BIPA requires companies to obtain users' written consent before collecting biometric information such as fingerprints, facial recognition data, and voiceprints, and to explain in writing the purpose of the data and how long it will be kept.