If your organization uses online proctoring and operates in Illinois, or serves Illinois residents, the Biometric Information Privacy Act applies to you. And unlike most privacy legislation, BIPA has teeth. Private individuals can sue directly, without needing to prove actual harm, and statutory damages start at $1,000 per negligent violation and $5,000 per intentional one.

This is not a checkbox compliance exercise. It is a legal and reputational risk that organizations need to address before they deploy any technology that touches biometric data.

This guide explains what BIPA requires, how it applies to online proctoring specifically, and how Integrity Advocate is built to support your organization's compliance obligations.

What Is BIPA?

The Biometric Information Privacy Act is an Illinois state law that establishes standards for how companies must collect, store, use, and disclose biometric information. It was enacted in 2008 and remains one of the strictest biometric privacy laws in the United States.

BIPA covers any information based on an individual's biometric identifiers, including:

• Retina and iris scans
• Fingerprints
• Voiceprints
• Face geometry and facial recognition data
• Hand geometry

For online proctoring, the most relevant category is facial geometry. Any platform that uses facial recognition or AI-based facial monitoring to verify identity or flag behavior is collecting biometric data under BIPA's definition.

What BIPA Requires

BIPA places four core obligations on organizations that collect biometric data:

1. Written Policy and Retention Schedule

Organizations must have a publicly available written policy establishing a retention schedule and guidelines for permanently destroying biometric data. Data must not be retained beyond the purpose for which it was collected, or beyond three years, whichever comes first.

2. Informed Written Consent

Before collecting biometric data, organizations must inform individuals in writing that biometric data is being collected, state the specific purpose and length of time for which it will be used, and obtain a written release. Consent cannot be buried in general terms and conditions.

3. No Commercial Benefit from Biometric Data

Organizations are prohibited from selling, leasing, trading, or otherwise profiting from an individual's biometric data. This applies to vendors and service providers as well.

4. Data Security Standards

Biometric data must be stored, transmitted, and protected using the same standard of care as other sensitive and confidential information, and in a manner consistent with the reasonable standard of care within the organization's industry.

Why Online Proctoring Is a BIPA Risk Area

Most online proctoring platforms collect biometric data as a core function. Facial recognition for identity verification, AI monitoring of facial expressions and eye movement, and behavioral biometric analysis all fall within BIPA's scope when delivered to Illinois residents.

The risk isn't hypothetical. Courts have consistently ruled that BIPA applies broadly, and class action litigation against organizations using biometric technology without proper consent frameworks has resulted in significant settlements.

The question isn't whether your proctoring platform uses biometric data. It almost certainly does. The question is whether it handles that data in a way that protects your organization.

How Integrity Advocate Supports BIPA Compliance

Integrity Advocate's identity verification and proctoring services are designed with biometric privacy obligations in mind.

Informed consent is built into the process. Test takers are informed of what data is collected, why it is collected, and how it will be used before any session begins. Consent is obtained as a documented step in the onboarding process, not assumed through general terms.

Data is not sold or used for commercial benefit. Integrity Advocate does not sell, lease, or repurpose biometric or session data for any secondary use. Data collected during a proctoring session is used solely for the purpose of that assessment.

Sensitive data is deleted promptly. Facial images and identity verification data are deleted within 24 hours of session completion, unless retention is required for a specific dispute resolution purpose. This supports compliance with BIPA's retention requirements.

Security standards are robust. Integrity Advocate uses 256-bit encryption in transit and at rest, stores data on AWS infrastructure in Montreal by default, and has maintained zero data breaches across 12+ years of operation.

Human review replaces over-reliance on facial AI. Rather than making automated decisions based on facial monitoring alone, every flagged session is reviewed by a trained person before any outcome is recorded. This reduces the risk of inaccurate findings and limits the extent to which facial geometry data drives decisions.

BIPA Is Part of a Broader Privacy Picture

BIPA is one of several privacy frameworks that organizations using online proctoring need to consider. Depending on where your test takers are located, GDPR, PIPEDA, FERPA, and other state-level legislation may also apply. Integrity Advocate is built to operate across jurisdictions, with privacy-first architecture that supports compliance across multiple frameworks simultaneously.

The Risk of Getting This Wrong

BIPA litigation is active and growing. Organizations that collect biometric data without proper consent frameworks, retain it beyond its purpose, or work with vendors who repurpose it commercially are exposed. Statutory damages per violation, multiplied across a class of test takers, add up quickly.

