The complaint usually arrives with a number attached, and the number is designed to take your breath away. A former employee, now a class representative, says your company scanned her fingerprint every time she punched the clock. Multiply one finger scan by every shift, by every worker, across several years, and the demand letter floats an exposure figure that looks less like a lawsuit and more like a going-out-of-business sale. The message is not subtle. Settle now, settle big, and do not ask too many questions.

That message is a negotiating tactic. It is not a legal conclusion. The Illinois Biometric Information Privacy Act, 740 ILCS 14/1 and following, is a real statute with real teeth, and we do not pretend otherwise to our clients. But the law in this area has moved hard over the last three years, and a meaningful share of that movement has favored the defense. The Illinois business that understands the current landscape negotiates from a much stronger position than the business that reaches for the checkbook the day it is served.

Start with what the statute actually requires, because most demand letters blur it. BIPA regulates biometric identifiers and biometric information, which the Act defines to include fingerprints, retina and iris scans, voiceprints, and scans of hand or face geometry. Section 15(b) is the heart of most cases. Before a private entity collects that data, it must tell the person in writing that the data is being collected, state the specific purpose and the length of term for which it will be collected and stored, and obtain a written release. Section 15(a) requires the entity to publish a written retention and destruction policy and to destroy the data when the purpose is satisfied or within three years of the person’s last interaction, whichever comes first. Section 15(c) bars selling or profiting from the data. Section 15(d) restricts disclosure. Section 15(e) requires a reasonable standard of care in storage. Section 20 supplies the damages that make these cases attractive to the plaintiffs’ bar: liquidated damages of $1,000 for each negligent violation and $5,000 for each intentional or reckless violation, or actual damages if greater, plus attorney fees and an injunction.

For several years the Illinois Supreme Court read those provisions in ways that steadily raised the stakes. In Rosenbach v. Six Flags Entertainment Corp., the Court held that a person is aggrieved, and may sue, on the bare violation of the statute, with no need to plead an actual injury. In Tims v. Black Horse Carriers, Inc., the Court held that the generous five-year catch-all limitations period governs every BIPA claim. And in Cothron v. White Castle System, Inc., a divided Court held that a separate claim accrues with every scan and every transmission, not just the first one. Cothron is the decision that produces the eye-watering numbers, because it lets a plaintiff multiply a single fingerprint by years of daily punches.

Here is what the demand letters tend to leave out. The legislature answered Cothron. Effective August 2, 2024, Public Act 103-0769 amended Section 20 so that a private entity that collects or discloses the same biometric identifier from the same person using the same method commits a single violation, for which the aggrieved person is entitled to, at most, one recovery. The same amendment confirmed that an electronic signature satisfies BIPA’s written-release requirement. In plain terms, the per-scan multiplication that drove the catastrophic exposure figures was cut off at the knees for conduct going forward, and the recovery is now anchored to the person, not the punch.

The defense news did not stop there. In Clay v. Union Pacific Railroad Co., one of a set of consolidated appeals the United States Court of Appeals for the Seventh Circuit decided in April 2026, the court held that the 2024 damages amendment applies retroactively to cases that were already pending when it took effect. The court reasoned that the change was remedial rather than substantive, because it altered only the damages available and not the underlying standard of liability, and that Illinois courts apply remedial changes retroactively. For Illinois businesses defending claims premised on years of historical scans, that holding can transform the math the plaintiff has been counting on.

The amendment limits the size of the case. Several established defenses can dispose of it altogether or push it out of the forum the plaintiff wants. Three are worth understanding.

The first is the health care exemption. Section 10 excludes information collected, used, or stored for health care treatment, payment, or operations under HIPAA. In Mosby v. Ingalls Memorial Hospital, the Illinois Supreme Court read that exemption in the disjunctive and applied it to the fingerprints health care workers used to access medication dispensing systems for patient care. A hospital, clinic, or other provider sued over biometrics tied to patient care should look hard at Section 10 before conceding the statute even applies.

