Camera-related state law

The Illinois eavesdropping statute, 720 ILCS 5/14-2, was rewritten by Public Act 98-1142 in 2014 after the Illinois Supreme Court struck down the prior version on First Amendment grounds in People v. Clark and People v. Melongo. The current statute makes it a felony to knowingly use a device to record a private conversation without the consent of all parties, where a private conversation is one in which a party intends the conversation to be private under circumstances reasonably justifying that expectation.

Functionally, IL operates as a two-party consent state for many commercial scenarios because the audio capture in a camera install rarely falls outside the reasonable-expectation zone for the people in the room. Video-only surveillance is treated more permissively: recording video in non-private areas of a commercial property with posted notice is generally lawful. Hidden cameras in spaces with a reasonable expectation of privacy (restrooms, locker rooms, hotel guest rooms) trigger separate criminal exposure under unauthorized video recording statutes.

Practical translation. Commercial IL camera installs default to video-only on the cameras and route audio capture through a documented all-party consent workflow when audio is needed. The bigger compliance lift in IL is BIPA, not the camera placement itself.

Biometric data: BIPA

The Biometric Information Privacy Act (BIPA), 740 ILCS 14, is the strictest US state biometric privacy law. It applies to private entities (not state or local government) operating in IL and requires three things before any biometric capture from an IL resident:

  • Written, informed consent. The subject must receive written notice of the specific purpose and length of collection, then provide a written release before capture.
  • Publicly available written retention and destruction policy. The entity must publish a schedule, and biometric data must be destroyed when the initial collecting purpose is satisfied or within three years of the last interaction, whichever is sooner.
  • No sale, lease, trade, or profit from biometric data. Disclosure to a third party requires consent or a narrow statutory exception.

Biometric identifiers under BIPA include fingerprints, voiceprints, retina or iris scans, and scans of hand or face geometry. Biometric information includes any information based on those identifiers used to identify a person. Damages under 740 ILCS 14/20 are $1,000 per negligent violation and $5,000 per intentional or reckless violation, plus attorneys' fees. The Illinois Supreme Court in Rosenbach v. Six Flags (2019) held that statutory violation alone is sufficient injury for standing.

In Cothron v. White Castle (2023), the IL Supreme Court held that each scan of a fingerprint or face can constitute a separate violation. The legislature responded with a 2024 amendment that addresses some per-scan questions. Practical effect for an IL commercial install: any facial recognition, fingerprint access control, or retina/iris scanning needs a BIPA-compliant consent and retention workflow in place at go-live.

Privacy in the workplace

The Illinois Right to Privacy in the Workplace Act, 820 ILCS 55, restricts certain monitoring and inquiry practices but does not directly govern general workplace video surveillance. The Illinois Personnel Record Review Act (820 ILCS 40) governs employee access to personnel records, which can include surveillance footage in some interpretations. BIPA reaches employee biometric capture in fingerprint timeclocks and biometric access control.

Cameras in employee-only spaces with a reasonable expectation of privacy (changing areas, lactation rooms, employee restrooms) are off-limits. Cameras in production lines, retail floor, loading dock, and warehouse aisles are routine when paired with notice and, where biometric capture is involved, BIPA written consent.

IL employers using fingerprint timeclocks (Kronos, ADP, smaller HR platforms) need a BIPA-compliant onboarding workflow. The largest BIPA settlements to date have come from employer fingerprint timeclocks where the employee never signed a BIPA release.

Public-place and common-area cameras

For commercial real estate, multi-tenant residential, retail, and hospitality, the practical rule set is consistent. Cameras in lobbies, hallways, exterior, parking, retail floor, and other non-private common areas are lawful with posted notice. Cameras in bathrooms, dressing rooms, hotel guest rooms, and any other space where privacy is expected are off-limits.

