Non-Biometric Package Tracking: Camera Design That Avoids BIPA
Track parcels with cameras and stay outside BIPA, CUBI, and GDPR biometric rules by never creating face geometry data in the first place.
Hayat AminPresident of IP, Position Imaging
5 min read
You avoid biometric privacy laws by making sure your cameras never create a scan of face geometry, a voiceprint, or a gait signature, even accidentally. Track the package through barcode reads and spatial trajectories, treat every person as an anonymous bounding box, and blur or discard face pixels at the edge before any frame is stored. That keeps you outside BIPA's definitions entirely, which matters because BIPA damages run $1,000 to $5,000 per violation and Facebook paid $650 million to settle one class action.
Key takeaways
- BIPA punishes collection of face geometry, not identification. You can violate it without ever knowing anyone's name.
- Anchor identity to the package via barcode or label OCR at induction, then follow it with spatial-temporal tracking. People stay anonymous detections.
- Face recognition, gait analysis, and persistent body-appearance embeddings are the three techniques that turn a logistics camera into a biometric system.
- Blurring faces after recording does not cure a BIPA claim. The collection already happened. Redact at the edge, before storage.
- Overhead, downward-facing cameras at package height rarely capture usable face geometry, which shrinks the argument before it starts.
- Illinois is not alone: Texas CUBI extracted a $1.4 billion settlement from Meta in 2024, and GDPR Article 9 treats biometric data as a special category.
What actually puts a warehouse camera inside BIPA's scope?
The Illinois Biometric Information Privacy Act, on the books since 2008, regulates a short list: retina or iris scans, fingerprints, voiceprints, and scans of hand or face geometry. Two features make it dangerous for camera products. First, it has a private right of action with statutory damages of $1,000 per negligent violation and $5,000 per intentional or reckless one. Second, courts have repeatedly held that you do not need to identify anyone by name. Generating a face geometry template is enough. That is how Facebook ended up paying $650 million in 2021 and how the Illinois Supreme Court's 2023 Cothron v. White Castle ruling briefly made every single scan a separate violation, before an August 2024 amendment limited recovery to one claim per person per collection method. Even after that amendment, a facility scanning 200 workers and 50 drivers a day carries real exposure. The statute punishes collection, not misuse.
Track the package, not the person
The clean architecture gives identity to the object and never to the human. It works in three steps:
- Induction: a barcode read or label OCR assigns the parcel a durable ID the moment it enters the field of view. Identity comes from the label, not from anyone's body.
- Custody chain: computer vision maintains that ID by following the parcel's trajectory frame to frame and handing it off between cameras using position and timing, not the appearance of the person carrying it.
- Events, not portraits: when a person picks up parcel 4471, the system logs "parcel 4471 moved from bin 12 to dock 3 at 14:02." The person is a transient bounding box that expires when they leave frame.
This design answers every operational question logistics teams actually ask, such as where a package is, who last touched it by shift and station rather than by face, and how long it sat. The package has an identity. The person never does.
Which CV techniques are safe, and which are radioactive?
Draw the line at whether the model produces a measurement of a specific human body. Generally defensible: object detection and classification, barcode and label OCR, depth sensing, optical flow, anonymous person detection that outputs only a box and a track ID valid for seconds, and zone occupancy counts. Radioactive, meaning they arguably create a biometric identifier even with no name attached:
- Face recognition or face embeddings of any kind, including "we only match against a watchlist" designs. The template itself is the problem.
- Gait analysis. Plaintiffs' firms have argued gait fits BIPA's identifier list, and you do not want to fund the test case.
- Persistent person re-identification embeddings that fingerprint a body's appearance across cameras and days. Short-lived tracklets are different from a durable body signature.
The question a court will ask is not "did you know who this was?" It is "did you measure this person's body and keep the measurement?"
If it fingerprints a body, treat it as biometric.
Can camera placement alone keep faces out of your data?