The second is federal labor preemption. In Walton v. Roosevelt University, the Illinois Supreme Court held that Section 301 of the Labor Management Relations Act preempts BIPA claims brought by union employees when the collective bargaining agreement contains a broad management-rights clause, because the dispute belongs in the grievance and arbitration process, not in court. For employers with a unionized workforce, and a management-rights clause is common, Walton can move the entire fight to a different arena. Continue reading ›

Every data incident in 2026 produces the same playbook. A plaintiffs’ firm files a class action. The complaint pleads breach of contract. It pleads invasion of privacy. It pleads a federal statutory claim. And, almost always, it pleads negligence.

The negligence count usually says some version of the same thing. The defendant owed a duty to safeguard the plaintiff’s personal information, the defendant breached that duty by allowing the data to be exposed or transmitted, and the plaintiff suffered damages including diminished data value, anxiety, lost time, and lost benefit of the bargain.

Illinois law has a problem with this count. Two problems, actually.

The first problem is that there is no freestanding common law duty in Illinois to safeguard another person’s data. The second problem is that even if there were such a duty, Illinois’s economic loss doctrine, known as the Moorman doctrine, would bar recovery for the kinds of damages plaintiffs typically plead.

Both problems are dispositive at the motion to dismiss stage when the defense is built carefully.

The duty problem is settled by the Seventh Circuit. In Community Bank of Trenton v. Schnuck Markets, Inc., the court held that the Illinois Supreme Court has not recognized an independent common law duty to safeguard personal information. The court applied that holding to a data breach class action and dismissed the negligence claim. The Illinois Appellate Court reached the same conclusion in Cooney v. Chicago Public Schools, where the court rejected an attempt to use HIPAA, the federal medical privacy statute, as the source of a state law duty to safeguard data.

These holdings are not technicalities. They are reflections of how the duty element works in Illinois negligence law. A duty does not arise from a vague feeling that information should be protected. A duty arises from a relationship recognized by law, a statute that creates a private cause of action, or a common law rule the Illinois Supreme Court has actually adopted. When none of those exists, there is no duty, and there is no negligence.

Plaintiffs sometimes argue that the physician patient relationship, the merchant customer relationship, or the employer employee relationship is enough. Federal courts in Illinois have rejected those arguments in the data context. In Doe v. Genesis Health System, decided in 2025, the Central District of Illinois applied Community Bank and Cooney directly to a healthcare website tracking case and dismissed the negligence count. The court explained that the relationship based theory does not change the rule. If the Illinois Supreme Court has not recognized the duty, a federal court sitting in diversity will not invent it.

The second problem is the Moorman doctrine.

Moorman Manufacturing Co. v. National Tank Co. is one of the most cited cases in Illinois law. The Illinois Supreme Court held in 1982 that a plaintiff cannot recover in negligence for purely economic loss. Economic loss means losses that are not personal injury and are not damage to other property. Diminished data value is economic loss. Lost benefit of the bargain is economic loss. Lost time is economic loss. Anxiety and emotional distress are not personal injuries in this context. Each of those theories runs into the Moorman bar.

The reason this matters is that data class action complaints almost always allege economic loss as the principal damage theory. Without economic loss damages, the negligence count loses most of its monetary value. Without an actual breach of contract or a separate statutory cause of action, the case shrinks dramatically.

Three points are worth highlighting for any Illinois business defending a data related lawsuit. Continue reading ›

A new wave of class action lawsuits is sweeping into the Northern District of Illinois. The defendants are not telecom companies. They are healthcare practices, retailers, fintech companies, telehealth platforms, employers running candidate portals, and any business with a website that uses analytics or advertising tools.

The legal theory is the same in almost every case. The plaintiff alleges that a tracking pixel, often the Meta pixel, the TikTok pixel, or the Google tag, captured information the user typed into the defendant’s website and quietly transmitted that information to a third party advertising platform. The plaintiff then alleges that this transmission violated the federal Electronic Communications Privacy Act, also known as the Wiretap Act, 18 U.S.C. section 2511.

The financial pressure of these cases is enormous. The Wiretap Act allows statutory damages of the greater of $100 per day or $10,000 per plaintiff, plus attorney fees. Multiplied across a putative class of website visitors, the demand letter is designed to force a settlement. That math is the plaintiffs’ bar’s business model.

There is a powerful defense to most of these cases. It is called the party exception, and Illinois federal courts are increasingly willing to enforce it.

