Biometric Information Privacy Act (BIPA) Litigation Tracker

This litigation tracker is intended to track cases filed under Illinois’ Biometric Information Privacy Act. It contains brief case summaries, relevant secondary sources, the context (workplace, social media, etc.), what kind of biometric data/information is alleged to have been collected, trial and/or appellate court results, and other relevant details.

Key Takeaways:

1. Almost all BIPA lawsuits are class actions that allege that defendant(s) collected plaintiffs' biometric data (1) without informing individuals that their biometric information is being collected or stored, (2) without informing individuals for how long and for what purposes their biometric information is collected, (3) without receiving written releases from the individuals whose biometric data is collected, and (4) without provided a publicly available written policy establishing a retention schedule and guidelines for destruction of biometric information.

2. Over 100 out of a total of 182 lawsuits involved allegations by employees against their employers, mostly for collecting employees' fingerprints for timekeeping purposes.

3. 51 out of a total of 182 lawsuits alleged BIPA violations due to the collection, disclosure, and/or dissemination of individuals’ facial geometry or facial biometric information. 35 of these 51 cases were against smartphone applications (e.g. TikTok, Snapchat, OKCupid), photo services (e.g. Amazon Photos, Google Photos), and various tech products, (e.g. Ring, Clearview) that scanned users’ faces to profit and/or to improve facial recognition software.

4. Other BIPA violations involve remote proctoring services; identity verification for customers, application users, and employees; and companies that contribute and disclose biometric data to Clearview for their facial recognition database.

5. Targets of BIPA litigation have often turned to their insurers for help in defending and resolving these cases. Though general liability insurers seek court approval for denial of coverage,  alleged disclosure of a person's biometric information in violation of Section 15(d) of BIPA is a potentially covered publication that violated a person's privacy rights (see W. Bend Mut. Ins. Co. v. Krishna Schaumburg Tan, Inc.)

6. Important cases:

   • Rosenbach v. Six Flags Entertainment Corp
     clarifying the expansive scope of BIPA

     • BIPA “codified that individuals possess a right to privacy in and control over their biometric identifiers and biometric information.”

     • violations are not “merely ‘technical’ in nature” because “an individual’s unique biometric identifiers . . . cannot be changed if compromised or misused.”

     • “an individual need not allege some actual injury or adverse effect, beyond violation of his or her rights under the Act, in order to qualify as an ‘aggrieved’ person and be entitled to seek liquidated damages”

   • Patel v. Facebook
     article-III standing

     • The violation of BIPA’s notice and consent provisions amounts to a concrete injury-in-fact (not merely a procedural violation) sufficient to confer Article II standing to plaintiffs.

   • W. Bend Mut. Ins. Co. v. Krishna Schaumburg Tan, Inc.
     broadening insurance liability

     • Commercial general liability insurance for personal injury potentially covers BIPA lawsuits

DISCLAIMER: All case descriptions are based on allegations by the parties. STOP makes no warrantees of the accuracy of any such facts, and all should be read as allegations.