A Biometric-Privacy Class Based on Workplace Time Clocks: How Could Plaintiffs Prove Classwide Injury and Damages?

Plaintiffs in a workplace biometric-privacy class action tied to time clocks prove classwide injury the same way Illinois courts have already accepted: by showing the employer applied one uniform scanning, consent, and retention practice to every worker, which counts as a common statutory violation under the Biometric Information Privacy Act (BIPA) without any employee needing to show identity theft or other real-world harm. Damages then follow from counting scans or violations per worker and applying the statutory per-violation framework, as shaped by a string of Illinois Supreme Court and Seventh Circuit rulings since 2023. BIPA requires Illinois employers to get written consent before collecting a fingerprint, handprint, or other biometric identifier, and to follow a written retention and destruction schedule. A time-clock class case argues the employer skipped one or both steps for its whole workforce, which is why the same proof usually works for every class member at once.

Why Classwide Injury Doesn't Require Individual Harm Evidence
How the Per-Scan Damages Math Works — and Where It Was Capped
Does the 2024 Damages Cap Apply to Cases Already in Court?
Can an Employer Avoid Liability by Pointing to Workers' Compensation?
What Classwide Recoveries Have Actually Looked Like
Frequently Asked Questions

Why Classwide Injury Doesn't Require Individual Harm Evidence

The Illinois Supreme Court settled this question in Rosenbach v. Six Flags, ruling that an employee becomes "aggrieved" under BIPA the moment an employer violates the statute's consent or retention requirements — no identity theft, financial loss, or other downstream harm has to be pleaded or proved, according to a Fisher Phillips summary of the decision. That single rule is what makes a time-clock class case workable at all: plaintiffs do not need to track down what happened to each worker's fingerprint data after it was scanned. This matters for class certification because it removes the biggest obstacle to treating hundreds or thousands of workers as one group.

If each worker had to show individualized harm, a court could find that individual issues predominate over common ones, defeating certification. Because the violation itself is the injury, the common question — did the employer get written consent and publish a retention policy before scanning anyone? — can usually be answered once, for the whole class. An Illinois appellate court applied exactly this logic in 2025, affirming certification for a class of more than 800 workers at a railway-services company whose time clocks allegedly lacked BIPA-compliant notice. The court treated the employer's uniform practices as common proof that satisfied the predominance requirement, without requiring injury evidence from individual workers, as reported by Bloomberg Law.

How the Per-Scan Damages Math Works — and Where It Was Capped

Before 2024, the core damages question in time-clock cases was whether each individual scan generated its own statutory claim or whether a worker who clocked in with a fingerprint 1,000 times during their employment had only one claim total. The Illinois Supreme Court resolved that in Cothron v. White Castle System, Inc., holding that a separate claim accrues every time biometric data is scanned or transmitted, not just once per employee, according to reporting summarized by Lewis Rice. That ruling is what made time-clock classes so financially significant: a workforce of a few hundred people clocking in twice a day could generate hundreds of thousands of technical violations. The same Cothron opinion limited how severe that math could get in practice.

The Illinois Supreme Court held that BIPA's liquidated-damages provision is discretionary rather than mandatory, meaning a trial court may reduce an award it considers excessive instead of automatically multiplying $1,000 (for a negligent violation) or $5,000 (for an intentional or reckless one) by every scan, as explained in an analysis from RL Law. Lawmakers then narrowed the exposure further. Governor J.B. Pritzker signed SB 2979 on August 2, 2024, amending BIPA so that collecting or disclosing the same person's biometric identifier by the same method multiple times counts as a single violation, capping each class member's recovery at one statutory award rather than one per scan, according to Lewis Brisbois. For cases filed after that date, the per-scan multiplier from Cothron no longer applies.

Pre-amendment claims (violations before August 2, 2024): potentially one claim per scan under Cothron.
Post-amendment claims: one claim per person, per collection method, regardless of scan count.
Either way: $1,000 minimum for negligent violations, up to $5,000 for intentional or reckless ones, at the court's discretion.

Does the 2024 Damages Cap Apply to Cases Already in Court?

Yes, for pending federal cases in the Seventh Circuit. The court held in Clay v. Union Pacific Railroad Co., decided April 1, 2026, that the 2024 damages amendment applies retroactively to cases that were already pending when it was enacted.

The ruling reversed three district courts and sharply cut the potential classwide exposure in suits over time-clock scans that predated the amendment, as reported by Sidley's Data Matters blog. For a worker or attorney evaluating an existing time-clock claim, this means the date of the alleged violations no longer guarantees Cothron's per-scan math will apply just because the scanning happened before August 2024. The case's procedural status — whether it was filed and how far it had progressed — now interacts with when the scanning occurred to determine the damages ceiling.

Can an Employer Avoid Liability by Pointing to Workers' Compensation?

No. Employers in Illinois time-clock cases have repeatedly argued that the state's Workers' Compensation Act is the exclusive remedy for workplace injuries, which would route biometric claims out of civil court and into the workers' comp system — typically a less favorable forum for plaintiffs seeking statutory damages.

Trial courts and the Illinois Appellate Court have rejected that argument, leaving plaintiffs free to pursue BIPA damages through ordinary civil litigation, according to an analysis from Nixon Peabody. This matters practically because workers' compensation exclusivity is one of the few defenses that could shut down a time-clock BIPA case entirely rather than just reducing its damages. With that defense foreclosed, the live disputes in most cases are about certification, the scope of the damages period, and how the 2024 amendment applies — not about whether the claim belongs in civil court at all.

What Classwide Recoveries Have Actually Looked Like

Two recent outcomes show the range workers can expect once liability is established. A federal court in the Northern District of Illinois approved a $12.1 million class settlement in Speedway's fingerprint time-clock case in late 2025, one of the largest timeclock-biometric recoveries to date, illustrating how per-worker scan counts can translate into large aggregate settlement value even under the post-Cothron framework, according to Duane Morris's Class Action Weekly Wire.

At the individual level, the ITS Technologies & Logistics settlement shows what a single worker's share can look like: class members who scanned a hand or fingerprint on a company time clock can claim roughly $964.48 each from the settlement fund, according to a settlement notice summary from openclassactions.com. Claim forms in that case are due December 4, 2026, with final approval scheduled for January 7, 2027 — and nothing is paid automatically unless a class member files a claim.

Confirm you're in the class: notice should specify the employer, the time period, and the biometric time-clock device.
File the claim form before the deadline listed in the notice; missing it forfeits payment even if you qualify.
Expect per-person payouts in the hundreds to low thousands of dollars range, driven by the size of the settlement fund and the number of claiming class members, not by how many times any one person scanned in.

Frequently Asked Questions

Does a worker need to show their fingerprint data was stolen or misused to join a time-clock BIPA class?

No. Under Rosenbach v. Six Flags, the employer's failure to get written consent or publish a retention policy is itself a statutory injury, regardless of what happened to the data afterward.

Is every scan still worth a separate damages award?

Only for violations before August 2, 2024, and only where the 2024 amendment doesn't apply retroactively to the case. The Seventh Circuit's Clay v. Union Pacific Railroad Co. ruling applied the amendment's one-claim-per-person cap to pending cases as well.

Can an employer get a time-clock BIPA claim dismissed by arguing it belongs in workers' compensation instead?

Courts have rejected that argument. The Illinois Appellate Court has held the Workers' Compensation Act does not preempt BIPA claims over biometric time clocks.