Illinois BIPA compared with Washington My Health My Data for face scans

What to take away

• Creator rights and image consent online now hinge on two state statutes: the Illinois Biometric Information Privacy Act and the Washington My Health My Data Act.
• BIPA requires a written release before a face scan, plus a public retention and destruction schedule, and it carries a private right of action.
• Washington's My Health My Data Act (RCW 19.373) covers consumer health data, including biometric data used to identify someone, and is enforced by the Washington attorney general.
• AR filters, face swaps and beauty effects collect face geometry, so both laws can apply to the same app depending on where the user lives.
• Consent notices and deletion records are the practical compliance work: capture the release, set a retention period, and honor withdrawal.

Two state biometric and health data laws that reach creator face scans

Face scans stopped being a novelty feature. Every AR filter that maps your cheekbones, every face swap that tracks a jawline, and every beauty effect that measures skin tone is collecting measurements of a human body.

Two states treat that collection as regulated data. Illinois passed the Illinois Biometric Information Privacy Act, usually called BIPA, in 2008. Washington passed the My Health My Data Act in 2023, codified at Chapter 19.373 RCW.

They are not twins. BIPA is a biometric privacy statute with a narrow definition and a private lawsuit right. My Health My Data is a consumer health privacy statute with a broad definition and public enforcement.

A creator or app developer serving users in Illinois and Washington has to satisfy both. The overlap is where most compliance failures happen, because a notice that satisfies one statute often misses a duty in the other.

This comparison walks through consent, retention, enforcement and drafting, with the specific duties named.

Why creators and filter developers are in scope

BIPA applies to any private entity that collects a biometric identifier. A small AR effects studio is a private entity. So is a solo creator shipping a face filter through a social platform's effect tool.

My Health My Data applies to regulated entities that determine why and how consumer health data is processed, and to small businesses with limited exceptions. A filter that infers health conditions, such as acne, fatigue or heart rate, pulls the creator into the health data category.

Neither law asks whether you meant harm. Collection alone triggers the duty.

Where the two laws diverge

BIPA regulates a specific list of biometric identifiers: retina or iris scans, fingerprints, voiceprints, hand geometry, face geometry, and anything else that identifies a person by a physical characteristic.

My Health My Data regulates consumer health data, which includes biometric data collected with the consumer's consent or used to identify a specific consumer. That is a wider net, and it reaches data that is not a face scan at all.

For a creator, the practical result is this: a face filter is squarely a BIPA question, and the same filter may also be a health data question if the output says anything about the user's body or mind.

A studio shipping one effect into Illinois and Washington ends up in two forums. BIPA suits are filed in Illinois courts, including the Northern District of Illinois, while My Health My Data enforcement runs through the Washington attorney general in Olympia.

Illinois BIPA: written consent, retention schedule and destruction duties

The core BIPA duty is simple to state. Before collecting a face scan, an entity must inform the person in writing that biometric data is being collected, state the specific purpose and length of term, and obtain a written release.

The Written release requirement under BIPA is the piece most creators miss. A checkbox buried in a general terms of service is not a written release for biometric data. The release has to be its own informed authorization.

The statute also requires a publicly available Retention and destruction schedule. You must say how long you keep biometric data and when you destroy it, and the schedule has to be available to the public, not just to lawyers.

Destruction has a deadline. When the initial purpose for collecting the data is satisfied, or within three years of the person's last interaction with the entity, whichever comes first, the data must be destroyed.

That deadline is the reason a filter that stores face templates indefinitely is a problem. A stored template has no natural end, so the three-year ceiling becomes the operative rule.

What a compliant BIPA release contains

1. A plain statement that face geometry or another biometric identifier is being collected.
2. The specific purpose, such as applying an AR effect or measuring fit.
3. The length of term the data is kept.
4. A signature or other written affirmation from the person.
5. A reference to the public retention schedule.

The retention schedule in practice

A retention schedule is a document, not a policy sentence. It should list each biometric data type, the purpose, the retention period and the destruction method.

For a face filter, a defensible schedule might keep the face template only for the duration of the session and destroy it when the session ends. That is the cleanest position because it removes the storage question.

If you store templates for account features, name the period and the destruction trigger. Vague language such as "as long as needed" invites a claim.

Creators building effects that reuse a person's likeness across projects should treat the schedule as part of a broader set of rights questions, which the consent release license comparison covers in detail.

Washington My Health My Data: consumer health data and intimate data scope

The Washington My Health My Data Act (RCW 19.373) regulates consumer health data, a term defined broadly to include past, present or future physical or mental health status. It also covers biometric data and data used to identify a consumer for health-related purposes.

