Jobsite AI Cameras & BIPA: A $5K-per-Violation Risk Guide

The rise of AI-powered cameras on construction sites offers a clear benefit: better safety monitoring, theft reduction, and progress tracking. These systems can automatically flag missing PPE, detect unauthorized access, and create a visual record of the entire project. But this technology carries a hidden, multi-million-dollar legal risk that many contractors in Illinois are unknowingly accepting.

The issue lies with a state law called the Biometric Information Privacy Act (BIPA). If your jobsite camera system uses facial recognition or facial geometry to identify or track workers, you are collecting biometric data. Doing so without meeting BIPA’s strict consent and policy requirements can lead to financially devastating class-action lawsuits. This guide breaks down the risk and provides a clear compliance framework for construction firms. As an independent AI-tools directory, ZEKAI’s mission is to help professionals deploy technology safely and effectively, and this is a risk that the construction industry must take seriously. For a broader look at technology in the sector, see our guide to AI in construction.

What is BIPA and Why Does It Matter for Construction?

Passed unanimously by the Illinois legislature in 2008, the Biometric Information Privacy Act (BIPA) gives individuals control over their unique biological information. It regulates how private companies (including construction firms and subcontractors) can collect, use, and store “biometric identifiers.”

These identifiers include retina or iris scans, fingerprints, voiceprints, and, most importantly for this discussion, “scans of hand or face geometry.” AI cameras that identify workers—even just to count them or track their hours—often do so by analyzing the unique mathematical representation of their faces. This act is a BIPA-regulated activity.

Unlike other states with biometric laws, BIPA is the only one that grants a “private right of action” to any individual whose data is mishandled. This allows individuals, typically grouped into a class-action lawsuit, to sue for damages without having to prove they suffered any actual harm.

This combination of broad definitions and a private right of action has made BIPA a focal point for high-stakes litigation against employers.

How AI Jobsite Cameras Can Trigger BIPA Violations

The core conflict arises from how many modern security and workforce management platforms function. Systems designed to prevent “buddy punching” or to ensure only authorized personnel are on site often rely on identifying specific individuals.

Here’s the typical process:

1. Enrollment: A worker’s face is scanned to create a baseline data template.
2. Detection: An AI-powered camera captures faces on the jobsite.
3. Analysis & Matching: The system converts the captured face into a mathematical representation (facial geometry) and compares it against the database of enrolled workers to verify identity.

Step 1 and Step 3 are clear instances of collecting and using biometric data under BIPA. Even if the camera vendor claims their system doesn’t use “facial recognition,” if it analyzes facial geometry to tell one person from another, it falls under the law. Some camera providers, aware of this liability, explicitly state they do not include facial recognition technology in their systems.

The risk is not theoretical. A recent settlement saw the video interview platform HireVue agree to pay $3.75 million to resolve claims it violated BIPA by collecting facial and voice biometrics from job applicants without proper consent.

The Real-World Cost: BIPA Penalties Explained

BIPA’s penalty structure is what makes it so dangerous for businesses. The law allows for statutory damages of:

• $1,000 for each negligent violation
• $5,000 for each intentional or reckless violation

For years, courts interpreted “each violation” to mean each time a person’s biometric data was scanned (e.g., every time an employee clocked in). This led to scenarios of “annihilative liability,” where a company like White Castle faced a potential $17 billion in damages for a class of 9,000 employees.

Recognizing this risk, the Illinois legislature amended BIPA in August 2024. Effective retroactively, the amendment clarifies that repeated collection of the same biometric identifier from the same person using the same method now counts as a single violation for the purpose of calculating damages.

While this reform significantly reduces the astronomical potential damages, the liability remains substantial. A single, knowing violation for a crew of 100 workers could still amount to $500,000 ($5,000 x 100), plus attorneys’ fees. The statute of limitations for BIPA claims is a lengthy five years.

A 3-Step Compliance Checklist for Using AI Cameras in Illinois

Using AI cameras on Illinois jobsites is possible, but it requires a strict, proactive compliance strategy. The law lays out three core requirements.

1. Create a Publicly Available Written Policy Your company must develop and publicly display a written policy that establishes a retention schedule and guidelines for permanently destroying biometric information. Data must be destroyed when the initial purpose for collecting it has been satisfied, or within three years of the individual’s last interaction with the company, whichever comes first.

2. Obtain Informed Written Consent Before you collect *any* biometric data, you must:

• Inform the person in writing that biometric data is being collected.
• Inform them in writing of the specific purpose and length of time the data will be collected, stored, and used.
• Receive a signed written release from the employee (or any person on site, including subcontractors and visitors). The 2024 BIPA amendment clarified that an “electronic signature” is a valid form of written release.

3. Prohibit Profiting and Restrict Disclosure You may not sell, lease, trade, or otherwise profit from a person’s biometric information. You also cannot disclose the data unless you receive consent for the specific disclosure, the disclosure is required by law, or it’s in response to a warrant.

Tools for Navigating Compliance

While no software can make you BIPA-compliant on its own, certain AI tools can help manage the documentation and risk assessment process. Our ranking criteria for these tools are based on their direct application to BIPA compliance, ease of use for construction teams, and integration capabilities.

Swipe the table sideways →

For Contractual Risk: Document Crunch

For General Compliance: Kestrel Labs

Prompting for Policy: Using AI to Draft Your BIPA Policy

You can use a large language model like ChatGPT or Claude to create a first draft of your BIPA compliance policy. This should always be reviewed by qualified legal counsel, but AI can provide a solid starting point.

Act as a compliance officer for a mid-sized general contractor in Illinois. Your task is to draft a comprehensive BIPA compliance policy for our company, "ConstructCo," which plans to use AI-powered security cameras with facial recognition capabilities for site access control and safety monitoring on our jobsites.
The policy must be clear, easy for employees and subcontractors to understand, and meet all requirements of the Illinois Biometric Information Privacy Act (740 ILCS 14).
Your draft must include the following sections:
1.  **Policy Purpose:** State clearly that this policy governs the collection, use, storage, and destruction of biometric data.
2.  **Biometric Data Covered:** Explicitly mention "scans of face geometry" collected by jobsite cameras.
3.  **Notice and Consent Procedure:** Detail the exact steps the company will take to obtain written consent *before* any data is collected. Specify that this applies to all personnel on site, including employees, subcontractors, and visitors.
4.  **Purpose of Collection:** State the specific, limited purposes (e.g., "for site security, access control, and automated safety compliance checks only").
5.  **Data Disclosure and Prohibition on Sale:** State that ConstructCo will not sell, lease, trade, or otherwise profit from biometric data and will not disclose it without consent, unless required by law.
6.  **Data Storage and Security:** Describe how the data will be stored securely using a reasonable standard of care.
7.  **Retention and Destruction Schedule:** Define the data retention schedule. State that data will be permanently destroyed when the initial purpose for its collection is complete, or within 3 years of the individual's last interaction with the company, whichever comes first.
Draft the full policy.

The Bottom Line

AI jobsite cameras are a valuable tool for improving safety and security. However, for any project in Illinois, their use demands careful attention to the Biometric Information Privacy Act. The financial risks of non-compliance are significant, even with recent legislative reforms.

By understanding the law, implementing a strict notice-and-consent protocol, and leveraging tools to manage contractual risk, construction firms can adopt this powerful technology without exposing themselves to crippling legal liability. This isn’t a reason to avoid AI, but a mandate to deploy it intelligently. We encourage you to explore more tools and strategies at our AI for Construction Professionals hub.