Illinois BIPA and UKG Biometric Time Clocks: Your Consent Form Is Probably Missing the Part That Matters Most

Most Illinois BIPA consent forms for UKG biometric time clocks name the employer and the clock but leave out the part that matters most: every company the biometric data passes through. Some Illinois employers have no BIPA consent process at all. Others have a form employees signed at onboarding, filed by HR and checked off by the HRIS admin. That second group often carries the same exposure, because the form rarely names where the data goes after the scan: the clock vendor’s cloud, the UKG tenant where the punch lands and any processing in between. Under BIPA, a missing disclosure in that chain can be a violation in its own right.

CloudApper AI TimeClock for UKG includes facial recognition, runs on standard Android tablets and iPads, and syncs with UKG Ready and Pro WFM. For Illinois employers deploying it, the test is whether the consent form names every downstream processor and was signed before the first scan. This is general information, not legal advice.

What BIPA Requires — and What Most Summaries Leave Out

Illinois Biometric Information Privacy Act, 740 ILCS 14, has four requirements before an employer collects biometric data. Three of them are widely understood. The fourth is the one that drives most of the litigation.

The widely understood three. An employer must: (1) establish and publicly post a written policy that includes the retention schedule and destruction guidelines for biometric data; (2) inform the subject in writing that data is being collected, state the purpose and duration, and receive a written release signed before collection begins; (3) use reasonable care to store, transmit, and protect biometric data at least as carefully as other sensitive confidential information.

The one that gets missed. Section 15(d) prohibits disclosing, redisclosing, or otherwise disseminating biometric data to any third party — including vendors and cloud processors — without the employee’s explicit written authorization. If your consent form does not name every downstream processor — the time clock vendor, the vendor’s cloud host, and the UKG tenant receiving the punch — the authorization for third-party disclosure is probably deficient. The general biometric privacy framework for UKG time clocks is well-documented, but the specific subprocessor disclosure obligation is where most Illinois consent forms fall short.

Cothron and the 2024 Amendment: How BIPA Exposure Is Counted Now

Before Cothron v. White Castle System, Inc. (2023), the prevailing interpretation was that a single BIPA violation accrued at enrollment — the first unconsented collection was the claim, not every subsequent scan. The Illinois Supreme Court rejected that reading. Each biometric collection, capture, or transmission is a separate claim.

Illinois then amended BIPA in August 2024. Under the amendment, repeated collection or disclosure of the same biometric identifier from the same person using the same method counts as a single violation, and the person can recover once. Damages remain up to $1,000 for a negligent violation and up to $5,000 for an intentional or reckless one, and the amendment confirmed that an electronic signature can satisfy the written release requirement. For an employer with 400 Illinois hourly workers on facial recognition clocks, the exposure is now counted per employee rather than per scan, which still means hundreds of potential claims if the consent form is deficient.

The disclosure prong still deserves attention. Adding a new cloud integration, migrating to a new UKG tenant, or routing biometric data to a processor the consent form never named can create a new disclosure question that the original release does not cover. UKG admins who have upgraded their time clock vendor or migrated UKG tenants since original biometric enrollment without re-executing consent should treat this as a priority audit item. The documentation mindset that drives wage and hour audit readiness applies here — the record needs to be contemporaneous, specific, and complete, not reconstructed.

What Your Consent Form Must Actually Name

A BIPA-compliant written release for a biometric time clock program at a UKG-integrated Illinois location needs to cover more than most HR teams have included.

The specific biometric identifier. “Facial geometry” is the correct BIPA term for facial recognition. “Fingerprint” for fingerprint scanners. Generic “biometric data” is too vague to constitute adequate notice for the specific identifier being captured.

AI TimeClock

Employee Time Clock

Turn any iPad or tablet into an affordable UKG time clock.

Learn More

The purpose and retention schedule. “Time and attendance tracking via UKG integration” states the purpose with appropriate specificity. The retention schedule should state exactly when biometric data will be destroyed — typically when the employment relationship ends or within three years of collection, whichever comes first — not merely reference a separately posted policy.

