A growing rift between federal and state courts in Illinois is creating significant uncertainty for businesses facing claims under the state’s Biometric Information Privacy Act.

The law, which regulates the collection, disclosure and storage of certain biometric data, such as fingerprints, voiceprints and facial or retinal scans, allows a private right of action for any person “aggrieved” by a violation, and the Illinois Supreme Court has held that plaintiffs do not need to prove actual damages to pursue a BIPA claim.

The resulting wave of additional BIPA claims propelled a subsequent wave of coverage litigation for damages. The 7th U.S. Circuit Court of Appeals’ recent decision in Citizens Ins. Co. of Am. v. Mullins Food Prods. Inc. reaffirmed its narrow interpretation of two key policy exclusions, which directly contradicts the Illinois Appellate Court’s broader reading of the same provisions. This growing interpretational divergence between state and federal courts creates a risk of forum shopping by insureds and insurers alike, as each may seek to litigate in the jurisdiction most likely to deliver a favorable ruling.

Exclusions

Among insurers’ other arguments against coverage, courts have grappled with the interpretation of three common general liability exclusions:

1. The statutory violation exclusion, which excludes injuries resulting from the violation of certain laws regulating information collection and dissemination.
2. The access or disclosure exclusion, which excludes losses arising out of any access to or disclosure of a person’s “personal information.”
3. The employment practices liability exclusion, which excludes claims arising out of employment-related practices and policies.

Statutory violation exclusion

The differing interpretations by Illinois state courts and federal courts is the latest chapter in a rift that existed even before Citizens.

In National Fire Insurance Co. of Hartford v. Visual Pak Co., the BIPA claim involved allegations that the insured collected and disseminated employees’ fingerprint data without proper notice, consent or retention policies. The insurer denied coverage based on a statutory violation exclusion that listed specific statutes — the Telephone Consumer Protection Act, the Controlling the Assault of Non-Solicited Pornography and Marketing Act and the Fair Credit Reporting Act. In addition, it included a catchall clause for any statute that “addresses, prohibits, or limits the printing, dissemination, disposal, collecting, recording, sending, transmitting, communicating or distribution of material or information.”

The Illinois Appellate Court held that the inclusion of terms like “collecting,” “recording” and “disposal” directly aligned with BIPA’s regulatory scope and purpose. It also noted that the specific statutes listed in the exclusion all touch on various aspects of an individual’s personal privacy, further supporting the conclusion that the exclusion would cover a BIPA-type statute.

As part of its analysis, the Illinois Appellate Court directly addressed and rejected the 7th Circuit’s prior decision and reasoning in another case involving Citizens — Citizens Ins. Co. of Am. v. Wynndalco Enters — which had found a similar exclusion ambiguous, and therefore inapplicable to BIPA, because it “swallowed” the policy’s personal and advertising injury coverage.

The Illinois Appellate Court disagreed, holding that despite the exclusion’s “broad sweep” it did not exclude the coverage entirely. As such, the Illinois Appellate Court found the exclusion was not ambiguous, that BIPA violations fell within the exclusion’s catchall, and that the exclusion barred coverage for the claim.

Federal appeals decision

In direct contradiction to the Illinois Appellate Court’s decision in Visual Pak, the 7th Circuit recently held in Mullins that the same exclusion did not bar coverage for BIPA-related claims, furthering the divide between Illinois state and federal courts.

The insurer argued that the same catchall language relied upon in Visual Pak encompassed BIPA claims. Although the district court agreed, the 7th Circuit did not. Specifically, the 7th Circuit maintained that the exclusion’s breadth created ambiguity when read in the context of the policy as a whole and could not be read to include BIPA. The court noted that the three named statutes preceding the catchall — TCPA, CAN-SPAM and FCRA — shared no clear unifying theme that would signal to an ordinary insured that BIPA claims fall within the exclusion. While the Illinois Appellate Court in Visual Pak found a privacy-based common thread among the statutes, the 7th Circuit rejected that view.

The court also reaffirmed its concern from Wynndalco that a literal reading of the catchall would “swallow” much of the coverage ostensibly granted under the policy’s personal and advertising injury provisions. Because the exclusion could be interpreted to eliminate coverage for a wide range of statutory claims, the court deemed it ambiguous and construed it in favor of the insured.

The 7th Circuit also waved away the Illinois Appellate Court’s competing interpretation of the same exclusion, explaining that it needed to follow guidance only from the Illinois Supreme Court — not any intermediate state appellate court — and that it was “confident” the Illinois Supreme Court would agree with it.

Forum shopping

The insured in Mullins urged the 7th Circuit to certify the question to the Illinois Supreme Court, but the panel declined. This refusal leaves insureds in a precarious position, because they could face different outcomes depending on whether they are in federal or Illinois state court. The result is a heightened risk of forum shopping: Insureds may prefer a federal court, where the 7th Circuit’s interpretation favors coverage, but insurers may seek to litigate in state court, where the statutory violation exclusion is more likely to be upheld.

The long-term impact of this divide may be tempered by evolving market practices. Many insurers have added BIPA-specific exclusions, and recent amendments to BIPA that limit the amount of per-violation damages have also reduced the volume and attractiveness of new claims.

Nonetheless, the Mullins and Visual Pak decisions underscore the importance of careful policy review and strategic litigation planning. Businesses must remain vigilant in understanding how exclusions are interpreted across jurisdictions — and how those interpretations may affect their coverage in privacy-related disputes.

---

Originally published on August 22, 2025, online with Business Insurance. Reprinted with permission. Further duplication without permission is prohibited. All rights reserved.