IL HB4686

Changes "written release" to "written consent" in the Biometric Information Privacy Act and permits consent to be obtained electronically.

Requires written policies on biometric data retention and destruction be made available to the individual whose biometric information is collected, rather than to the general public.

Establishes a 30-day cure period: entities must be notified of alleged violations and have 30 days to cure the violation and provide written assurance before any lawsuit can proceed; cured violations prevent statutory damages.

Reduces damages for negligent violations from $1,000 per violation to actual damages only; limits willful violations to actual damages plus liquidated damages up to the amount of actual damages (previously $5,000 per violation minimum).

Exempts private entities whose employees are covered by collective bargaining agreements with different biometric information policies from the Act's requirements.