The statute adds a category that matters for creators: intimate data. That includes data about a consumer's intimate relationships, sexual orientation, gender identity, and reproductive or sexual health.

A face filter that infers gender identity or sexual orientation from appearance is collecting intimate data under this framing. So is a body scan that estimates reproductive status.

Consent under My Health My Data must be voluntary, specific, informed and unambiguous. It is opt-in, and the consumer can withdraw it at any time. Withdrawal must be as easy as giving consent.

Separate consent is required to collect and to share consumer health data. Sharing with a third party for advertising needs its own authorization, which rules out most default data flows in ad-supported filter apps.

The law also requires a privacy policy that names the categories of consumer health data collected, the sources, the purposes and the third parties receiving it. The codified text is available at Chapter 19.373 RCW:, and the full statutory code sits at the Revised Code of Washington (RCW).

Washington also has a separate My Health My Data geofencing provision that restricts tracking near health facilities, which can catch location data in creator apps.

Intimate data and creator content

Intimate data rules change the calculus for adult and suggestive content. A creator platform that collects body measurements, arousal signals or sexual health details is inside the statute.

Even a beauty app that asks about hormonal skin conditions can cross into health data. The question is not the app's category, it is what the data reveals.

Consent for intimate data has to be separate from general terms. Bundling it with a marketing opt-in fails the specificity test.

Small business treatment

My Health My Data exempts small businesses from some obligations, but the exemption is narrow and does not remove the core consent and privacy policy duties. Do not assume a small effects studio is outside the law.

How AR filters, face swaps and beauty effects trigger each statute

An AR filter runs a pipeline. The camera captures frames, a face tracker extracts landmarks, a model maps the geometry, and the effect renders over the face. Each stage touches regulated data.

The landmark extraction is the BIPA moment. Face geometry is a listed biometric identifier in Illinois, and the extraction is collection.

If the app stores the template or sends it to a server, BIPA's retention and destruction duties attach. If the app only processes on device and discards the template, the collection question narrows but does not vanish.

The health inference is the My Health My Data moment. If the effect labels the user's skin, mood, age or body type, the output is health data or intimate data.

Face swaps add a second person. A face swap that maps one person's face onto another person's body involves the biometric data of the source person and the likeness rights of the target person.

That is a different legal layer, and the child image consent compared breakdown helps separate a face swap from a composite or avatar before you pick a consent form.

Consent flow for a filter app

• Show a standalone biometric notice before the camera opens.
• Capture a written release for face geometry collection.
• Offer separate opt-in for any health or intimate data inference.
• Link the public retention and destruction schedule.
• Provide one-tap withdrawal and deletion.
• Log the consent version and timestamp.
• Confirm third-party sharing in the privacy policy.

Beauty effects and inferred conditions

A beauty effect that smooths skin is cosmetic. A beauty effect that scores acne severity is a health data product.

The same camera code can do both. The difference is the label, the output and the purpose you declare.

Declare the purpose narrowly. If you say the data is used to render an effect, do not quietly use it to train a model or target ads.

Retention, deletion and consent records compared state by state

Retention is where the two statutes pull apart. BIPA gives a public schedule and a three-year outer limit tied to last interaction. My Health My Data requires deletion when consent is withdrawn and limits retention to what is necessary for the stated purpose.

In both Illinois and Washington deletion is mandatory once the trigger fires, but the trigger itself is different, so a single deletion calendar will not cover users in each state.

Both require deletion on request. BIPA's mechanism is the destruction schedule. My Health My Data's mechanism is the consumer's withdrawal right plus the deletion request process.

Consent records differ too. BIPA wants a written release you can produce. My Health My Data wants proof that consent was voluntary, specific and informed, and that withdrawal was honored.

Duty	Illinois BIPA	Washington My Health My Data
Consent form	Written release before collection	Opt-in, specific, informed, unambiguous
Retention rule	Public schedule, destroy at purpose end or three years	No longer than necessary for stated purpose
Deletion trigger	Purpose satisfied or last interaction	Consent withdrawal or consumer request
Intimate data	Not a separate category	Covered, separate consent needed
Sharing	Notice and consent required	Separate consent to share
Enforcement	Private right of action	Washington attorney general

Build one record system that satisfies the stricter column. Store the consent text, the version, the timestamp, the scope and the withdrawal event.

A deletion log matters as much as a consent log. If you cannot show that you deleted the template when the user withdrew, the consent record does not save you.

Creators who license their face to a studio should treat deletion terms as contract terms. The image consent guide lists the fields to agree before any scan happens.

Private right of action under BIPA versus the Washington attorney general route

The BIPA private right of action is the reason this statute dominates biometric litigation. A person who is aggrieved can sue directly, without waiting for a regulator.

