The parent company of OnlyFans has become the latest target of a class action lawsuit launched under Illinois’ biometrics privacy law, with the suit claiming OnlyFans has improperly scanned the faces of content creators in Illinois, when the creators are forced to verify their age and identity using a facial recognition program.
On Nov. 5, attorneys Eugene Y. Turin and Colin P. Buscarini, of the firm of McGuire Law, of Chicago, filed suit in Cook County Circuit Court against Fenix Internet LLC.
Fenix is identified in the complaint as the corporate entity through which OnlyFans content creators are paid.
In recent years, and particularly since the onset of the COVID-19 pandemic in early 2020, social media platform OnlyFans has boomed into an online behemoth of video content.
The growth has been almost entirely driven by the ability of sex workers and pornographers to use the platform to share and monetize adult sexual content. Content creators are paid through OnlyFans from people who purchased either a monthly subscription to specific content creators, or who purchase specific content from the creators.
According to the complaint, OnlyFans now boasts more than 130 million user accounts worldwide, purchasing media content from more than 2 million content creator accounts. Most OnlyFans users are located in the U.S., with many in Illinois, the complaint said.
According to the complaint, OnlyFans reported more than $1.2 billion in purchases from visitors in 2020 alone.
In response to rising complaints from the public of content potentially containing underage “creators,” OnlyFans launched a program to require content creators to verify their identity and age before they can post content or get paid.
Under the automated process, the complaint said, OnlyFans requires potential creators to submit a photo of themselves, taken as a selfie. They are then required to submit a photo of their official government photo ID, such as a drivers license, showing their date of birth.
According to the complaint, OnlyFans then uses a program to create a “geometric profile of their face” and compare it to “the biometric profile that it extracts from the user’s ID document to see if they match.”
The complaint asserts OnlyFans has thus “collected the facial biometrics of thousands of individuals, including Illinois residents.”
According to the complaint, the named plaintiff, identified only as Jane Doe, has been an OnlyFans content creator since 2019. She was allegedly required to re-verify her age and identity using OnlyFans’ automated verification program in 2021.
According to the complaint, OnlyFans’ verification program violates the Illinois Biometric Information Protection Act (BIPA.)
In the past six years, a growing number of plaintiffs’ law firms, including McGuire Law, have used the BIPA law to launch thousands of class action lawsuits against businesses of all kinds and sizes. The lawsuits typically accuse businesses of violating technical provisions of the law, which require businesses to secure written consent from people, and provide them certain notices, before scanning their biometric identifiers, such as fingerprints, retinal scans, or, as in this case, facial geometry.
Many of the lawsuits have particularly targeted employers, accusing them of improperly requiring workers to scan their fingerprints to verify their identities when punching in and out of work shifts.
However, a number of other class actions under BIPA have taken aim at social media and big tech companies, including Facebook, Google, Shutterfly and others.
Facebook, for instance, was sued over its photo tagging programs, which scan the faces of people depicted in photos uploaded to Facebook, and then creates and saves a template of those faces, enabling the program to locate that person in all other photos in which they appear on Facebook.
The class actions have netted substantial settlements. Facebook agreed to pay $650 million to settle the BIPA class action over its tagging software.
Class actions against employers typically have brought in settlements ranging from hundreds of thousands of dollars to $25 million.
A growing number of businesses are opting to settle, rather than go to trial, and risk potential ruinous judgments in the face of a law that gives plaintiffs the chance to demand damages of $1,000-$5,000 per violation – with individual violations defined by some courts under the law as each time a biometric identifier is scanned.
In the OnlyFans complaint, the plaintiffs assert OnlyFans violated BIPA by allegedly failing to publish a policy with “a schedule and guidelines” explaining how the facial scans would be handled and ultimately destroyed; allegedly improperly using the facial scans for profit; and allegedly failing to secure the facial scans and users’ data from former employees of OnlyFans and Fenix.
The complaint seeks damages of $1,000-$5,000 per violation, plus attorney fees.
The plaintiffs seek to expand the lawsuit to include potentially thousands of OnlyFans users in Illinois who submitted photos of their faces and IDs through OnlyFans’ identity and age verification system.