Illinois ID scanning laws

Is it legal to scan IDs in Illinois?

Illinois does not treat every type of ID scanning the same way.

The state has a specific restriction on possessing or using hardware or software designed to read encrypted information from the barcode or magnetic strip of an Illinois-issued driver's license or state ID.

The law also contains exceptions, including when:

For venues, this means the legality of an ID-reading setup can depend on the credential, the technology being used and the reason the information is being read.

Do you have to check IDs in Illinois, and when?

It depends on what you sell. Scanning is required for cannabis, but not generally for alcohol or tobacco.

Which IDs provide protection in Illinois?

Illinois alcohol law is not limited to a short list of specific ID types.

The law describes adequate written evidence as identification issued by a federal, state, county or municipal government. It provides examples, but the list is not exclusive.

That means the focus is generally on whether the customer presents qualifying government-issued evidence of identity and age rather than whether the document appears on a short list of approved credentials. Separate rules can apply to how information from a particular credential is scanned or used afterwards.

Can you keep data from an ID scan in Illinois?

Yes, but what you can do with that information is limited.

Illinois does not set a general retention period for ID information collected by an alcohol venue. Instead, the law limits how that information may be used.

Information collected from an ID may generally be used to:

It may not be reused for unrelated purposes such as commercial solicitation. Illinois also restricts selling, leasing or sharing the information with third parties, apart from specified uses related to detecting or prosecuting crime or fraud.

This matters for repeat visits. Information originally collected for one transaction should not automatically become a reusable customer profile for future visits without the customer's express permission.

Customers can bring a private claim for violations, with statutory damages and legal fees available under the law.

What other Illinois laws reach the data you keep?

Illinois also has data security and biometric privacy rules that may apply depending on what your venue collects.

Keeping someone's name together with a driver's license or state ID number can bring Illinois data-security requirements into play. Biometric information is treated separately.

Illinois's Biometric Information Privacy Act, commonly known as BIPA, covers specific biometric identifiers and information. A photograph by itself is excluded from the statutory definition.

If a business collects a covered biometric, additional requirements apply before collection, including notice, disclosure of the purpose and retention period, and a written release. So simply reading information from an ID barcode is different from separately collecting biometric information from the person presenting it.

Does scanning give you a defense if you serve a minor in Illinois?

No. For alcohol, using a scanner does not itself create the statutory protection.

Illinois protects an alcohol licensee who requests identification, is shown adequate written evidence and reasonably relies on it. That protection can apply both to a criminal case and to proceedings involving the alcohol license. What matters is the identification presented and the venue's reasonable reliance on it, not whether a scanner was used.

Cannabis is different. Illinois has separate rules requiring ID scanning for dispensaries and provides protections specific to that process.

Can a customer refuse an ID scan in Illinois?

Illinois does not specifically address a customer's refusal to scan a physical ID.

For alcohol, a venue can still require adequate evidence of identity and age where an ID check is necessary. Illinois is more specific about mobile credentials. A business cannot require someone to present a mobile ID instead of a physical credential.

When a customer does use a mobile ID, the business also cannot require them to hand over possession of their phone, and presenting the credential does not give permission to access other information on the device.

Does Illinois biometric privacy law apply to ID scanning?

Reading an ID barcode by itself does not make the scan biometric.

BIPA covers specific biometric identifiers and biometric information, including fingerprints, voiceprints, retina or iris scans and scans of hand or face geometry. Photographs are excluded from the definition. If a venue separately captures a covered biometric, BIPA requirements can apply.

Before collecting it, the business generally needs to:

For venues, the important distinction is between reading information from the ID and collecting biometric information from the customer.