In a move that will be unwelcomed by plaintiffs’ lawyers, Illinois has enacted an amendment to its biometrics privacy law – the Biometric Information Privacy Act (“BIPA”) – to provide that when a private entity that, in more than one instance, discloses, rediscloses, or otherwise disseminates the same biometric identifier or biometric information from the same person to the same recipient using the same method of collection, without the required prior notice and written release, it commits only a single violation for penalty calculation purposes, regardless of the number of times the data was disclosed, redisclosed, or otherwise disseminated. This will significantly reduce the potential damages and lower the settlement value of BIPA claims. The amendment also provides that an e-signature satisfies the written requirements for the release. “Electronic signature” means an electronic sound, symbol, or process attached to or logically associated with a record and executed or adopted by a person with the intent to sign the record[,]” thus clarifying that online “clickwrap” releases suffice. This amendment follows previous failed attempts at similar reforms to stem the fold of BIPA class action litigation that has plagued companies that have enacted fingerprint time cards or other biometric fraud and security measures without strictly complying with BIPA. Colorado recently enacted a BIPA-like biometrics law, but like other states except only Illinois, it does not have a privacy right of action and can only be enforced by the state. However, states are active in enforcing their privacy laws as illustrated by a recent Texas settlement with a social media company for biometric consent claims that included a 9-figure civil penalty payment.