IL HB2411

Adds new restriction prohibiting private entities from requiring customers or persons to provide biometric identifiers or biometric information as a condition for receiving goods or services, except as necessary for employers to conduct background checks or implement employee security protocols.

Exempts medical services companies, law enforcement agencies, and governmental entities from the new biometric collection restrictions.

Requires private entities possessing biometric data to develop written policies establishing retention schedules and guidelines for permanently destroying biometric identifiers within 3 years of last interaction or when the initial collection purpose is satisfied.

Prohibits private entities from selling, leasing, trading, or profiting from biometric information and restricts disclosure except with subject consent, to complete authorized financial transactions, when required by law, or pursuant to valid court warrant or subpoena.

Requires private entities to store, transmit, and protect biometric information using reasonable industry standards and in a manner at least as protective as how they handle other confidential and sensitive information.