Consumer applications of face biometrics draw privacy lawsuits

A trend has emerged in biometric data privacy lawsuits, with services involving photos of people taken for reasons other than identification, but taking measurements that could in theory be used to do so, targeted by plaintiffs. While significantly different from the time-and-attendance systems alleged in so many Illinois’ lawsuits to have violated people’s privacy, the statutes in question are the same.

Pharmacy chain CVS has been served with a potential class-action lawsuit for allegedly violating Illinois’ Biometric Information Privacy Act with its automated passport photo kiosks, Cook County Record reports.

The Kodak Biometric ID Photo System operating at various CVS locations uses facial geometry to prompt users to take photos compliant with the ICAO standards for biometric passports, but without satisfying the informed consent requirements of BIPA, according to the two named plaintiffs.

Estée Lauder and L’Oréal are being sued in two separate actions in Illinois for allegedly violating biometric data privacy with their virtual try-on tools. ClassAction.org reports that the online service allows people to upload images to see how makeup will look on them, but plaintiffs allege the software uses facial recognition, in violation of BIPA.

Each cosmetic company is alleged to have violated BIPA’s requirements to collect written consent, and disclose use policies and retention schedules.

Snapchat lenses and filters are also being targeted in a BIPA lawsuit alleging failure to obtain prior written consent for applying biometrics to people’s images, according to another ClassAction.org article.

A similar lawsuit filed against Snapchat involving a minor was sent to arbitration based on the platform’s terms and conditions.

A lawsuit against Microsoft departs from the trend slightly, with the tech giant’s Photos app in Windows 10 and 11 alleged to use facial recognition to identify people in photos, group their photos together, and analyze facial expressions, writes ClassAction.org.

Microsoft is already facing an unrelated potential class action under BIPA for its alleged use of biometric training data.

Article Topics

biometric data  |  Biometric Information Privacy Act (BIPA)  |  biometrics  |  data privacy  |  data protection  |  face biometrics  |  lawsuits  |  Microsoft