Onfido has agreed to pay $28.5 million to end a class action accusing the online identity verification service provider of violating Illinois' biometrics privacy law.
Fredy Sosa, a member of online resale marketplace OfferUp, sued Onfido in June 2020 in Cook County Circuit Court, alleging it violated the Illinois Biometric Information Privacy Act when verifying the identities of OfferUp users with its TruYou facial recognition software. The technology requires users to upload both a photograph and a picture identification card.
Onfido removed the suit to federal court, where in January 2021 U.S. District Judge Marvin Aspen denied Onfido’s attempt to stay the complaint and compel individual arbitration. The judge found Sosa successfully argued Onfido isn’t a party to the service contract and privacy policy agreement between OfferUp and its users. After the U.S. Seventh Circuit Court of Appeals denied Onfido’s appeal in August 2021, the company again failed to win dismissal.
“Onfido’s software scans identification cards and photographs to locate facial images and extracts a unique numerical representation of the shape or geometry of each facial image, which Sosa refers to as a ‘faceprint,’ ” Aspen wrote in 2022. “The faceprints extracted by Onfido plausibly constitute scans of face geometry and, therefore, ‘biometric identifiers’ under BIPA.”
Sosa and the plaintiffs’ class is represented by attorneys with the firm of Edelson P.C., of Chicago, which is in line to collect more than $8.91 million — a third of the net settlement — according to documents filed with Judge Aspen on April 20. Individual class members would have to submit claims and, if found eligible, could expect to be paid between $66 and $350 based on the number and type of claims.
The total class size is estimated at more than 670,000, with breakdowns based on the type of company through which they used TruYou verification. The smaller group, the non-financial institution (NFI) class, is almost 195,000 strong, while the financial institution class, represented by named plaintiff Rohith Amruthur, is pegged at almost 476,000.
NFI class members are expected to collect between $210 and $350, while financial institution class members would receive between $65 and $110, which presumes a claim rate of about 15% to 25% in each class. Also deducted from the pool are $5,000 incentive awards for class representatives and settlement administration expenses of more than $1.46 million.
Each class would cover uploads dating from June 12, 2015, through the date of a preliminary approval of the settlement. That timing is significant given the Feb. 2 Illinois Supreme Court opinion, Tims v. Black Horse Carriers, which established a five-year window for private litigation alleging BIPA violations. The settlement also follows a different February Illinois Supreme Court holding, specifically that BIPA should be interpreted to allow plaintiffs to demand damages of $1,000-$5,000 for each and every scan of a person’s biometric identifiers, not just the first, and earlier holdings that plaintiffs can sue strictly for statutory violations and aren’t required to demonstrate identity theft or other legal harm.
When multiplied across hundreds of thousands of users, the potential payout could increase exponentially, should the case go to a jury. A growing number of companies have opted to settle, rather than risk what an Illinois Supreme Court justice called "annihilative" damages should they lose at trial.
Organizations represnting businesses operating in Illinois have asked the Illinois Supreme Court to reconsider its decision. They have also called on state lawmakers to reform the law to reduce the risk of catastrophic harm to Illinois employers and the state's economy.
In addition to payments, under the settlement, Onfido agreed to implement or maintain policies compliant with BIPA’s requirements to collected informed written consent, specifically by instructing its TruYou customers to always use the most current version of a software development kit containing written consent forms whenever interacting with Illinois residents. The company also said it would establish and follow a data retention schedule and deletion policy.
Onfido has been represented by attorneys with the firm of Baker & Hostetler, of Chicago, Orlando and Denver.