FB pixel

Apple wins US biometric privacy case on appeal

On-device data does not trigger BIPA requirements
Apple wins US biometric privacy case on appeal

In a biometrics-bound lawsuit decision more noteworthy for the name of its defendant than precedent, Apple has prevailed in a state of Illinois Biometrics Information Privacy Act case.

A state appellate court just before Christmas said that Apple does not violate BIPA by offering owners of its mobile devices the ability to unlock the operating system using their fingerprint or face.

The case was brought by David Barnett, Ethel Burr and Michael Henderson in Cook County Circuit Court. It was dismissed in January 2022 and appealed, according to legal news publication Cook County (Ill.) Record.

The matter could still be heard by the state supreme court. There also is an outside chance that a case can be made that software updates by Apple confer some ownership or control. This was not decided here.

It is not a shocking appellate decision and likely will have zero impact on other BIPA cases in the works. If anything, the decision shows businesses how to comply with the law and still legally sell biometric features and services.

Apple never collected, stored or managed the data collected by Touch ID and Face ID, functions that protect mobile Apple products from illicit access. Device owners do the scanning (or they can choose to use other access-control features) and the biometric data is stored nowhere but on their device.

Apple has no role in how the biometrics are managed, including when they are deleted.

The case could allow biometric technology providers like FaceTec, which provides algorithms to clients to process data on their own servers, to argue that they are not subject to BIPA’s requirements. The ruling could also protect on-device implementations such as those based on FIDO.

In every successful BIPA case to date, one or more companies required a person to be biometrically scanned, stored the data, used it for profit, managed the data (including sharing and/or selling it) or all of the above. They did not, however, get express permission to scan and manage or clearly state their intensions for the information or their policies for managing the data.

Article Topics

 |   |   |   |   |   |   |   | 

Latest Biometrics News


Secure Technology Alliance launches template for using mobile driver’s licenses

Get used to the idea of your phone as your driver’s license. The ecosystem for mobile driver’s licenses (mDLs) continues…


Biometric identity verification launches and deals show diversity of approaches

The biometric identity verification market covers a wide variety of sectors and use cases, but the breadth is not just…


Decentralized digital identity is spreading as fresh use cases emerge

A recent post on Forrester’s website, written by VP and Principal Analyst Andras Cser, dips into how travel and mobile…


Cameroon building Digital Transformation Center to manage digital consular services

As part of a process launched last year by the government of Cameroon to modernize its consular services including the…


UK digital visas to fully replace physical immigration documents by 2025

In the UK, the Home Office has announced that it will invite those with physical immigration documents to create a…


iBeta biometric PAD evaluations grow in global prominence

Compliance with biometric presentation attack detection standards has become table stakes for numerous applications of face biometrics in particular, and…


Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Most Read From This Week

Featured Company

Biometrics Insight, Opinion

Digital ID In-Depth

Biometrics White Papers

Biometrics Events