exclusion itself. The amendment limits how large a future judgment can get; it does nothing to restore coverage an insurer already removed from the form. An employer whose 2026 renewal carries a biometric exclusion is just as uncovered for a smaller, capped claim as for the uncapped version Cothron described.

The timing works against employers in a second way. The Council of Insurance Agents & Brokers (CIAB) reported overall commercial premiums down 2.0% across all accounts in the second quarter of 2026, the second straight quarterly decline after premiums first fell across every account size in the first quarter, according to Insurance Journal’s coverage of the CIAB survey. That same survey lists employment practices among the ten lines that shrank in the second quarter, without publishing an exact percentage for it this cycle. A softening market gives a broker more room to negotiate a buyback endorsement back in without a big premium jump, but an owner watching the price fall is the least likely person to ask for it.

Before You Renew, Check Three Things

Check whether your state has a BIPA-style law with teeth. Illinois is the outlier.

State and law	Can an individual sue directly	Who can bring a claim	Penalty per violation
Illinois, BIPA (740 ILCS 14)	Yes	Any person whose biometric data was collected without consent	$1,000 negligent or $5,000 intentional or reckless, now one recovery per person per method
Texas, Capture or Use of Biometric Identifier Act	No	Only the Texas Attorney General	Civil penalty up to $25,000 per violation
Washington, biometric identifiers law (Revised Code of Washington, cited as RCW, 19.375)	No	Only the Washington Attorney General, under the state Consumer Protection Act	Civil penalty up to $7,500 per violation, under the Consumer Protection Act’s general penalty provision

Texas’ Capture or Use of Biometric Identifier Act and Washington’s biometric identifiers law both regulate the same kind of data collection, but Texas’ own Attorney General’s office confirms that “the Texas Attorney General has exclusive authority to enforce” that state’s law, and Washington’s statute states directly that it “may be enforced solely by the attorney general.” That penalty traces to the state’s Consumer Protection Act, which caps each violation at $7,500, not to the biometric statute itself. Neither state hands an employee a courtroom the way Illinois does.

Second, ask what a real biometric claim actually costs. Power Solutions International, a manufacturer in Wood Dale, Illinois, was sued in 2018 over a fingerprint time clock from a vendor called NOVAtime Technology, and the case reached a court-approved settlement of $2.4 million in February 2025. Per the company’s own quarterly securities filing, “the final settlement amount of $2.4 million was paid to the Plaintiff, of which $0.7 million was paid by the Company and $1.7 million was paid by the Company’s insurance carrier.” That policy predated the exclusion wave; a comparable claim filed today, against a policy carrying the current exclusion, could leave the full $2.4 million on the employer’s own books.

Third, get the exclusion’s exact wording in writing. Some carriers use a narrow, biometric-specific exclusion; others rely on a broader access-or-disclosure or statutory exclusion that reaches BIPA without naming it. Ask whether a buyback endorsement exists, what it costs, and whether it survives renewal. Even on a claim the exclusion doesn’t touch, EPLI defense costs erode the same limit that pays a settlement, so a long BIPA suit can shrink the coverage left before it’s resolved.

Frequently asked questions

Does Employment Practices Liability Insurance cover BIPA lawsuits in Illinois? Some older policies did, based on language covering an employment-related invasion of privacy. Since 2023, a growing share of renewed Employment Practices Liability Insurance and commercial general liability policies in Illinois carry an exclusion specifically written to block biometric claims, including those filed under BIPA. Check your current renewal’s exclusion list rather than relying on how an older policy was interpreted.

What is a biometric information exclusion? It is a policy endorsement, added to many Employment Practices Liability Insurance and commercial general liability forms since 2023, that removes coverage for claims arising from the collection, storage, or disclosure of biometric identifiers like fingerprints, iris scans, or facial geometry. It applies whether or not the underlying lawsuit specifically names BIPA.

How much can a single BIPA violation cost under Illinois law? BIPA’s damages provision allows $1,000 per negligent violation or $5,000 per intentional or reckless violation, whichever is greater than actual damages, plus attorney’s fees and costs. A 2024 amendment now limits an employer to one recovery per person per collection method, rather than one recovery per individual scan.

Did the 2024 BIPA amendment eliminate the risk of a large settlement? No. Public Act 103-0769 capped future damages at one claim per person per method instead of one claim per scan, which lowers the ceiling on a new lawsuit. It does not restore coverage on a policy that already excludes biometric claims, and it does not apply to claims that already settled before it took effect.

Do Texas and Washington allow the same kind of biometric lawsuits as Illinois? No. Both states regulate biometric data collection, but neither gives an individual the right to sue directly. Texas’ Capture or Use of Biometric Identifier Act and Washington’s biometric identifiers law are both enforced solely by each state’s Attorney General, which is why Illinois accounts for nearly all of the coverage litigation described in this article.