The party exception is not buried in a regulatory annex. It is in the statute itself. 18 U.S.C. section 2511(2)(d) provides that the prohibition on intercepting electronic communications does not apply where one of the parties to the communication has consented, or where the defendant is itself a party to the communication. When a customer or patient fills out a form on your website, the customer’s communication is being directed at you. You are not eavesdropping on someone else. You are the recipient.

That sounds obvious. It is also dispositive in most pixel cases when the defense is properly pleaded.

The Northern District of Illinois has issued a series of decisions applying this exact logic. In Kurowski v. Rush System for Health, the court held that Rush, not Facebook or Google or a downstream ad platform, was the intended recipient of the patient communications submitted through Rush’s website and patient portal. Sloan v. Anker Innovations Ltd. went further, holding that even where a defendant later uploads information to a third party server, the defendant remains a party to the original communication, not a non party interceptor. The Zak v. Bose Corp. line of cases rejected the plaintiffs’ bar’s relabeling tactic of recasting the website operator as a redirector of someone else’s data flow. And in Doe v. Genesis Health System, the court explained the principle in plain language. The communications could not have occurred without the plaintiff communicating with the defendant as the intended recipient and party.

What this means in practice is that when a plaintiff sues your business for embedding analytics on your own website that collected information the plaintiff voluntarily submitted to your business, you have a real defense at the motion to dismiss stage. The defense does not require discovery. It does not require expert testimony. It requires careful pleading and an early motion that frames the issue correctly. Continue reading ›

If you operate a healthcare practice, a telehealth platform, a behavioral health clinic, a fertility center, an addiction treatment facility, a dental or optometry chain, or any consumer facing business that handles sensitive information online, you have probably heard about the new generation of class action lawsuits over tracking pixels.

The lawsuits target businesses that embed third party tools like the Meta pixel, the TikTok pixel, or Google Analytics on their websites. The complaints allege that the tools captured information about a user’s interactions and transmitted that information to advertising platforms without consent.

In most of these cases, the defendant has a strong defense built into the federal Wiretap Act itself. When a user submits information to your website, you are a party to the communication, and 18 U.S.C. section 2511(2)(d) excludes parties from liability under the statute.

Plaintiffs know about that defense, so they have a workaround. They invoke the same subsection’s other clause, the so called crime tort exception. It provides that the party exception does not apply if the communication was intercepted for the purpose of committing any criminal or tortious act. Plaintiffs typically plead a HIPAA violation, an invasion of privacy claim, or both, as the predicate.

The question is whether this workaround survives.

That question is now actively splitting the federal courts in Illinois. The split is real, current, and important enough that one judge has already certified it for interlocutory appeal.

In the defense friendly camp, Doe v. Genesis Health System, decided by the United States District Court for the Central District of Illinois in 2025, held the answer is no. The court read the statute carefully and concluded that the defendant must have intercepted the communication for the purpose of committing a crime or a tort. Marketing and advertising purposes, the court held, do not satisfy that standard, because lawful commercial activity, even when it ultimately runs afoul of HIPAA’s regulatory scheme, is not the same as acting in order to commit a crime or tort. The Seventh Circuit articulated a similar principle years earlier in Thomas v. Pearl and again in Desnick v. American Broadcasting Cos. The recorder must intend to break the law or commit a tort. That intent is the heart of the carve out.

Doe 1 v. Chestnut Health Systems, Inc., decided in 2025, took the same path and dismissed a complaint that recited criminal or tortious purpose in conclusory terms. The court held that a conclusory recital will not do.

In the plaintiff friendly camp, Stein v. Edward-Elmhurst Health, decided in 2025, went the other way. The court held that a HIPAA violating disclosure can satisfy the carve out even when the defendant’s overall purpose was lawful commercial advertising. The same court later denied reconsideration but explicitly certified the question for interlocutory appeal, finding substantial ground for difference of opinion. That certification is itself a tell. When a federal trial court is comfortable enough with the strength of the opposing view to permit an immediate appeal, the law is genuinely unsettled.