The statute provides for damages per violation, plus attorney fees and costs, and injunctive relief. Because the figures are set in the statute and can stack across users, exposure grows with the user base.

Washington takes a different path. The My Health My Data Act is enforced by the Washington attorney general under the state's Consumer Protection Act. There is no general private right of action in the statute for consumers to sue directly.

That does not make Washington softer. The attorney general can seek civil penalties and injunctive relief, and the office has built a technology and privacy enforcement practice. Its technology enforcement work is described at Technology | Washington State, and its consumer protection priorities appear at Safeguarding Consumers | Washington State.

For a creator, the difference is who knocks. In Illinois, a plaintiff's firm can knock on behalf of a class. In Washington, the attorney general knocks after an investigation.

Both routes reward documentation. A clean consent record and a real deletion log are the best defense in either forum.

Developers comparing state privacy regimes often look at California as a third reference point, and the California Codes: Search tool is a practical way to pull citable statutory text for side-by-side review.

What triggers scrutiny first

• A camera permission that opens before any notice.
• A privacy policy that never mentions biometric data.
• A retention schedule that does not exist or is not public.
• Templates stored after the session with no deletion date.
• Health or identity inferences used for ad targeting.

Creator rights and image consent online: drafting a filter consent notice for both states

One notice can serve users in Illinois and Washington if it is built to the stricter standard on each point. Draft it as a layered document: a short screen, a full notice, and a retention schedule.

The short screen states what is collected, why, how long and how to withdraw. The full notice carries the statutory detail. The schedule lists data types and destruction rules.

Write the notice in everyday words a user can act on. A release that a user cannot understand is weak evidence of informed consent in either state.

A worked example

Suppose a creator ships a face filter that maps facial geometry, stores a template for a week, and labels skin condition. The user is in Chicago and Seattle.

Step one: show a biometric notice before the camera opens, naming face geometry, the one-week retention period and the destruction date.

Step two: capture a written release for the face geometry, with the purpose stated as rendering the effect.

Step three: add a separate opt-in for the skin condition label, because that output is health data under Washington law.

Step four: publish the retention schedule, listing face templates, the one-week period and the deletion method.

Step five: provide one-tap withdrawal that deletes the template and stops the health inference, and log both events.

Step six: name any third-party processors in the privacy policy and confirm they are bound by the same deletion duty.

That flow satisfies the BIPA written release and the My Health My Data consent and withdrawal duties in one product.

Drafting rules that hold up

Name the data. Do not write "biometric information" when you mean face geometry.

Name the term. A retention period with a number is stronger than a promise to keep data briefly.

Name the withdrawal path. If withdrawal takes five screens, it is not as easy as consent.

Keep versions. When the notice changes, the old consent does not cover the new collection.

Run the review before launch. A structured platform image rights checklist or publishing any effect catches the gaps that a launch-week scramble misses.

Creators who also handle likeness rights, publicity and contractual limits should read the child image consent problems overview before signing a studio agreement, because biometric consent and image rights are separate permissions.

What to do this quarter

Audit every effect that touches a face or body. List the data collected, the storage location and the retention period.

Draft or update the written release and the public schedule. Add the separate health and intimate data opt-in.

Build the deletion log. Then test withdrawal yourself, on a real account, and confirm the template is gone.

Common questions

Does BIPA apply to a free AR filter with no revenue? Yes. BIPA applies to private entities that collect biometric identifiers, and it does not require a commercial transaction. A free filter that extracts face geometry is still collecting a regulated identifier in Illinois.

Is a face template stored on the user's own device covered? BIPA regulates collection and storage by the entity, so on-device processing narrows the exposure but does not automatically remove it. If the entity can access or retain the template, treat it as covered and document the retention period.

Can one consent screen satisfy both Illinois and Washington? Usually, if it is built to the stricter standard on each point. That means a written release for face geometry, a separate opt-in for health or intimate data, a public retention schedule, and one-tap withdrawal.

Does Washington's My Health My Data Act let consumers sue? The statute is enforced by the Washington attorney general rather than through a general private right of action. Consumers can complain to the attorney general, and enforcement proceeds under the state consumer protection framework.

How long can a creator keep a face scan under BIPA? Until the initial purpose is satisfied, or within three years of the person's last interaction, whichever comes first. A shorter period, such as session-only storage, is easier to defend and easier to document.

What happens if a user withdraws consent after a face swap is published? Withdrawal stops further processing and triggers deletion under Washington law, and it should trigger destruction under the BIPA schedule. It does not automatically remove an already published video, so pair the deletion with a takedown and removal process.