This research is verified for the main employer-facing point: buddy punching is a time-record problem, but some ways of stopping it can create a bigger privacy-law problem. The research accurately explains why biometric clocks are legally different from lower-risk controls such as GPS context, device checks, photo-on-punch for human review, manager approval, and exception patterns.
The Illinois BIPA section is current as of May 30, 2026. The 2024 amendment limits recovery for repeated Section 15(b) and 15(d) violations to one recovery per person, per method. The Seventh Circuit's 2026 Clay decision says that remedial change applies to pending cases. That changes damages exposure. It does not remove the notice, consent, retention, disclosure, and care duties that make biometric time clocks a serious decision for employers with Illinois workers.
The research also keeps the FLSA recordkeeping point in the right place. If an employer's time records are inaccurate, the employer can lose the clean record it needs in wage disputes. That is why the practical recommendation is not "spy harder." It is to keep better punch records, preserve correction reasons, and use non-biometric review signals before moving to biometric collection.
The only weaker item is the common "2% payroll loss" estimate. The research treats it as directional background rather than as a primary-source claim, which is the right treatment. The page does not build its recommendation on that number.
1 claim
Federal recordkeeping rules require accurate records of daily and weekly hours worked
The research correctly treats buddy punching as a record-integrity problem. A false punch is not just a payroll nuisance; it weakens the record the employer may later need to explain hours worked.
1 claim
Payroll records are generally kept for three years and time-card support for two years
The research accurately separates payroll records from supporting records such as time cards and wage-computation materials.
1 claim
Inaccurate employer records can shift the wage-dispute burden under Anderson v. Mt. Clemens
The research fairly uses Mt. Clemens for the practical point: if the employer's records are unreliable, the employer may need other evidence to rebut an employee's reasonable estimate of hours worked.
2 claims
BIPA covers fingerprint, voiceprint, and scans of hand or face geometry, but excludes ordinary photographs
This supports the research's distinction between photo-on-punch and biometric matching. A stored photo for human review is not the same as extracting a face-geometry template.
Illinois BIPA still requires notice, release, retention policy, disclosure limits, and reasonable care
The research correctly says the 2024 amendment changed recovery for certain repeated violations, not the underlying compliance duties.
1 claim
Illinois BIPA allows private lawsuits and statutory damages
Illinois remains different from AG-only states because BIPA includes a private right of action and liquidated damages. That is why biometric time clocks deserve extra caution for Illinois employees.
1 claim
Public Act 103-0769 created one recovery per person, per method, for repeated BIPA Section 15(b) and 15(d) violations
The research accurately states the effective date and the practical damages change. It also correctly avoids saying the amendment eliminated BIPA liability.
1 claim
Clay v. Union Pacific held the 2024 BIPA amendment applies retroactively to pending cases
The research correctly treats Clay as a major damages update for pending cases, while preserving the difference between damages and substantive compliance duties.
2 claims
Rosenbach supports BIPA standing without a separate actual injury
The research fairly uses Rosenbach as the case that made technical BIPA violations actionable even without a separate money-loss injury.
Cothron created the pre-amendment per-scan risk that led to the 2024 amendment
The research correctly distinguishes the pre-amendment per-scan theory from the amended recovery structure.
1 claim
The $228 million BNSF verdict should be described as vacated, not final
The research handles the headline number correctly. It uses the verdict as a risk signal, while telling readers it was vacated for a damages retrial and was not a final damages judgment.
1 claim
Texas CUBI requires notice and consent and is enforced by the Texas Attorney General
The research correctly says Texas is not the same as Illinois. It is AG-enforced, but penalties can still be material.
1 claim
Texas announced a $1.4 billion Meta settlement under its biometric/privacy enforcement track in 2024
The research uses this as an enforcement signal, not as an employment-timeclock case.
1 claim
Washington, Colorado, and Maryland are described as serious but different from Illinois private-action BIPA risk
The research accurately treats these states as important biometric or sensitive-data regimes while keeping the enforcement posture distinct from Illinois BIPA.
1 claim
GPS, device checks, IP restrictions, manager approval, and pattern alerts are non-biometric detection methods
These are operational categories, not legal safe harbors. The research says they can reduce biometric privacy risk, not that they remove every legal or employee-relations risk.
1 claim
The 2% payroll-loss estimate should be treated as directional background
The fact-checkable problem is not the exact percentage. The research handles the number correctly by keeping it out of the primary recommendation and not presenting it as government or primary-source data.
17 unique sources cited across the report — click to audit any claim directly against its evidence.
Every claim above links to the source we used. Open any source to compare the wording here with the underlying rule, guidance, court opinion, or product behavior.
If a source has changed or a claim looks wrong, tell us. We would rather correct the page than leave a stale answer online. See how we fact-check.
Clockspot helps small businesses track employee time and keep payroll-ready records. Used in all 50 states since 2007, we focus on getting time and pay right — including the wage-and-hour rules that shape both.
We build Clockspot for the same reason we publish these reports: time records should be understandable, reviewable, and tied to the rules that affect payroll. See how Clockspot works.