What does this mean for Illinois businesses? Three things. Continue reading ›

The deal closed on a Friday. The selling dealer went to Naples. The buyer took the keys on Monday, and by Wednesday was staring at a floor plan audit showing twenty units short, a used-car inventory valued two hundred thousand dollars below the closing schedule, and a working-capital adjustment the seller’s accountant had, in the buyer’s view, quietly gerrymandered. The buyer calls us. So does the seller, a week later, demanding the earn-out the buyer now refuses to pay.

This pattern repeats across Illinois dealership deals. Our earlier post on the five critical clauses every Illinois dealer needs in a buy-sell agreement addressed what the agreement itself must contain. The next battleground is the one that opens after the agreement is signed. Post-closing disputes between dealer principals are where deals go to die, and they fall into three familiar buckets: working-capital adjustments, indemnification claims, and earn-outs.

Working-capital adjustments are the first and most common flashpoint. Nearly every dealership asset purchase agreement includes a true-up mechanism tied to a target net working capital figure, measured as of closing and adjusted within 60 or 90 days. The seller’s preliminary closing statement anchors the seller’s position. The buyer then issues a dispute notice identifying line-item disagreements. If the parties cannot negotiate those, the agreement usually routes the remaining items to an independent accounting firm sitting as arbitrator. The fights cluster around a short list of items. New-vehicle inventory valued at dealer cost versus MSRP less holdback. Aged used units written down or not. Contracts in transit counted as receivables. Warranty receivables from the manufacturer treated as accounts receivable. Parts inventory counted at cost or marked down for obsolescence. In our experience, the buyer who does not send a manager to physically count inventory the night before closing is the buyer who pays too much. The seller who does not require the accountant to sign off on the closing-date balance sheet before wiring the funds is the seller who litigates for the next eighteen months.

The phone call comes on a Sunday afternoon. The F&I director has resigned, effective immediately. On Monday, she starts at the crosstown competitor. By the following week, three F&I products the dealer offered her team are discounted next door, customers are calling to cancel service contracts, and the general manager notices her laptop was “imaged” the week before she left. The dealer principal wants to know two things. Can he stop her? And can he recover what she took?

Illinois law gives dealers real tools here, but the rules changed in 2022, and the rules for dealership employees are not intuitive. A careless cease and desist letter, or worse, a lawsuit filed on the old assumptions, can convert a winning case into a fee-shifting loss.

Start with the non-compete itself. Since January 1, 2022, the Illinois Freedom to Work Act, 820 ILCS 90/1 et seq., governs the enforceability of restrictive covenants for Illinois employees. The statute prohibits non-competes against employees earning $75,000 or less annually, and prohibits customer and coworker non-solicitation covenants against employees earning $45,000 or less annually, with threshold increases scheduled through 2037. The Act also requires that the employer advise the employee in writing to consult with an attorney before entering into the covenant, and requires that the employee receive the agreement at least 14 calendar days before commencement of employment or have at least 14 calendar days to review it. An agreement that does not satisfy the salary threshold, the attorney-consultation advisement, and the review period is unenforceable. The Act authorizes a prevailing employee to recover attorney fees. A dealer who sues on a covenant that does not meet the statutory floor risks paying the other side’s legal bills.

The allocation spreadsheet arrives on a Monday morning. Two crosstown competitors received the inventory the dealer ordered months ago. The factory’s stair-step bonus program pays a per-unit kicker the dealer cannot possibly hit because the dealer cannot get the cars to sell. Then the region manager calls to explain that the dealer’s “minimum sales responsibility” number is slipping, and unless volume climbs, the incentives the dealer does receive will be clawed back.

Illinois dealers should not accept this as the cost of doing business. The Illinois Motor Vehicle Franchise Act does not tolerate arbitrary allocation, price discrimination across dealers, or the use of new-vehicle sales performance as a lever to cut a dealer out of used-vehicle and certified pre-owned programs. The statute is specific. The remedies are serious. And in our experience, the dealers who document these practices in real time are the dealers who get paid.

