A major restaurant chain is facing a class-action lawsuit over its use of biometric data, raising significant privacy concerns. On August 28, 2024, Michael Massel filed a complaint in the United States District Court for the Northern District of Illinois against Steak N Shake, Inc.
The lawsuit alleges that Steak N Shake violated the Illinois Biometric Information Privacy Act (BIPA) by collecting and storing customers' facial geometry without proper consent or disclosure. According to the complaint, Steak N Shake implemented facial recognition kiosks in 2024 to streamline customer check-ins and payments. These kiosks automatically scan customers' faces to log them into their loyalty accounts and process payments. Massel claims that during his visit to a Steak N Shake location in 2024, he was prompted to use this "Face Check-In" feature, which collected his facial geometry.
Massel argues that facial geometry scans are unique and permanent biometric identifiers that cannot be changed if compromised. He asserts that Steak N Shake's collection and storage of these scans without proper safeguards put customers at risk of identity theft and unauthorized tracking. The Illinois legislature enacted BIPA to protect residents' privacy interests in their biometric data, requiring private entities like Steak N Shake to inform individuals in writing about the collection and storage of their biometric information, specify the purpose and duration of such activities, obtain written consent, and publish retention schedules for destroying this data.
The complaint highlights several alleged violations of BIPA by Steak N Shake. Massel claims that the company did not inform him or other customers in writing about the collection or storage of their biometric information. Additionally, Steak N Shake allegedly failed to disclose the specific purpose and length of time for which this data would be used and did not obtain written consent from customers before collecting their facial geometry scans. Furthermore, Massel accuses Steak N Shake of unlawfully retaining his biometric information even after it should have been destroyed following his order.
Massel seeks certification of the case as a class action on behalf of all individuals who had their biometric information collected by Steak N Shake in Illinois within the past five years. He requests statutory damages of $5,000 for each intentional or reckless violation of BIPA or alternatively $1,000 for each negligent violation. Additionally, he seeks reasonable attorneys' fees and costs, actual damages, declaratory relief stating that Steak N Shake violated BIPA, and any other appropriate relief.
The case is being handled by attorneys Michael L. Fradin from Skokie, IL, and James L. Simon from Chagrin Falls, Ohio (pro hac vice forthcoming). The case ID is 1:24-cv-07827.