A new report says Illinois’ biometrics privacy law has largely served as a tool to enrich trial lawyers, who have raked in hundreds of millions of dollars in fees, harming employers and other businesses, while providing little real protection for consumer privacy and limiting Illinoisans’ access to new tech products.
The report, issued April 4 by the McLean, Virginia-based Chamber of Progress, says the findings should serve as a warning to other states to avoid following the example of Illinois in enacting laws designed to protect their residents’ digital and biometric privacy rights.
According to its website, the Chamber of Progress is an organization that bills itself as a politically “center-left” coalition of business advocates, primarily in the online and tech sectors, that are “devoted to a progressive society, economy, workforce and consumer climate.”
They are not affiliated with traditional Chamber of Commerce organizations, such as the U.S. Chamber of Commerce.
On its website, the Chamber of Progress lists a number of business “partners” among its membership, including many of the biggest and most recognizable names in big tech and ecommerce. These include: Apple, Amazon, Google, Facebook parent company Meta, Uber, Lyft, Zillow, DoorDash, Grubhub, Instacart and more.
Many of these companies are also among the long and growing list of businesses famously targeted by massively costly class action lawsuits under the Illinois state law known as the Biometric Information Privacy Act (BIPA.)
The BIPA law has gained notoriety throughout the country and the world in recent years, as a growing cadre of class action law firms have used the law to amass hundreds of millions of dollars in attorney fees from settlements from businesses terrified at the prospect of facing “annihilative” and “catastrophic” payouts at the hands of juries.
Enacted in 2008, the Illinois BIPA law was ostensibly designed to safeguard the so-called unique identifying biometric information of consumers and employees, such as their fingerprints, retinas or facial geometry, among others. It was inspired by the collapse of the company known as Pay by Touch, which had been among those pioneering the ability of consumers to pay for goods and services by linking their banking information to one of the unique biometric identifiers, in that case, their fingerprints.
To coerce compliance with the law, the BIPA measure included steep financial penalties of $1,000 or $5,000 per violation, depending on how willful the business could be seen to be in not complying.
Recognizing the law’s potential, a few plaintiffs’ law firms began filing class actions under the law around 2015. At first, those lawsuits primarily targeted big tech companies and platforms, notably including Facebook, Google and Shutterfly. The lawsuits against those companies, for instance, asserted they improperly scanned the faces of people included in photos uploaded to their photo sharing platforms.
They claimed the scans were conducted without first obtaining consent from the people whose photos were scanned, or without providing notices and other information concerning how the scanned biometric data would be used, stored, shared and ultimately destroyed.
Notably, an early class action lawsuit took aim at theme park operator Six Flags, accusing the company of violating the BIPA law by improperly requiring people to scan their fingerprints to verify their identity when using a season pass to enter Six Flags Great America in Gurnee. That case, docketed as Rosenbach v Six Flags, resulted in a landmark 2019 ruling from the Illinois Supreme Court in which justices ruled plaintiffs don’t need to prove they suffered any actual harm, such as identity theft, before pressing class actions worth millions of dollars over violations of BIPA’s technical notice and consent provisions.
According to the Progress Chamber report, that decision opened the floodgates to BIPA-related litigation. The report noted, for instance, that in 2018 only nine class actions were filed under the BIPA law. By 2020, that total had increased to 209 cases in a single year.
BIPA litigation has continued to stream into courtrooms in Cook County and elsewhere in the years since.
While some of the lawsuits have continued to target the initial kinds of targets in technology and ecommerce, the vast majority of such lawsuits have instead taken aim at thousands of Illinois employers, of all types and sizes.
Such lawsuits have typically sought to make employers pay for allegedly illegally requiring their workers to scan fingerprints or other biometric identifiers when punching the clock during work shifts, or when accessing secured areas in a workplace, such as a hospital medicine locker or a cash room at a retail store.
According to the Progress Chamber report, 88% of BIPA-related class action lawsuits have been used to press claims against employers for allegedly violating BIPA’s notice and consent provisions in the way they required workers to verify their identity in the workplace.
Another significant and growing segment of BIPA litigation also targets companies over alleged improper face scans, amounting to 78% of all lawsuits on behalf of consumers. Of those, 40% of such lawsuits have targeted companies over face scans for verification and security purposes, while 22% have taken aim at companies over facial recognition databases.
A growing number of lawsuits have also been lodged against companies over so-called virtual try-on services, which allow consumers to sample or “try on” products like cosmetics or eyeglasses while shopping online.
