[asdfasgasdgasdg]

Whose consent is needed, according to the law? The person who took the photos, or the person being photographed? And is the consent required only if the product is used in Illinois? Or if the photo is taken in Illinois? Or if the person photographed is a resident of Illinois?

(I read the law, and it appears to cover the person being photographed, if the photograph is taken in Illinois. So basically according to the law Google ought not build face models from photographs taken in Illinois, except of people who have consented.)

I wonder if in the broadest configuration (basically any configuration other than "consent of the user, who is a resident of Illinois"), this law would probably be struck down as an unconstitutional restraint on interstate commerce? I guess we'll see! Should be exciting.

[voxic11]

BIPA requires the consent of the person that the biometrics identify. However it specifically excludes photographs from the definition of biometric information so its not clear how it applies in this case.

[lmkg]

It excludes photographs, but includes certain data derivable from photographs. Storing the photograph is not a violation, but the lawsuit alleges that the facial recognition software that Google runs constitutes a violation.