Every named downstream processor. This is the section most consent forms omit. If the time clock vendor’s cloud stores the facial templates, that vendor is named. If facial data or derived authentication tokens are transmitted to the employer’s UKG tenant, that disclosure needs to be authorized. If the time clock vendor uses a third-party AI inference engine for spoof detection, that processor appears by name. The consent form needs to match the actual data flow — not a generic description of “our time clock vendor.” The principle that attestation documentation must be specific and contemporaneous applies with equal force to BIPA consent: a generic form signed before the specific processors existed does not authorize the current data pipeline.

A mechanism for updates. Best practice is a consent form that explicitly states the employee will be notified and asked to re-consent if new processors are added to the data pipeline. This creates a defined process for the vendor change and platform migration scenarios that would otherwise create new disclosure exposure.

The UKG Partnership Argument That Backfires

One of the most common assumptions HR teams make when deploying a UKG-integrated biometric time clock is that the vendor’s UKG Technology Partner status means the privacy compliance is handled at the partnership level. It is not.

UKG’s partner program covers technical interoperability — the punch data format, the API connection, the sync logic. It does not extend indemnity for BIPA compliance to the partner’s biometric data collection and processing on the employer’s behalf. The employer is the data controller for BIPA purposes. When an employee brings a BIPA claim for a missing subprocessor disclosure, the claim is against the employer — not against UKG and not against the clock vendor.

This matters practically because the consent form and the BIPA policy are the employer’s responsibility to draft, update, and re-execute whenever the data pipeline changes. The partner badge confirms the technical integration works. It does not confirm the consent form names the partner’s cloud infrastructure as an authorized subprocessor. Assumptions that vendor integrations handle compliance automatically are a recurring source of timekeeping and payroll errors — BIPA is the same pattern at the privacy layer.

Auditing Your Current BIPA Posture

Map the data flow first. Before reviewing consent forms, document where biometric data goes from the moment of capture to destruction: on-device template storage, clock vendor cloud, UKG punch transmission, payroll sync, AI processing. Every step that touches the data is a potential Section 15(d) disclosure that needs authorization.

Match consent forms to the data flow. For every processor in the data flow, confirm it appears by name in the signed consent form. A processor not named in the consent is a disclosure violation for every transmission that has already occurred. Multi-location UKG configurations that process Illinois employees’ data through shared infrastructure across state lines need to confirm that the Illinois-specific consent covers the shared infrastructure.

AI TimeClock

Employee Time Clock

Replace expensive UKG time clock hardware with AI-powered tablets.

See How

Confirm pre-scan execution timestamps. The consent record must predate the enrollment biometric capture. A consent form signed on day three of employment, when biometric clock-in started on day one, does not cover the first two days of scans. Pull the enrollment timestamps from your time clock system and compare them to the consent signature dates in your HR records.

Audit destruction practices for former employees. Biometric data for employees who left more than three years ago must already be destroyed. Retained biometric data past the policy’s destruction date is a BIPA violation independent of the original consent. The compounding cost of errors that go undetected until litigation applies here — destruction policy violations discovered in discovery are worse than the same violations discovered in an internal audit.

How CloudApper AI TimeClock Closes the BIPA Enrollment Gap

CloudApper AI TimeClock for UKG runs on standard Android tablets or iPads and syncs directly with UKG Ready and Pro WFM. The facial recognition capability is included in licensing — making tablet-based biometric time tracking accessible at roughly 25% of the cost of proprietary UKG Intouch hardware. For Illinois employers, the terminal-level BIPA enrollment workflow is what makes that capability deployable.

When an employee is enrolled in facial recognition at a CloudApper AI TimeClock terminal, the enrollment workflow surfaces the required BIPA disclosures before the facial template is captured: the specific biometric identifier, the purpose and retention schedule, and the named downstream processors. The employee acknowledges each element. The acknowledgment is tied to the employee’s identity, timestamped, and synced to UKG as part of the time clock profile. The consent event precedes the biometric capture — the sequence BIPA requires — and the record is retained and accessible for audit and litigation response.

AI TimeClock

Employee Time Clock

Capture employee time accurately with a smarter UKG time clock.

Get Started

When the data pipeline changes — a new cloud integration, a processor update — CloudApper AI TimeClock can surface a re-consent workflow at the terminal for affected employees, creating a new acknowledgment record tied to the updated disclosure. This directly addresses the disclosure exposure that begins when a new processor relationship starts.

