Biometric privacy (BIPA) lawsuits: what they say about face scans and consent

"Biometric" data means measurements of a person's body that can identify them. Under the text of the Illinois Biometric Information Privacy Act, "biometric identifiers" include a retina or iris scan, a fingerprint, a voiceprint, and a scan of hand or face geometry (the shape and spacing of features a computer can use to recognize someone).

Companies use this kind of data in products such as facial recognition, sign-in tools and safety monitoring. Software can use a face or voice to tell one person from another without a password or ID card.

According to the statute, a private company that wants to collect a person's biometric identifiers in Illinois generally has to tell the person in writing what is being collected, why, and for how long, and get a written release, meaning signed permission. The law also says companies must publish a policy on how long they keep the data and when they destroy it. It lets people bring their own lawsuits over violations, rather than leaving enforcement only to the state.

The lawsuits on this page make claims under that law. The Google for Education lawsuit says Google collected biometric data from Illinois students through its education tools without the consent BIPA requires. The Samsara dash cam lawsuit says Samsara used dash cams with facial recognition to capture drivers' biometric data without their consent.