Driver-facing cameras and BIPA: what fleets must check before any data use

When does a driver-facing camera raise BIPA questions?#

A driver-facing camera raises BIPA questions when it captures a biometric identifier, such as a scan of face geometry, or information derived from one, about a person in Illinois. Recording ordinary video is not the same as collecting biometrics, but many AI dashcams analyze the driver's face to detect drowsiness, distraction or phone use, or to identify which driver is in the seat.

Whether a particular system does this depends on its features and settings, which can differ by vendor, model and firmware version. Marketing language is not enough; the fleet needs the vendor's technical documentation and admin settings, and counsel should decide how the law applies to those facts.

BIPA's remedies explain why fleets take it seriously. A prevailing party may recover liquidated damages of $1,000 per negligent violation or $5,000 per intentional or reckless violation, or actual damages if greater, and the Illinois Supreme Court held in Rosenbach v. Six Flags (2019) that a person need not show injury beyond the violation itself to sue.

An amendment signed on August 2, 2024 (SB 2979) limits recovery to a single violation per person when the same identifier is collected repeatedly by the same method, but it does not remove exposure. Litigation has reached camera vendors and transportation companies, so read the actual filings and their current status with counsel rather than press summaries.

The core checklist before any data use#

The core checklist covers notice, consent, retention, disclosure, the vendor's role and the facts about who was recorded and when. Counsel will want documents rather than recollections, so collect the evidence before anyone forms a view.

Run the checklist for the whole period a feature was active, not just today. Programs often changed over time as vendors shipped new features or the fleet added vehicles.

Why the camera vendor's role matters#

The camera vendor's role matters because the vendor may be the party that actually processes face data on its servers, and the contract decides who is responsible for notice, consent and deletion. Some vendor agreements place those duties on the fleet; others share them or say nothing.

Vendor terms also matter for any later data use. Some camera and telematics agreements give the vendor rights to use footage or derived data to improve its own products. A fleet that wants to license its own records needs to know what the vendor already holds, what it may do with it, and whether the fleet can export what it needs.

Retention settings show why vendor documents matter. Samsara's help center, for example, describes camera retention settings from 3 days to 4 years with defaults that depend on region and sign-up date, says data outside the chosen period is purged nightly and cannot be recovered, and notes that dash cams store video locally and generally upload it only for a safety event or a manual request. Counsel should weigh any preservation duties before anyone shortens a retention setting.

• 1Obtain the current MSA, data processing terms and any biometric addendum.
• 2Ask the vendor in writing which features use face geometry and whether they can be disabled.
• 3Confirm where biometric data is stored, for how long and how deletion is verified.
• 4Check whether the vendor uses fleet footage to train its own models.
• 5Confirm export rights and formats for footage, events and metadata.

Footage, events and metadata are different data#

Footage, AI event labels and telematics are different data with different risk, and a fleet should treat them separately rather than as one camera dataset. The safest material for any outside use is usually the material least connected to a face.

This matters most for licensing. BIPA bars private entities from selling, leasing, trading or otherwise profiting from a person's biometric identifiers or information, so face templates and face-derived data are generally excluded outright rather than prepared for use.

Event labels deserve care. On some systems a distraction or phone-use flag is produced by analyzing the driver's face, so the label itself may be derived from biometric processing even though it looks like ordinary metadata.

Illustrative: a regional fleet pauses before a data project#

Illustrative: a fictional regional truckload carrier with a terminal in Illinois installed AI dashcams with driver-facing lenses across its fleet. Its onboarding packet included a general camera policy but no separate biometric consent, and the vendor contract was silent on who handles biometric notices.

When the CEO explores licensing operating records, the general counsel pulls the vendor documentation and admin logs and finds that a driver identification feature had been enabled on part of the fleet. Counsel advises keeping all cabin video, face data and face-derived event labels out of any data project.

The fleet scopes only dispatch, maintenance and road-event telematics with drivers tokenized. It also works with counsel on a state-tailored notice and consent process, adopts a written retention and destruction schedule, and negotiates a vendor addendum setting out each party's duties.

What to fix going forward#

Fixing the program going forward reduces future risk but does not erase what was already collected, so the two should be handled separately with counsel. Start with facts about the features, then the documents, then the vendor.

• 1Inventory every camera feature and whether it uses face geometry, by vehicle and date.
• 2Adopt a written retention and destruction schedule and publish it where required.
• 3Deliver a clear notice and collect signed consent before biometric collection begins.
• 4Tailor notices to the states where drivers are based or operate.
• 5Sign a vendor addendum that allocates notice, consent, storage and deletion duties.
• 6Keep consent records linked to driver, date and notice version.
• 7Review the program whenever the vendor adds a feature or updates firmware.

How SourceX treats camera and biometric data#

SourceX flags camera footage and any biometric data during the Rights and Preparation steps of the SourceX five-step transaction, and a package can exclude them entirely. Most fleet records that matter for AI work, such as dispatch, maintenance and exception histories, do not depend on a driver's face.

Whatever is excluded, and why, is documented in the privacy record of the SourceX Evidence Packet, alongside provenance, licensing rights, permitted use and release authorization. That gives the fleet and any buyer a clear record that biometric material was considered and kept out.