The report notes such lawsuits can prove to be very costly. While the law allows plaintiffs to request damages of up to $5,000 per violation, a recent Illinois Supreme Court decision has declared businesses in Illinois could be held liable for each allegedly improper biometric scan, not just each person whose rights were allegedly violated.
Further, the state high court has ruled plaintiffs can demand up to $5,000 for each allegedly improper fingerprint or face scan, dating back over the preceding five years.
When multiplied across entire workforces or customer bases, the court and business advocates alike have noted the law, as interpreted by the Illinois Supreme Court, will leave Illinois employers and other businesses facing what an Illinois Supreme Court justice described as “absurd” and “annihilative” financial risk.
Fast food chain White Castle, for instance, has told the court its reasoning could leave them facing damages of $17 billion from a BIPA class action lawsuit against them. According to financial reports, White Castle’s annual income is estimated at about $795 million per year.
The Democrat-dominated state Supreme Court, however, said the steep financial risks, which threaten to put even some large companies out of business, are an intended feature of the law, meant to frighten businesses into compliance. If businesses don’t like it, they need to petition state lawmakers to change the law, the court said. The Democratic supermajority in the Illinois General Assembly, however, has proven resistant to calls to amend the law, despite its heavy costs to Illinois employers.
Illinois Democrats receive large and regular campaign donations from trial lawyers, who have publicly registered their opposition to any reforms to the BIPA law.
The report notes the risks from such lawsuits also extend beyond economic damage. The report notes tech companies have begun refusing to release some new products and services in Illinois that are available elsewhere in the country. This, the report asserts, will harm consumers in Illinois, by making the state less competitive and less welcoming to technological innovation.
While businesses and consumers are harmed, the report notes that the biggest winners from the flood of lawsuits appear to be the lawyers who bring the lawsuits.
The complaint notes that businesses in Illinois have largely opted to settle, rather than take their chances in court.
Facebook and Google, for instance, have famously opted to pay $650 million and $100 million, respectively, to settle the class actions against them.
Six Flags notably agreed to pay $39 million to end the Rosenbach litigation that famously landed before the state Supreme Court in 2019.
Hundreds of BIPA-related class actions against employers have also settled in recent years, with payouts ranging from the hundreds of thousands of dollars to as much as $50 million.
At the same time, the fears of many businesses concerning the risks of trial were proven to be justified, when a federal jury in Chicago ordered freight rail operator BNSF to pay $228 million to a class of 45,000 truck drivers who claimed they were improperly required to scan fingerprints when entering Illinois rail yards.
In post-trial motions, plaintiffs have argued even that figure was too low. They estimate they should actually have received at least $800 million.
It is not known how the recent big wins for plaintiffs at the Illinois Supreme Court may mean for the value of future settlements.
But it is likely that attorneys will continue to rake in large fees from these cases. The report notes plaintiffs’ lawyers typically have received anywhere from 15% to 40% of the money paid by employers and other businesses to settle BIPA lawsuits.
The report estimated trial lawyers have received, on average, $11.5 million in fees from BIPA-related lawsuits.
By contrast, class members typically receive an average payout of $506 each – “and only individuals that affirmatively filed paperwork as part of the claims process received individual payouts,” the report said.
The complaint said four firms – Edelson P.C., Robins Gellar Rudman & Dowd, Labaton Sucharow, and Carrol Rhow and Fegan – have each collected at least $30 million in fees from settlements of “consumer-facing” BIPA lawsuits.
The report notes that such consumer-oriented settlements amounted to only 12% of total BIPA cases filed.
The report’s authors said the experiences in Illinois under BIPA should make other states wary of copying Illinois’ example.
According to the report, states including New York, Arizona, Hawaii, Massachusetts, Tennessee, Maryland and Mississippi are actively considering legislation “modeled after Illinois’ BIPA” law.
“The largest beneficiaries of BIPA cases alleging consumer harm appear to be plaintiffs’ law firms,” the Progress Chamber report said.
“… States considering copycat legislation should be wary of designing legislation based on Illinois’ BIPA statutes. Passing similar legislation in other states will likely lead to similar increases in litigation, increased business costs, additional product restrictions for customers, and limited benefits for consumers,” the report said.
“While biometric privacy and related security concerns are extremely important protections for consumers, Illinois’ BIPA is overly restrictive, leading to consequences for consumers and business owners within the state.”