Choosing a proctoring partner that takes biometric privacy seriously is not just a compliance decision. It is a risk management decision.

{{post-cta}}

If your organization is a university, college, hospital, or designated agency in Ontario, the Freedom of Information and Protection of Privacy Act applies to every vendor you work with that handles personal information, including your online proctoring platform.

FIPPA has governed Ontario institutions since June 10, 2006. It establishes a uniform regulatory framework for how personal information is collected, used, disclosed, retained, and destroyed. For online proctoring, which collects identity data, session recordings, and behavioral information from learners, FIPPA compliance is not optional. It is a condition of operating within Ontario's public sector ecosystem.

This guide walks through FIPPA's seven key principles and explains exactly how Integrity Advocate meets each one.

What Is FIPPA and Who Does It Apply To?

The Freedom of Information and Protection of Privacy Act serves two purposes. First, it gives individuals the right to access information held by Ontario government institutions. Second, and more relevant to online proctoring, it protects the privacy of individuals by limiting how institutions and their service providers collect, use, and disclose personal information.

FIPPA applies to all Ontario government ministries and any agency, board, commission, corporation, or other body designated as an institution under the regulations. In practice, this includes Ontario universities, colleges, hospitals, and a broad range of publicly designated organizations.

When an Ontario institution uses an online proctoring platform, the vendor handling learner data becomes accountable to FIPPA standards. Choosing a vendor that does not meet those standards creates compliance risk for your institution.

Why FIPPA Compliance Matters for Online Proctoring

FIPPA places emphasis on Privacy by Design, meaning privacy protections must be built into information systems from the ground up, not layered on after the fact. For proctoring platforms, this means the architecture itself must reflect the principles of collection limitation, purpose restriction, and timely data destruction.

Organizations using proctoring vendors that collect more data than necessary, retain it longer than required, or share it without appropriate controls are exposed to FIPPA investigations, Information and Privacy Commissioner findings, and reputational risk with learners who have a right to know how their data is handled.

FIPPA's Seven Key Principles and How Integrity Advocate Meets Each One

1. Authority to Collect and Manner of Collection

FIPPA limits the collection of personal information to authorized activities and requires that collection come directly from the individual except in limited circumstances.

Integrity Advocate collects only what is required to verify a learner's identity and monitor their session. If a learner is not permitted to access other browser tabs during their assessment, Integrity Advocate monitors exactly that and nothing more. Other proctoring providers routinely collect browsing history, desktop file lists, and program inventories that go well beyond what any assessment requires.

The only data Integrity Advocate receives from sources other than the learner directly is the learner's first name, last name, and email address, which comes from the Learning Management System solely for the purposes of identity verification and session communication.

2. Notice Requirements

FIPPA requires that individuals be informed of the collection of their personal information before it occurs.

Integrity Advocate presents its privacy policy to every user at the start of every session. Users must actively accept the policy before any personal information is collected. The privacy policy and session instructions are available in dozens of languages to ensure that consent is genuinely informed, regardless of the learner's primary language.

3. Proper Use and Disclosure

FIPPA limits the use and controls the sharing of personal information to authorized activities only.

Integrity Advocate provides a full human review service specifically designed to limit what gets shared with client organizations. When a session produces no violations, no session media is shared. When a session is flagged, only the minimum information required to document the specific concern is shared, with unrelated personal information redacted. This is the opposite of how most proctoring platforms operate, where full session recordings are routinely handed over to institutions regardless of whether a violation occurred.

4. Accuracy

FIPPA requires that processes be in place to keep personal information accurate.

Integrity Advocate session findings represent a documented snapshot of what occurred during a specific assessment. Because findings are based on human review rather than automated algorithmic flags, the information recorded is assessed for accuracy before it becomes part of any record. Session data does not change over time, which eliminates the risk of drift or corruption that can affect systems relying on ongoing data updates.

5. Retention

FIPPA requires that individuals be able to obtain access to their own personal information for a defined period.

Integrity Advocate eliminates the need for learners to submit formal access requests by proactively notifying every user by email after their session is completed and reviewed. The notification details what information was retained beyond the session and what conclusions were drawn. Learners know exactly what is on file about them without having to ask.

6. Security

FIPPA requires that personal information be kept secure and confidential.

Integrity Advocate uses 256-bit encryption for all data in transit and at rest, stores data on AWS infrastructure in Montreal by default, and has maintained zero data breaches across 12 or more years of operation. The platform holds SOC 2 certification, providing independent third-party verification of security controls. Compliant user identification images and session media are deleted within 24 hours of session completion. Personal data that does not exist cannot be breached.

7. Disposal and Destruction

FIPPA requires that the disposal and destruction of personal information be authorized and secure.

Every piece of personal data collected by Integrity Advocate carries a programmatically applied time-to-live setting. When a session is complete, deletion occurs automatically and exactly as communicated to the learner. There is no manual process, no exception handling, and no risk of data persisting beyond its intended retention period.

Built for Ontario Institutions

FIPPA is one of several privacy frameworks that Ontario institutions need to navigate. Depending on the nature of your program and the location of your learners, PIPEDA, PIPA, GDPR, and FERPA may also apply. Integrity Advocate is built to support compliance across multiple frameworks simultaneously, with the same foundational Privacy by Design architecture underlying each.

For Ontario institutions specifically, Integrity Advocate provides the documentation, audit trail, and data handling practices your compliance and legal teams need to demonstrate that your proctoring vendor meets FIPPA's standards.

‍

{{post-cta}}

Many online proctoring companies claim GDPR compliance. It is worth asking what that claim actually means, and whether it can be verified.

The short answer is that GDPR compliance claims are largely self-reported. There is no mandatory third-party verification process that a company must pass before making the claim. For organizations choosing a proctoring vendor on the basis of GDPR compliance, this creates a significant due diligence gap.

The US Patriot Act Problem

Many proctoring companies are registered in the United States or store data within US jurisdiction. This creates a direct conflict with GDPR that no privacy policy can resolve.

Data protection laws across the EU prohibit the disclosure of personal data without a data subject's consent or knowledge. The US Patriot Act gives the US government the ability to compel data disclosure from US-based companies or companies storing data on US infrastructure, without that consent and without notifying the individual.

A proctoring company that stores learner data on US servers and claims GDPR compliance is operating under two conflicting legal obligations. When those obligations conflict, US law governs US-based companies. The GDPR claim does not change that.

The Privacy Shield Failure

Many US-based organizations attempted to address this conflict by certifying under the EU-US Privacy Shield program, which was designed to provide a legal mechanism for transatlantic data transfers that satisfied GDPR requirements.

On July 16, 2020, Europe's top court invalidated the EU-US Privacy Shield, finding that the transfer mechanism did not ensure compliance with the level of protection required by EU law. The certification that many companies had pointed to as evidence of GDPR compliance was rendered invalid overnight.

The EU-US Data Privacy Framework: A Replacement With Familiar Weaknesses

Following the 2020 decision, negotiations between the EU and the US produced a new framework. On July 13, 2023, the US Department of Commerce launched the Data Privacy Framework program, intended to allow eligible US companies to self-certify their participation in the EU-US Data Privacy Framework.

The mechanism for self-certification is a short questionnaire and a fee to the US International Trade Administration, ranging from $375 to $4,875 USD depending on the company's revenue.

Critics have already noted that the new framework faces the same fundamental shortcomings as its Privacy Shield predecessor, including the unresolved tension between US surveillance law and EU privacy rights. Self-certification through a paid questionnaire does not resolve the underlying Patriot Act conflict.

What Meaningful GDPR Compliance Actually Requires

For a proctoring vendor's GDPR compliance claim to be substantive rather than self-reported, it needs to rest on something more than a certification program that can be obtained by filling out a form and paying a fee.

The most reliable indicator is where the data actually lives. If learner data is stored outside US jurisdiction, on infrastructure not subject to US government compelled disclosure, the conflict between the Patriot Act and GDPR does not arise.

Integrity Advocate's GDPR compliance is grounded in the same Privacy by Design architecture that underpins GDPR itself. All data is hosted in GDPR-designated jurisdictions, out of reach of governments with compelled data access authority. Integrity Advocate collects only what is necessary to confirm a learner's identity and compliance with exam rules, most of which is automatically deleted within 24 hours of session completion.

This is not a self-certification. It is an architectural position.

Questions to Ask Your Proctoring Vendor

Before accepting a GDPR compliance claim at face value, organizations should be able to answer the following:

• Where is learner data physically stored, and in which legal jurisdiction?
• Is the vendor registered in the United States or storing data on US infrastructure?
• Is the GDPR compliance claim based on self-certification, third-party audit, or architectural design?
• Has the vendor's compliance been reviewed independently, or is it self-reported?
• What happens to learner data if the vendor receives a government data request?

If the answers are not clearly documented, the GDPR compliance claim deserves further scrutiny.

{{post-cta}}