CloudApper AI TimeClock’s 24/7 AI assistant also allows employees to ask questions about the biometric program at the terminal — what data is collected, where it goes, how to request deletion — in plain language, in the employee’s preferred language. For Illinois workforces with questions about the biometric data they consented to provide, routing those answers through the terminal rather than HR reduces queue volume and creates a documented record of the information the employee received. The broader compliance advantages of biometric time clocks in UKG environments are well-established; BIPA-compliant enrollment workflow is the prerequisite for capturing those advantages legally in Illinois.

Frequently Asked Questions

Q: Does BIPA apply to facial recognition time clocks used by Illinois employees?

Yes. BIPA applies to any private entity that collects, captures, or stores biometric identifiers from Illinois residents. Facial geometry — the unique facial measurements captured during a facial recognition scan — is a biometric identifier under BIPA. If your UKG-integrated time clock uses facial recognition at Illinois locations, BIPA applies to every scan.

AI TimeClock

Employee Time Clock

Simplify employee time capture with an affordable UKG tablet time clock.

Explore Now

Q: Do we need to name our biometric time clock vendor in the BIPA consent form?

Yes. Section 15(d) of BIPA prohibits disclosing biometric data to third parties without the employee’s written consent. Your time clock vendor, their cloud infrastructure provider, and any other processor that receives biometric data are third parties for BIPA purposes. A consent form that authorizes the employer to collect biometric data but does not specifically authorize disclosure to the named processors handling that data is likely deficient under Section 15(d).

Q: How do Cothron v. White Castle and the 2024 BIPA amendment affect exposure?

The Illinois Supreme Court held in Cothron (2023) that a separate BIPA claim accrues each time biometric data is collected or transmitted without prior consent. In August 2024, Illinois amended BIPA so that repeated collection or disclosure of the same biometric identifier from the same person, using the same method, counts as a single violation. Exposure is now generally measured per person, at up to $1,000 for negligent and up to $5,000 for intentional or reckless violations, rather than per scan.

AI TimeClock

Employee Time Clock

Modernize UKG time tracking with AI-powered time capture.

Book a Demo

Q: What happens to BIPA consent obligations if we switch biometric time clock vendors?

A vendor change requires updating the consent form to name the new vendor and their processors, and re-executing that updated consent with all enrolled employees before the new vendor’s system begins processing biometric data. Employees who continue scanning during a platform migration, without updated consent naming the new processor, generate fresh Section 15(d) exposure for the transition period.

Q: Can employees be required to use biometric time clocks as a condition of employment in Illinois?

BIPA does not explicitly prohibit making biometric time clock use a condition of employment, but consent obtained under coercion may be challenged by plaintiff-side firms. Providing alternative clock-in options — PIN, badge, QR code — reduces the coercion argument and is best practice for Illinois biometric time clock programs.

Q: Does BIPA compliance transfer from the time clock vendor to the employer?

No. The employer is the data controller for BIPA purposes. A time clock vendor’s UKG Technology Partner status covers technical interoperability, not BIPA indemnity. The employer is responsible for drafting, distributing, and maintaining the consent form, the public retention policy, and the destruction schedule — regardless of which vendor’s terminal is capturing the biometric data.

Q: How long must BIPA consent records be retained?

Biometric data must be destroyed when the employment relationship ends or within three years of collection, whichever comes first. Consent records should be retained for at least five years after the last biometric scan associated with that consent, given that Illinois courts have applied a five-year limitations period in some BIPA cases. The records need to be producible in discovery — not just filed in an HR system that no longer has the original employee profile active.

Closing

The BIPA consent form most Illinois employers have on file covers the employer’s collection of biometric data. What it usually does not cover is the pipeline that data flows through after the scan — and a disclosure to a processor the form never named is a violation in its own right. The exposure is not in the absence of a form. It is in the gap between what the form says and where the data actually goes.

If your Illinois UKG locations are running facial recognition time clocks without a BIPA enrollment workflow that names every downstream processor and executes before the first scan, the gap is the exposure. Explore how CloudApper AI TimeClock for UKG handles BIPA-compliant biometric enrollment at the terminal: https://ukg.cloudapper.ai/affordable-ukg-kronos-time-clock/