Although well-intended legislation, Illinois’ biometric privacy law has turned into a bonanza for opportunistic lawyers under the guise of protecting everyday people against threats to their personal data.

Take what happened on Dec. 17: The 7th U.S. Circuit Court of Appeals in Chicago upheld the certification of a class-action lawsuit against Amazon, very likely increasing settlement pressure.

Illinois is home to some of the strongest consumer privacy regulation in the country and, in this case, the so-called privacy violations being challenged seem harmless. The plaintiffs allege Amazon failed to follow the burdensome notice and consent requirements for customers actively using a virtual try-on feature to see how they would look with makeup or eyewear for sale at the giant online retailer.

As we’ve written before, we are grateful for barriers to widespread misuse of such personal information. On the other hand, Illinois’ biometric data laws are responsible for regulating a marketplace that is changing by the second — and they’re just not keeping up.

More and more cases are still piling up despite legislation last year aimed at reducing the huge damage awards under a law that has left a trail of bad outcomes.

Illinois’ experience as an early adopter of restrictions on the use of biometrics shows how lawmakers struggle to keep abreast of fast-moving technologies. It’s also a glaring example of how a single state can create a legal minefield that discourages innovation while inviting exploitation from attorneys on the hunt for easy money.

The Amazon case before the 7th Circuit centered on a techy feature of the company’s mobile website and app. The retail giant’s software enabled customers to preview how its products look over an image or video of their faces before making purchases. Users agreed to let Amazon tap the camera on their phone, which would then be used to analyze their facial geometry and overlay the product.

Eye shadow too dark? Lipstick too bold? With the virtual try-on feature, there would be no need to order the product and then return it to the merchant after sampling it, if it didn’t work out.

Sounds like a good deal all around, but it involves a risk. Biometric data like fingerprints, voices, retina scans or facial features are unique to each person and unalterable. Any company collecting that data has an obligation to use it responsibly and protect it from misuse.

Illinois recognized the risk and, in a move ahead of its time in 2008, the General Assembly passed the Biometric Information Privacy Act. BIPA, as it is known, required companies to publish policies and obtain consent when using biometrics for applications that range from security screenings and financial transactions to employee timeclocks.

In practice, Illinois created a monster, mainly because it has allowed individuals to sue over alleged violations and claim enormous damages. Facebook paid a $650 million class-action settlement over its facial tagging feature, and Google settled a case over its facial grouping tool on Google Photos for $100 million. Many small companies also were threatened with the existential threat of huge judgments.

In 2023, the Illinois Supreme Court pleaded with state legislators to revisit the law in a case involving fingerprint scanners used by employees at fast-food company White Castle. The court ruled that, as written, damages accrued every time a person provided their biometric information without prior informed consent.

In other words, whenever an employee clocked in or out at a White Castle restaurant using a finger, that was a separate violation. The legal damages could have gone into the billions, though the case eventually settled for far less, which is understandable considering no harm was done and the appropriate penalty was zero.

Last year, the General Assembly finally got around to amending the law to address the potential for enormous liability every time biometric information was collected without the required consent. Courts have disagreed about whether the 2024 amendment applies to pending cases involving earlier conduct. It also kept companies on the hook for unintentional violations.

The 2024 revisions to the law fell short in other ways, too. It’s still an open question, for instance, whether data centers and cloud platforms could be subject to massive liabilities for their role in storing or analyzing computerized biometric information (we don’t think they should be). In the latest Amazon case, the judges didn’t even consider whether last year’s amendment would cap the damages that some class members may recover. That issue, they said, was “not a question before us.”

So, Illinois lawmakers went back to the drawing board and still came up with a boondoggle that threatens legitimate businesses with more of these “gotcha” judgments. If the state can’t fix this issue after years of evidence that the original law has gone wrong, then how about this solution: Repeal the entire statute and, if elected officials think they can get it right on a third try, give it a fresh shot.

_____

©2026 Chicago Tribune. Visit chicagotribune.com. Distributed by Tribune Content Agency, LLC.