Placement is your cheapest control. A camera mounted overhead and angled down at package height sees hands, torsos, labels, and shelves, and captures faces only at oblique angles and low pixel density, well below what face geometry extraction needs. Compare that with a chest-height camera at a pickup kiosk, which stares straight at faces all day. Where you cannot avoid face pixels, process at the edge: run face detection on-device, blur or crop those regions, and only then write frames to storage. Order matters. Blurring during a nightly batch job means the raw collection already happened, and BIPA claims attach at collection. Pair this with short retention, for example 30 days for redacted video and zero days for raw frames, and document both numbers. Under GDPR you get a second benefit, since footage that never contains identifiable faces is far easier to justify under Article 6 and never touches Article 9's special-category biometric rules. A face you never captured cannot be litigated.
What compliance work remains even with a non-biometric design?
Avoiding biometric identifiers removes the worst exposure, but three items remain. First, write and publish a video retention and use policy anyway. It costs a page of text and it is the first document any regulator or plaintiff requests. Second, audit adjacent systems. The largest share of BIPA suits target fingerprint and face-scan employee timeclocks, so a legally careful tracking system next to a non-compliant timeclock still gets the company sued. If any employee-facing biometric exists, get the written release BIPA requires. Third, put the non-biometric constraint into vendor contracts. A camera OEM that silently ships a firmware update with face-recognition-based re-identification can move you into scope without a single code change on your side. Remember the map is bigger than Illinois: Texas's CUBI statute allows up to $25,000 per violation in attorney general enforcement and produced Meta's $1.4 billion settlement in July 2024, and Washington regulates biometric identifiers too. Write the policy before the first camera ships.
Why license proven non-biometric tracking IP instead of rebuilding it?
The architecture above, meaning label-anchored identity, trajectory-based custody chains, and multi-camera handoff without person fingerprinting, is exactly the hard part of camera-based package tracking, and it is patented ground. Position Imaging has spent over a decade building granted IP around computer vision tracking and monitoring of packages and assets, including US 11,774,249, US 12,079,006, US 12,066,561, and US 12,000,947, in a portfolio cited by Apple, Bosch, and other major firms. Licensing does two things for a builder. It compresses the engineering timeline from a multi-year CV research effort to a product integration measured in months. And it gives you freedom to operate in a field where the obvious designs are already claimed, so your legal review covers one license instead of a portfolio-by-portfolio clearance search. You still own your product, your data practices, and your privacy posture. You just skip re-deriving tracking methods that already survived examination. License the pattern instead of discovering the lawsuit.
Frequently asked questions
Does BIPA apply if our system never identifies anyone by name?
Yes, it can. BIPA regulates the creation and possession of biometric identifiers such as a scan of face geometry, and courts have held that no name matching is required. If your pipeline generates a face template, the statute is in play even if the template is never linked to an identity. That is why the safe design never generates the template at all.
Is blurring faces after the video is recorded enough for compliance?
No. BIPA claims attach at collection, so raw frames written to disk before redaction mean the collection already occurred. Run face detection and blurring on the edge device, before storage, and configure raw frame retention to zero. Then the stored record never contains face data at any point in its life.
Are gait analysis and person re-identification embeddings considered biometric?
Treat them as if they are. Gait is a body measurement that plaintiffs' attorneys have argued fits BIPA's identifier list, and a persistent appearance embedding is functionally a body fingerprint even without a face. Short-lived tracklets that expire in seconds are the defensible alternative for multi-camera handoff.
We only operate outside Illinois. Can we ignore this?
Not safely. Texas's CUBI statute carries penalties up to $25,000 per violation and produced Meta's $1.4 billion settlement in 2024, Washington has its own biometric law, and GDPR Article 9 treats biometric data used for identification as a special category in the EU. Designing non-biometric from the start is cheaper than building per-state variants later.
Can we use face detection to trigger blurring without creating BIPA risk?
Face detection that outputs only a bounding box, immediately blurs the region, and discards everything else is the standard privacy-preserving pattern and is widely viewed as outside BIPA's scope because no face geometry template is created or retained. Keep the detector's output ephemeral and document that the pipeline stores no facial measurements.
Send us a one-paragraph description of your camera tracking product and we will map it against the portfolio, including where a license shortcuts both the CV build and the clearance work.
Tell us the product. We map the exact scope, what a license covers, and how fast you can ship, all in a 20-minute call.
Book a 20-minute call