On February 2, 2023, the Illinois Supreme Court filed an opinion in Jorome Tims v. Black Horse Carriers, Inc., holding that Illinois’ Biometric Information Privacy Act (BIPA) is subject to a single, five-year statute of limitations period.

The text of BIPA does not contain a statute of limitations. The question before the Illinois Supreme Court in Tims was whether BIPA is governed by the one-year statute of limitations for actions including those “for publication of matter violating the right of privacy” or the five-year “catch-all” statute of limitations period. Previously, the Appellate Court in Tims took a bifurcated approach. It held that the one-year privacy statute of limitations applies to subsections 15(c) and 15(d) of BIPA, which prohibit the sale or disclosure of biometric information. On the other hand, it held that the five-year catch-all limitations period applies to the remaining subsections 15(a), 15(b), and 15(e), which require development and compliance with a retention policy and informed consent prior to collecting biometric information.

The Supreme Court partially reversed the Appellate Court and found that the five-year catch-all applies to all subsections. Even though the Supreme Court acknowledged that subsections 15(c) and 15(d) involve “publication,” such that the one-year statute of limitations could be applied, it refused to do so in favor of a unified approach. The Supreme Court reasoned that two limitations periods could create confusion about which BIPA claims would be time-barred while others remain viable. It also relied on Illinois caselaw applying the five-year catch-all statute of limitations where the statute giving rise to a claim did not contain a limitations period. Finally, the Supreme Court found that a longer limitations period would support the Illinois’ legislature’s goal of “regulating the collection, use, safeguarding, handling, storage, retention, and destruction” of biometric information. Since the Supreme Court’s 2019 decision in Rosenbach v. Six Flags Ent. Corp., holding that “actual injury” is not required to pursue BIPA claims, the trend of BIPA class actions has remained consistent. The Tims decision will do nothing to slow down these actions and the attendant risk of liability. Accordingly, employers should ensure that they are in strict compliance with BIPA by working with counsel to audit their current compliance practices and address any potential gaps to reduce liability exposure.

Back to Workforce Bulletin Blog

Search This Blog

Blog Editors


Related Services



Jump to Page


Sign up to receive an email notification when new Workforce Bulletin posts are published:

Privacy Preference Center

When you visit any website, it may store or retrieve information on your browser, mostly in the form of cookies. This information might be about you, your preferences or your device and is mostly used to make the site work as you expect it to. The information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies. Click on the different category headings to find out more and change our default settings. However, blocking some types of cookies may impact your experience of the site and the services we are able to offer.

Strictly Necessary Cookies

These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information.

Performance Cookies

These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance.