PrivacyPartner_876819100_Feature_1920x945

11.15.19

Class action suit alleges Juul Labs, Inc. violated Illinois Biometric Privacy Law

BY Aya M. Hoffman

Biometric Information Privacy Act (the "BIPA"), by failing to provide consumers with the necessary disclaimers related to the use of facial recognition technology in Juul's age-verification process.

To purchase Juul products through the company's website, customers must follow certain procedures to verify their age. One option allows customers to upload a "real-time" photograph, which is uploaded into Juul's facial recognition database. The photograph is scanned for facial geometry and compared to the photo on the customer's government-issued identification.

However, Juul allegedly failed to inform customers how their biometric facial data would be used or stored, or that it would be shared with third-party data processors. The plaintiff in this suit, Michelle Flores, alleges that Juul's failure to obtain consumer consent constitutes a violation of the BIPA. Flores also accuses Juul of improperly disclosing its customer's biometric data to third parties, including Jumio Corp., an identity verification company. Flores seeks to represent a class of Illinois consumers whose biometric information has been scanned, stored, used, and disclosed by Juul.

When Illinois passed the BIPA in 2008, it was the first state to enact legislation regulating the collection of biometric information. The BIPA is unique in that it created a private right of action, allowing consumers to bring suit directly against companies that violate the privacy law. In Rosenbach v. Six Flags Ent. Corp., No. 123186, 2019 IL 123186, ¶ 33 (Jan. 25, 2019), the Illinois Supreme Court considered whether a plaintiff must demonstrate actual harm to have standing to pursue a claim under the BIPA's private right of action, or whether the statutory loss of privacy alone was sufficient to meet the statute's "aggrieved person" standing requirement. The Illinois Supreme Court determined that the BIPA does not require proof of actual damages, finding that the violation of a plaintiff's "right to privacy in and control over their biometric identifiers and biometric information" was sufficient to establish standing.

author img

Author

Aya M. Hoffman

Associate

Posts By this author