Illinois is the only state that allows individuals to sue over biometric-privacy violations. A pair of court rulings have expanded the scope of an Illinois biometric-privacy law that already was one of the toughest in the U.S., increasing potential civil liability for companies that collect personal data through facial-recognition technology, retinal scans or fingerprinting. The 2008 law, designed to protect consumers and workers, bars companies from collecting or disseminating biometric data without obtaining consent, with penalties ranging from $1,000 to $5,000 for violations. The law was little-noticed or used in its infancy, but in recent years it has been the basis for a rapidly expanding number of lawsuits, many seeking class-action status. Some U.S. companies, including technology giants Google and Facebook , already have settled cases for significant sums.

---