Start a project
Menu
ServicesAll servicesCybersecurityCloud EngineeringApplication ServicesEnterprise PlatformsData & AnalyticsAI & Machine LearningInternet of ThingsMobilize Talent
PlatformsAll platformsIdentity and accessPrivileged access and secretsERP, HCM and financeCRM, ITSM and automationHealthcareInsurance and bankingData and integrationCloud and AIIndustrial, utilities and mainframeSkills matrix
Case studiesAll case studiesIdentity and accessPrivileged accessSecurity operationsCloud and infrastructureApplicationsERP and HCMCRM, ITSM and automationIndustry platformsData and analyticsAI and agents
IndustriesAll industriesEnergy, oil & gasHealthcare payersBanking & financial servicesInsurancePublic sectorManufacturingLocations
InsightsField notesLearning tracks
CompanyAbout CohashPortfolioSkills matrixCareersTrust and securityContact
Start a project
locations · chicago

In Illinois, a fingerprint time clock is a legal decision before it is an IT one.

Chicago clients bring a question most states don't force. An identity team wants face login, palm scanners on the plant floor or voice ID in the call center. Illinois says not yet. First comes written notice, a stated purpose, a retention schedule and a signed release.

Talk to an engineer
work in chicago6 services
4 local rules covered below
in short·15-second read

Our Chicago clients are trading firms, hospitals and manufacturers, and Illinois law shapes most of what we build.

Biometric sign-in has to follow BIPA's consent and retention rules. Trading and clinical systems need privileged access controls. If AI touches hiring, the Human Rights Act notice duty applies. We're headquartered in Frisco, Texas and work with Illinois teams remotely and on site.

Our headquarters is in Frisco, Texas, and we have no Chicago office. Illinois engagements run remotely with on-site visits for discovery, floor walks at plants or hospitals, and go-live.

Ask an engineer facts checked 2026-10-20 · 7 sources
rules
Biometric Information Privacy ActPersonal Information Protection ActIllinois Human Rights Act §2-102 , AI in employmentArtificial Intelligence Video Interview Act
background
Every entitlement translated into business terms Auto-certified by policy unchanged and peer-aligned Ranked exceptions SoD conflicts first Revoke and verify proof logged with the decision
field note · 5 minThe access review nobody dreads
chicago by the numbers

What's specific about Chicago

Each figure comes from a public source, linked on the card.

01 805,600

BLS counted about 805,600 education and health services jobs and 409,500 manufacturing jobs in the Chicago-Naperville-Elgin metro in September 2026 (preliminary). The whole metro has roughly 4.77 million nonfarm jobs.

source ↗ 02 302,900

The same BLS release puts financial activities at about 302,900 jobs in the Chicago metro, and Cboe Global Markets runs its global headquarters out of the city's Old Post Office building.

source ↗ 03 $1,000

BIPA damages run $1,000 per negligent violation and $5,000 per intentional or reckless one. The 2024 amendment made repeated scans of the same person by the same method a single violation.

source ↗ 04

On 1 April 2026 the Seventh Circuit held in Clay v. Union Pacific that the 2024 BIPA damages amendment applies retroactively to pending cases.

source ↗ 05

Since 1 January 2026, the Illinois Human Rights Act treats AI that discriminates in hiring, promotion or discharge as a civil rights violation, and zip codes used as a proxy for protected classes count.

source ↗
who and what

Who we work with in Chicago, and the rules they work under

industries

  1. Trading firms and exchanges

    Proprietary trading shops and exchange operators run low-latency systems, and nobody wants an extra authentication hop on them. So the controls go somewhere else. Privileged access to production trading hosts runs through a vault with just-in-time elevation. API keys to market venues get inventoried, given an owner and rotated on a schedule.

  2. Hospitals and health systems

    Clinicians want tap-and-go or a badge at shared workstations. Some vendors will pitch fingerprint or face instead, and in Illinois that brings BIPA along. We put proximity badge with PIN, FIDO2 keys and biometrics on one page, next to the consent and retention work each one would cost you.

  3. Manufacturers

    Plenty of plants around Chicago still run biometric time clocks and shared HMI logins. We either replace them or document them properly. We also split operator identities from engineering accounts and put remote vendor access to industrial systems behind recorded sessions.

regulations

  1. Biometric Information Privacy Act (740 ILCS 14) ↗

    In Illinois, a private entity can't collect a fingerprint, face geometry or voiceprint until the person has it in writing what it's for and how long it will be kept, and has signed a release. E-signatures count since 2024. You also need a public retention and destruction policy. Individuals can sue.

  2. Personal Information Protection Act (815 ILCS 530) ↗

    Residents must be notified of a breach without unreasonable delay. If more than 500 Illinois residents are affected, the Attorney General must be told no later than the consumer notices, with a description, the count and remediation steps.

  3. Illinois Human Rights Act §2-102(L), AI in employment ↗

    From 1 January 2026, an Illinois employer can't use AI with a discriminatory effect in employment decisions, and has to tell employees when AI is used on them. The Department of Human Rights writes the notice rules.

  4. Artificial Intelligence Video Interview Act (820 ILCS 42) ↗

    If you score recorded video interviews with AI for Illinois-based jobs, the applicant has to know first. Tell them how the AI evaluates them and get their consent before the interview.

services

Most requested in Chicago

The services clients in Chicago ask us for most.

you are hereChicago
01Does Windows Hello or phone face recognition trigger BIPA?

It depends on where the biometric template lives and who can access it. Platform authenticators that keep the template on the device are treated differently from a vendor system that stores scans centrally. We document the data flow for your counsel so they can make the call, and design around central storage where possible.

02What did the 2024 BIPA amendment change for identity teams?

Damages now accrue once per person per collection method rather than per scan, and electronic signatures count as a written release. The consent, notice and retention duties did not change, so a daily-scan time clock without a signed release is still a problem.

03Can you help a hospital move to badge-based clinical login?

Yes. Shared workstations get proximity badge plus PIN, or FIDO2, wired into the EHR and SSO. We only keep biometrics on the table where the consent process is already running.

04Do you work with trading firms on latency-sensitive systems?

Yes, carefully. We keep new authentication off the order path and put the controls on administrative access, deployment pipelines and market-venue credentials.

elsewhere

Other cities we cover

All 82 cities
AtlantaPayments & payers New YorkNYDFS-regulated finance AustinTech & state government Dallas–FriscoBanking, fintech, telecom (HQ) HoustonEnergy & pipelines
sources 7 sources linked last checked 2026-10-20 content fingerprint 83f1f6f6
  1. 01BLS, Chicago-Naperville-Elgin economy at a glancebls.gov ↗
  2. 02Cboe Global Markets headquarters announcement (2019)ir.cboe.com ↗
  3. 03740 ILCS 14/15 and 14/20 (BIPA)ilga.gov ↗
  4. 04Sidley Data Matters, Seventh Circuit on BIPA amendmentdatamatters.sidley.com ↗
  5. 05815 ILCS 530/10 (PIPA)ilga.gov ↗
  6. 06775 ILCS 5/2-102 (Human Rights Act)ilga.gov ↗
  7. 07820 ILCS 42/5 (AI Video Interview Act)ilga.gov ↗
Reviewed by the Cohash team Product names are trademarks of their owners. how we handle facts and data →
next step

Tell us what you're running. We'll tell you what we'd do first.

A 30-minute working session with a senior engineer. No slides.

Book a working session See the case studies
useful to bring
  • The platform and the version you're on
  • Where you need to get to, and by when
  • What's custom: rules, plugins, integrations
  • Any audit finding or deadline driving it