A recent decision from the Northern District of Illinois highlights new legal hurdles for employers using AI-powered video interview technologies under Illinois’ Biometric Information Privacy Act (BIPA), 740 ILCS 14/15.  In Deyerler v. HireVue, initially filed over two years ago in January 2022, a class of plaintiffs alleged that HireVue’s AI-powered facial expression and screening technology violated BIPA.  According to the complaint, HireVue collected, used, disclosed, and profited from “biometric identifiers” without complying with the requirements of BIPA.  In a published decision, issued February 26, 2024, the court largely denied HireVue’s motion to dismiss, allowing most claims to proceed, and addressed several legal questions relevant to AI hiring tools and the use of video interviewing software. 

In its decision, the court first considered HireVue’s argument that the court lacked personal jurisdiction because HireVue has no meaningful corporate presence in Illinois and the applicable software was not developed in Illinois.  The court rejected that argument and found that plaintiffs sufficiently pleaded personal jurisdiction by alleging that HireVue marketed and sold its software to at least one company headquartered in Illinois, and the HireVue software was used to capture at least one of the plaintiff’s biometric identifiers.

The court next turned to HireVue’s two “statutory interpretation” arguments under BIPA.  First, the court rejected HireVue’s argument that facial scans are not “biometric identifiers” because they are not used to affirmatively identify specific individuals.  The court pointed to the language of the statute, which includes “facial geometry,” and found that plaintiffs’ allegation that HireVue used “facial expression and screening technology…to identify and assess candidates by collecting their facial geometry” was sufficient to survive a motion to dismiss.  Second, the court rejected HireVue’s argument that plaintiffs’ BIPA claims were “precluded” by the Illinois Artificial Intelligence Video Interview Act (AIVIA), 820 ILCS 42/1, which, according to HireVue, more specifically addressed the use of AI video interviewing tools.  The court disagreed and found that AIVIA and BIPA impose different but “concurrent” obligations and therefore plaintiffs’ BIPA claims were not precluded.

After addressing HireVue’s personal jurisdiction and statutory interpretation arguments, the court addressed HireVue’s arguments that the plaintiffs failed to state a claim under BIPA §§ 15(a), (b), (c) and (d).  Assuming the facts as alleged by the plaintiffs were true, the court found that plaintiff adequately pleaded violations of BIPA §§ 15(a) and (b) based on the plaintiffs’ allegation that HireVue collected, captured, and used plaintiffs’ facial geometry and did not make publicly available any biometric retention policy.   The court also found that plaintiffs’ allegation that HireVue’s software “results in the dissemination of biometrics to third parties, such as data storage vendors” was sufficient to establish a violation of § 15(d), which prohibiting the disclosure or redisclosure of biometric identifiers. 

HireVue was successful, however, in dismissing plaintiffs’ claims under BIPA § 15(c), which regulates the sale of, and profiting from, biometric identifiers.  In short, the court agreed with HireVue that the sale of its software does not equate to the sale of biometric identifiers.

Courts in Illinois have continued to enforce BIPA under its broad statutory terms, which can result in significant damages to employers.  This decision is a reminder that plaintiffs will continue to assert new and creative claims under biometric privacy laws, including as it relates to the use of AI software vendors.  And while, Illinois has the most prominent biometric privacy law in the country, numerous other states have or are considering passing biometric privacy laws that can be applicable to employers.  Considering this decision, employers and businesses should continue to vet HR and other software vendors, including those marketing the use of AI, to understand the potential risks and take measures to mitigate those risks.  Additionally, vendors of AI technology should understand the acts and practices that can result in the application of various state laws, especially when marketing and selling to customers. 

Back to Workforce Bulletin Blog

Search This Blog

Blog Editors


Related Services



Jump to Page


Sign up to receive an email notification when new Workforce Bulletin posts are published:

Privacy Preference Center

When you visit any website, it may store or retrieve information on your browser, mostly in the form of cookies. This information might be about you, your preferences or your device and is mostly used to make the site work as you expect it to. The information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies. Click on the different category headings to find out more and change our default settings. However, blocking some types of cookies may impact your experience of the site and the services we are able to offer.

Strictly Necessary Cookies

These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information.

Performance Cookies

These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance.