If your organization uses online proctoring and operates in Illinois, or serves Illinois residents, the Biometric Information Privacy Act applies to you. And unlike most privacy legislation, BIPA has teeth. Private individuals can sue directly, without needing to prove actual harm, and statutory damages start at $1,000 per negligent violation and $5,000 per intentional one.

This is not a checkbox compliance exercise. It is a legal and reputational risk that organizations need to address before they deploy any technology that touches biometric data.

This guide explains what BIPA requires, how it applies to online proctoring specifically, and how Integrity Advocate is built to support your organization's compliance obligations.

What Is BIPA?

The Biometric Information Privacy Act is an Illinois state law that establishes standards for how companies must collect, store, use, and disclose biometric information. It was enacted in 2008 and remains one of the strictest biometric privacy laws in the United States.

BIPA covers any information based on an individual's biometric identifiers, including:

• Retina and iris scans
• Fingerprints
• Voiceprints
• Face geometry and facial recognition data
• Hand geometry

For online proctoring, the most relevant category is facial geometry. Any platform that uses facial recognition or AI-based facial monitoring to verify identity or flag behavior is collecting biometric data under BIPA's definition.

What BIPA Requires

BIPA places four core obligations on organizations that collect biometric data:

1. Written Policy and Retention Schedule

Organizations must have a publicly available written policy establishing a retention schedule and guidelines for permanently destroying biometric data. Data must not be retained beyond the purpose for which it was collected, or beyond three years, whichever comes first.

2. Informed Written Consent

Before collecting biometric data, organizations must inform individuals in writing that biometric data is being collected, state the specific purpose and length of time for which it will be used, and obtain a written release. Consent cannot be buried in general terms and conditions.

3. No Commercial Benefit from Biometric Data

Organizations are prohibited from selling, leasing, trading, or otherwise profiting from an individual's biometric data. This applies to vendors and service providers as well.

4. Data Security Standards

Biometric data must be stored, transmitted, and protected using the same standard of care as other sensitive and confidential information, and in a manner consistent with the reasonable standard of care within the organization's industry.

Why Online Proctoring Is a BIPA Risk Area

Most online proctoring platforms collect biometric data as a core function. Facial recognition for identity verification, AI monitoring of facial expressions and eye movement, and behavioral biometric analysis all fall within BIPA's scope when delivered to Illinois residents.

The risk isn't hypothetical. Courts have consistently ruled that BIPA applies broadly, and class action litigation against organizations using biometric technology without proper consent frameworks has resulted in significant settlements.

The question isn't whether your proctoring platform uses biometric data. It almost certainly does. The question is whether it handles that data in a way that protects your organization.

How Integrity Advocate Supports BIPA Compliance

Integrity Advocate's identity verification and proctoring services are designed with biometric privacy obligations in mind.

Informed consent is built into the process. Test takers are informed of what data is collected, why it is collected, and how it will be used before any session begins. Consent is obtained as a documented step in the onboarding process, not assumed through general terms.

Data is not sold or used for commercial benefit. Integrity Advocate does not sell, lease, or repurpose biometric or session data for any secondary use. Data collected during a proctoring session is used solely for the purpose of that assessment.

Sensitive data is deleted promptly. Facial images and identity verification data are deleted within 24 hours of session completion, unless retention is required for a specific dispute resolution purpose. This supports compliance with BIPA's retention requirements.

Security standards are robust. Integrity Advocate uses 256-bit encryption in transit and at rest, stores data on AWS infrastructure in Montreal by default, and has maintained zero data breaches across 12+ years of operation.

Human review replaces over-reliance on facial AI. Rather than making automated decisions based on facial monitoring alone, every flagged session is reviewed by a trained person before any outcome is recorded. This reduces the risk of inaccurate findings and limits the extent to which facial geometry data drives decisions.

BIPA Is Part of a Broader Privacy Picture

BIPA is one of several privacy frameworks that organizations using online proctoring need to consider. Depending on where your test takers are located, GDPR, PIPEDA, FERPA, and other state-level legislation may also apply. Integrity Advocate is built to operate across jurisdictions, with privacy-first architecture that supports compliance across multiple frameworks simultaneously.

The Risk of Getting This Wrong

BIPA litigation is active and growing. Organizations that collect biometric data without proper consent frameworks, retain it beyond its purpose, or work with vendors who repurpose it commercially are exposed. Statutory damages per violation, multiplied across a class of test takers, add up quickly.

Choosing a proctoring partner that takes biometric privacy seriously is not just a compliance decision. It is a risk management decision.

{{post-cta}}

If your organization delivers online proctoring or participation monitoring in Canada, PIPEDA applies to you. The Personal Information Protection and Electronic Documents Act governs how the private sector collects, uses, and discloses personal information, and online proctoring sits squarely within its scope.

This guide draws from Integrity Advocate's PIPEDA compliance brief to explain exactly how IA's platform meets each of the 10 fair information principles, so your organization can deploy online proctoring with confidence that your privacy obligations are covered.

What PIPEDA Covers and Who It Applies To

PIPEDA became law on April 13, 2000, and applies to organizations' commercial activities across most of Canada. Alberta, British Columbia, and Quebec have substantially similar provincial privacy laws that apply instead, though PIPEDA continues to govern interprovincial and international transfers of personal information. For healthcare information, Ontario, New Brunswick, Newfoundland, and Labrador are also subject to similar provincial legislation.

For online proctoring specifically, PIPEDA applies to any personal information collected from test takers during identity verification or session monitoring, including images, behavioral data, and session recordings.

Why PIPEDA Compliance Matters for Online Proctoring

The impact of PIPEDA on online education services is direct. Organizations are accountable for the personal data they hold, including documentation of what data exists, why it is retained, who has access to it, and how it is protected.

PIPEDA also places emphasis on Privacy by Design, meaning privacy protections must be built into information systems from the start, not added as an afterthought. For proctoring platforms, this means the way data is collected, processed, and deleted needs to be addressed at the architecture level, not the policy level alone.

The 10 PIPEDA Principles and How Integrity Advocate Meets Each One

1. Accountability

PIPEDA requires organizations to establish a privacy management program and designate a person responsible for compliance.

Integrity Advocate's entire platform is built around protecting individual privacy while maintaining assessment integrity. This includes recognizing what constitutes personal information, minimizing collection, limiting use, deleting data as soon as it is no longer required, restricting access, and ensuring full transparency with test takers.

2. Identifying Purposes

Organizations must identify and document why personal information is being collected before or at the time of collection.

Integrity Advocate requires informed consent from each test taker through a privacy policy that explains specifically why their information is being requested and how it will be used and deleted.

3. Consent

Consent under PIPEDA must be meaningful. People must understand what they are agreeing to.

Integrity Advocate provides privacy statements and policies in plain language and in over 70 languages, so every test taker can give genuine informed consent before their session begins, regardless of their primary language.

4. Limiting Collection

Only the personal information required to fulfill a legitimate identified purpose should be collected.

Integrity Advocate is designed to minimize what it collects. For example, the platform monitors whether a user accesses other browser tabs without recording which tabs or pages were visited. On return visits, users can be verified biometrically against a prior confirmed image, eliminating the need to present government-issued ID again.

5. Limiting Use, Disclosure, and Retention

Personal information must only be used for the purpose for which it was collected, retained only as long as necessary, and not disclosed unnecessarily.

Integrity Advocate operates as an intermediary between the organization and the test taker's personal data, similar to how a payment processor protects both parties in a transaction. When a session is flagged, only the test taker's image and the minimum number of images required to substantiate a rule violation are shared with the organization. Data from fully compliant sessions is not disclosed. Integrity Advocate does not transfer or provide access to all personal information collected during a session.

6. Accuracy

Organizations must minimize the possibility of using incorrect information when making decisions about individuals.

Integrity Advocate uses AI in the review of sessions, but every automated finding requires human review and verification before any conclusion is recorded. This ensures that decisions about test takers are based on accurate, contextually reviewed information rather than algorithmic flags alone.

7. Safeguards

Personal information must be protected with security appropriate to its sensitivity.

Integrity Advocate uses 256-bit encryption in transit and at rest, stores data on AWS infrastructure in Montreal by default, and holds SOC 2 certification. The platform has maintained zero data breaches across 12 or more years of operation.

8. Openness

Organizations must make their privacy policies and practices readily available.

Integrity Advocate's privacy practices are documented and accessible to both client organizations and test takers. Organizations deploying Integrity Advocate can direct test takers to clear privacy information before any session begins.

9. Individual Access

Individuals have the right to know what personal information an organization holds about them and to have inaccurate information corrected.

Integrity Advocate proactively addresses this by sending each test taker an email after their session is completed and reviewed. The email details what information was retained and what conclusions were drawn, eliminating the need for test takers to make a formal request.

10. Challenging Compliance

Organizations must have a straightforward complaint handling and investigation process.

The post-session email creates a direct and transparent channel for test takers to raise concerns and have records corrected where required. This approach supports both the spirit and the letter of PIPEDA's challenge principle.

Privacy by Design in Practice

What separates Integrity Advocate from most proctoring platforms is that privacy is not a compliance layer added on top of the product. It is built into the architecture. Data minimization, deletion timelines, restricted disclosure, and human review in place of purely automated decisions are not policies written after the fact. They are product decisions made from the start.

That is what PIPEDA's Privacy by Design principle requires. And it is what your organization needs from a proctoring partner when your learners' data is on the line.

Download the Full PIPEDA Compliance Brief

For a complete breakdown of how Integrity Advocate meets each PIPEDA principle, including the full compliance table, download the official compliance brief.

Download the PIPEDA Compliance Brief →

Ready to see how it works in practice?
Book a Demo →

{{post-cta}}

If your organization serves learners based in the European Union, or if you are an EU-based organization serving anyone anywhere, the General Data Protection Regulation applies to you. GDPR is not just a European concern. It is one of the most far-reaching privacy laws in the world, and online proctoring platforms that collect identity data, session recordings, and behavioral information from EU-based learners are squarely within its scope.

Non-compliance carries serious consequences. Fines under GDPR are measured as a percentage of annual global turnover, with maximum penalties reaching 4% of annual revenue or 20 million euros, whichever is higher.

This guide explains what GDPR requires, how its seven key principles apply to online proctoring, and how Integrity Advocate is built to meet each one.

What Is GDPR and Who Does It Apply To?

The General Data Protection Regulation came into effect on May 25, 2018. It is designed to protect the privacy of EU citizens and to harmonize data privacy laws across Europe. GDPR applies if the organization collecting or processing data is based in the EU, or if the data subject, meaning the individual person, is based in the EU. This applies to all organizations regardless of where they are headquartered.

According to the European Commission, personal data is any information relating to an individual, whether it relates to their private, professional, or public life. For online proctoring, this includes names, email addresses, facial images, government-issued ID, session recordings, IP addresses, and behavioral monitoring data. All of it falls within GDPR's definition and all of it must be handled accordingly.

Why GDPR Matters for Online Proctoring Specifically

GDPR places particular pressure on proctoring services because of the sensitivity of the data they collect and the power imbalance between the platform and the test taker. Learners are required to submit to proctoring to access their assessment. They cannot negotiate the terms or choose a different provider. That makes the obligation on the proctoring platform to handle their data responsibly even more significant.

GDPR requires data protection by design, meaning privacy protections must be built into the product from the start, not added as policy language after a complaint. It also redefines consent, requiring that it be freely given, specific, informed, and unambiguous. For proctoring platforms, that means generic terms and conditions acceptance does not constitute valid GDPR consent for the collection of biometric and session data.

Any data breach must be reported to the relevant supervisory authority within 72 hours and to affected individuals if the breach relates to identity or financial data.

GDPR's Seven Key Principles and How Integrity Advocate Meets Each One

GDPR Article 5 sets out seven key principles for the lawful processing of personal data.

1. Lawfulness, Fairness, and Transparency (Article 5(1)(a))

Personal data must be processed lawfully, fairly, and in a transparent manner.

Integrity Advocate has made protecting learner privacy the foundational goal of its platform. Every user is informed of what data is being collected, what may be shared, and what will be deleted, before any collection begins. This transparency applies equally to institutions and to the learners they serve.

2. Purpose Limitation (Article 5(1)(b))

Personal data must be collected for specified, explicit, and legitimate purposes and not processed in a manner incompatible with those purposes.

Integrity Advocate restricts the processing of learner information to its stated purpose: verifying identity and confirming participation in the rules established by the client organization. It acts as an intermediary between the institution and the learner's personal data, protecting against any redistribution of that data beyond what is necessary to support a documented rule violation.

3. Data Minimization (Article 5(1)(c))

Personal data must be adequate, relevant, and limited to what is necessary for the purposes for which it is processed.

Integrity Advocate's data minimization approach eliminates unnecessary collection at every stage. Where a learner's image has been previously validated, the platform eliminates the need for ID resubmission on return visits. Government-issued ID images are deleted within 24 hours of submission. Browsing history, desktop files, and program inventories are not collected.

4. Accuracy (Article 5(1)(d))

Personal data must be accurate and, where necessary, kept up to date. Inaccurate data must be erased or rectified without delay.

Integrity Advocate provides every user with a copy of the data retained about them, the review findings, and the reviewer notes after their session is completed. This allows learners to verify the accuracy of the information held about them and the conclusions drawn from it, without needing to submit a formal request.

5. Storage Limitation (Article 5(1)(e))

Personal data must be kept in a form that permits identification of data subjects for no longer than is necessary for the purposes for which it was collected.

Integrity Advocate deletes all unnecessary data after session completion, defined as data not required to document who participated or to support a documented rule violation. The limited data retained is deleted after 24 months unless a specific client or regulatory requirement necessitates a different retention period.

6. Integrity and Confidentiality (Article 5(1)(f))

Personal data must be processed in a manner that ensures appropriate security, including protection against unauthorized processing, accidental loss, destruction, or damage.

Integrity Advocate encrypts all user data in transit and at rest and completes as much data processing as possible on the user's device, minimizing online traffic and the volume of data transmitted to servers. Data for UK-based learners is retained within the UK or on Canadian servers based on client preference. Integrity Advocate has maintained zero data breaches across 12 or more years of operation.

7. Accountability (Article 5(2))

The controller is responsible for demonstrating compliance with all six principles above.

Integrity Advocate supports its client organizations in meeting their accountability obligations by providing the documentation, audit trail, and data handling practices that demonstrate GDPR compliance. The platform's Privacy by Design architecture means compliance is not managed through reactive policy responses. It is built into how the system works.

Data Transfers Outside the EU

GDPR places restrictions on transferring personal data to countries outside the EU unless those countries provide an adequate level of data protection. Canada has been recognized by the European Commission as providing adequate protection under GDPR, which means data transfers from the EU to Integrity Advocate's Canadian servers meet GDPR requirements by default.

For organizations with specific data residency requirements, Integrity Advocate also supports storage within the EU and in other jurisdictions based on client preference.

The Lawful Basis for Processing in Online Proctoring

GDPR requires that every instance of data processing have a lawful basis. For online proctoring, the most relevant bases are legitimate interests and legal obligation, though the appropriate basis depends on the specific context and jurisdiction. Organizations deploying proctoring platforms should confirm with their legal team which lawful basis applies to their specific program.

Integrity Advocate's data processing practices are designed to be compatible with whichever lawful basis your organization relies on, with data minimization and purpose limitation ensuring that processing remains within the boundaries of that basis.

Built for Global Privacy Compliance

GDPR is the most internationally recognized privacy framework and often sets the standard that other jurisdictions follow. Integrity Advocate is designed to support compliance across GDPR, PIPEDA, FIPPA, PIPA, POPIA, FERPA, CCPA, and the Victorian PDP Act simultaneously, with the same Privacy by Design architecture underlying each framework.

{{post-cta}}