Frustratingly, the BIPA might exclude these offensive actions. It was really designed to protect customers from bad businesses. This sort of action probably didn't factor into it.
https://news.ycombinator.com/item?id=45750955
From the statute: "A private entity does not include a State or local government agency."