IL operators using any biometric capture (entry-by-face, age verification by face, customer fingerprint loyalty) layer BIPA consent on top of the standard surveillance posting. Multi-tenant residential operators handle BIPA at lease-up for any biometric access control and document the retention schedule in the building's privacy policy.

Video retention requirements

IL has no single statewide video retention statute that applies to all commercial cameras. Retention is set by the regime that governs the industry.

  • Cannabis. The Illinois Department of Financial and Professional Regulation (IDFPR) publishes camera coverage and retention rules for adult-use retail and cultivation. Pull the current IDFPR rules before designing the install.
  • Healthcare. HIPAA Security Rule (45 CFR Part 164) governs PHI-touching footage. Retention is typically 30 to 90 days at the facility, longer when an investigation is open.
  • Retail and hospitality with card data. PCI-DSS Requirement 9 specifies camera coverage of the cardholder data environment with 90-day retention.
  • Banks and financial institutions. Federal banking regulators set surveillance and retention expectations through bank examination. IL Department of Financial and Professional Regulation supervises state-chartered institutions.
  • Schools. FERPA reach for K-12 districts and higher education. Illinois School Code district policies apply.
  • Federal contractors and grantees. NDAA Section 889 controls vendor selection. Retention is contractor-driven through the SSP or grant award terms.
  • Biometric data destruction. BIPA requires destruction when the initial purpose ends or within three years of the last interaction, whichever is sooner. This is data destruction, not video retention, but it lives in the same retention schedule.

Default video retention for IL commercial systems with no specific industry rule is 30 days. Operators in higher-risk industries set longer retention with explicit written retention policies in the WISP, facility security plan, or IDFPR SOP.

Notable enforcement examples

BIPA class-action volume is the largest of any US state biometric privacy statute. Notable cases include Rosenbach v. Six Flags Entertainment (Illinois Supreme Court 2019, statutory injury), Cothron v. White Castle (Illinois Supreme Court 2023, per-scan accrual), and a long list of class-action settlements involving employer fingerprint timeclocks, retail facial recognition, and biometric loyalty programs. The pattern across cases: a private entity captured biometric data from employees or consumers without a written release and a published retention schedule, and the class action followed.

IDFPR has issued sanctions against IL cannabis licensees for surveillance and retention failures. The Illinois Attorney General has brought consumer protection actions involving electronic surveillance and data handling. Federal HIPAA settlements have reached IL-based defendants where physical safeguards were a documented part of the breach. Real settlements are searchable on the IL AG, IDFPR, and HHS OCR enforcement pages.

What Tec-Tel does to comply with Illinois regulations

Tec-Tel installs across Illinois for retail, manufacturing, healthcare, multi-tenant residential, financial, and licensed cannabis customers. The default install pattern for an IL commercial site:

  • Video-only on cameras unless audio is documented with all-party consent under 720 ILCS 5/14-2.
  • Posted surveillance notice at every public entrance.
  • No cameras in restrooms, locker rooms, dressing rooms, or any space where privacy is reasonably expected.
  • BIPA-compliant written consent and retention workflow coordinated with the customer's privacy team for any facial recognition, fingerprint access control, or retina/iris scanning.
  • Retention configured to the regime that governs the industry (HIPAA, PCI, IDFPR, NDAA), with the facility's written retention policy attached.
  • NDAA Section 889-compliant vendor selection on any federal-touching install. No Hikvision, Dahua, Hytera, Huawei, ZTE, or covered OEM relabels.
  • Multi-vendor architecture so the customer is not locked into one camera or VMS line as state and federal rules evolve.

This is a buyer-facing reference, not legal advice. For a specific IL regulatory question or a BIPA-compliance opinion, work with your privacy counsel.

Security service in Illinois

Tec-Tel deploys AI-era security across Illinois with one accountable project manager owning design, install, and service to one standard. The cities below have local service detail, deal sizing, and a free consultation. Don't see yours? We cover the whole state.

Or browse the full city directory and nationwide coverage map.