The central Illinois statute on allocation is 815 ILCS 710/4(d)(1), which prohibits a manufacturer, distributor, or wholesaler from adopting or implementing “a plan or system for the allocation and distribution of new motor vehicles to motor vehicle dealers which is arbitrary or capricious.” 815 ILCS 710/4(d)(1). The statute goes further. Under 815 ILCS 710/4(d)(2), a dealer may submit a written request and compel the manufacturer to disclose “the basis upon which new motor vehicles of the same line make are allocated or distributed to motor vehicle dealers in the State and the basis upon which the current allocation or distribution is being made or will be made to such motor vehicle dealer.” 815 ILCS 710/4(d)(2). Factories hate that request. They are required to answer it.

When a manufacturer announces a new point or a relocation, the first reaction inside most dealerships is frustration. The second is resignation. The factory says the market can support another store. The decision must already be made. There is no point in fighting it. That reaction is exactly what gets dealers hurt. In Illinois, a proposed additional same-line franchise or a relocation into the relevant market area of an existing dealer is not supposed to be a fait accompli.

The Illinois Motor Vehicle Franchise Act gives dealers a real protest process, and that process has teeth. If a manufacturer wants to grant an additional franchise in the relevant market area of an existing same-line dealer, or relocate an existing dealership within or into that market area, the manufacturer must send notice by certified mail at least 60 days before taking the proposed action. The notice is supposed to state the specific grounds for the proposal, and the dealer has only 30 days from receipt to file a written protest. Those deadlines are unforgiving. A strong case can become a lost case if the store treats the notice like ordinary correspondence.

If the protest is timely filed, the matter does not remain in the manufacturer’s hands. The Act requires a hearing schedule, and the manufacturer bears the burden of proving good cause to allow the additional franchise or relocation. Just as importantly, the manufacturer may not grant the additional franchise or complete the relocation before the hearing process is over and the manufacturer has prevailed. That point gets lost in the panic. A timely protest is not just symbolic. It can stop the move from becoming operational while the dispute is still being decided.

That shifts the leverage in a meaningful way. The dealer does not have to prove that the sky will fall if another point opens. The manufacturer has to prove that the proposed move is justified under the statutory standards. Illinois law directs the Board or arbitrators to consider a detailed list of factors, not just the manufacturer’s business preference. Those factors include whether economic and marketing conditions warrant the move, the retail sales and service business already being transacted in the market over the prior five years compared with the business available, the investments already made by existing dealers, the permanency of those investments, whether the public welfare would be helped or harmed, whether existing dealers are already providing adequate competition and convenient consumer care, whether those dealers have adequate facilities, parts, and qualified personnel, and the effect the new point or relocation would have on existing same-line dealers.

One statutory phrase is especially important. Illinois says good cause is not shown solely by a desire for further market penetration. That matters because “we want more penetration” is often the manufacturer’s real theme, even when the written notice uses more polished language. If existing dealers are serving customers well, carrying the capital burden, staffing the service department, and covering the market responsibly, a raw desire to sell more metal by putting another roof nearby is not supposed to end the analysis.

In practice, these protests are won or lost with facts. Dealers should immediately assemble a package that tells the market story better than the factory’s notice does. That usually means five years of sales and service history, facility investment records, staffing levels, parts and service capacity, appointment lead times, customer draw patterns, and evidence of the store’s permanency in the market. It may also mean showing the risks the factory’s plan creates: weakened fixed-operations absorption, unnecessary duplication of facilities, reduced investment incentives, and harm to service convenience if the move destabilizes the stores already serving the area. Continue reading ›

The debit memo usually arrives after the money has already been booked. A warranty claim that looked closed suddenly comes back to life. An incentive payment from months ago is now being “reviewed.” The factory’s spreadsheet says the store owes money, so accounting assumes the store owes money. That reaction is understandable. It is also often too quick. In Illinois, warranty and incentive chargebacks are governed by statute, and the process matters every bit as much as the manufacturer’s conclusion.

Dealers should start with the basic timing rules. Under the Illinois Motor Vehicle Franchise Act, a warranty claim submitted by a franchised dealer must be approved or disapproved within 30 days after submission in the manner and on the forms the manufacturer reasonably prescribes. Approved claims must be paid within 30 days after approval. If the manufacturer does not specifically disapprove the claim in writing or by electronic transmission within that 30-day period, the claim is deemed approved and payment must follow within 30 days. That is a powerful starting point, because it means the manufacturer is not supposed to sit on claims indefinitely and then rewrite history after the fact.

The disapproval rules matter too. When a claim is disapproved, the dealer is entitled to written notice stating the specific grounds for the disapproval. The dealer then has 30 days to correct and resubmit the claim. In practice, that means a vague after-the-fact accusation is not enough. Dealers should be asking basic questions immediately. When was the claim submitted? When was it disapproved? What exactly was the stated reason? Was the objection timely? Was the store given a real chance to cure? Those are not technicalities. They are often the difference between a legitimate adjustment and an overreach.

Manufacturers do have audit rights, but those rights are not open-ended. The statute allows the manufacturer to require reasonable documentation and to audit warranty claims within one year from the date the claim was paid or the credit was issued. For other incentive and reimbursement programs, the audit and chargeback window is also one year after the claim was paid or the credit was issued. That should change how dealers evaluate old debits. If the factory is reaching back beyond the statutory window, the conversation is already different.

The Illinois statute is also more protective than many dealers realize when it comes to warranty repair orders themselves. The Act states that no debit reduction or chargeback of any item on a warranty repair order may be made absent a finding of fraud or illegal actions by the dealer. At the same time, the manufacturer retains the ability to audit claims and to charge back false or unsubstantiated claims within the statutory period. The practical takeaway is not that every audit disappears. The takeaway is that a chargeback should not be treated as self-proving. Dealers should separate truly false claims from documentation disputes, coding disagreements, or hindsight second-guessing about repair-order detail.

That distinction becomes even more important because manufacturers sometimes use audits as a backdoor cost-control device. Illinois law addresses that problem directly in several ways. It requires compensation for diagnostic work and warranty labor at no less than the dealer’s retail customer rate for like work. It requires payment for time spent communicating with a technical assistance center, engineering group, or other outside manufacturer source when that communication is necessary to perform a warranty repair. It bars manufacturers from imposing cost-recovery fees or surcharges on franchised dealers for payments made under the warranty-compensation section. In other words, the statute does not just talk about what the manufacturer may recover. It also talks about what the dealer must be paid. Continue reading ›

A facility demand from the factory usually arrives dressed up as a business plan. The renderings look polished. The timeline looks urgent. The number looks painful. Sometimes the message is explicit. Rebuild the showroom. Replace the signs. Rework the service drive. Carve out exclusive space. Use our vendor. Do it now or your renewal will become a problem. Dealers hear that kind of message and often conclude the fight is over before it starts.

That is a mistake. Illinois law does not turn every manufacturer preference into a legal obligation. Some facility demands are legitimate. Some are commercially sensible. But some are leverage plays designed to extract capital on the theory that the dealer is too busy running the store to challenge the premise. In our experience, the dealers who pause, pull the documents, and evaluate the statutory timeline usually negotiate from a much stronger position than the dealers who assume the factory has already won.

The first question is whether the demand is really a condition of renewal or continuation of the franchise. Under the Illinois Motor Vehicle Franchise Act, if a manufacturer intends to change substantially or modify a dealer’s sales and service obligations or capital requirements as a condition to extending or renewing the existing franchise, the manufacturer has to follow a process. That process matters. It is not just paperwork. It is where leverage starts.

The statute requires the manufacturer to send a certified notice at least 60 days before the franchise expires. The notice is supposed to state the specific grounds for the proposed action, and the dealer has only 30 days from receipt to file a protest. If the dealer timely protests, the manufacturer carries the burden of proving good cause, and the manufacturer cannot force the new obligations into place before the hearing process is finished. Depending on the parties’ agreement, the dispute may proceed through arbitration or through the Motor Vehicle Review Board. Either way, the calendar matters. A “friendly” facility conversation can harden into a deadline-driven legal dispute very quickly.

That is why dealers should be careful about informal pressure. The factory representative may present the demand as collaborative. The email may say the program is “expected” rather than “required.” The dealer may be told there is still time to “work it out.” Then the renewal papers show up with a new capital requirement baked in. At that point, the store is no longer negotiating about branding. It is defending the franchise itself. The legal issue is not whether the manufacturer would prefer a shinier building. The issue is whether the manufacturer can prove a lawful basis to impose the obligation on the schedule it has chosen. Continue reading ›

Contact Information