Document Generators
Injury & Compensation
Fees & Support
Deadlines & Filing
Apple's Photos app faces a major biometric privacy lawsuit alleging facial data was collected without the consent required under Illinois law. Discover what BIPA protects, why the case matters, who may have legal rights, what compensation could be available, and how consumers can protect their biometric information.
Facial recognition technology has become a routine part of modern life. Smartphones can organize thousands of photographs by identifying the people who appear in them, security systems can recognize faces at entrances, and digital platforms increasingly use biometric technology to distinguish one person from another. These features can be convenient, but they also raise an important legal question: Can a company collect and store facial biometric data without obtaining a person's informed consent? A major lawsuit involving Apple is bringing this issue into the spotlight. In October 2026, a federal judge scheduled a jury trial for April 2027 in a class-action case alleging that Apple's Photos app collected and stored facial biometric information without complying with Illinois privacy law. The lawsuit focuses on the Illinois Biometric Information Privacy Act (BIPA), a law that imposes specific requirements on companies handling protected biometric identifiers.
The case could have significant implications for technology companies, smartphone users, and consumers concerned about how their personal information is collected. It also highlights a growing challenge for courts: determining whether facial recognition systems that analyze similarities between photographs create legally protected biometric data.
However, the allegations against Apple have not been proven at trial, and the lawsuit does not establish that every facial recognition feature violates the law.
This guide explains the Apple biometric privacy lawsuit, how Illinois law protects facial information, when consumers may have grounds to sue, what compensation might be available, and what practical steps individuals can take to protect their privacy.
The lawsuit, known as Hazlitt v. Apple Inc., was filed in federal court in the Southern District of Illinois in 2020. The plaintiffs allege that Apple's Photos application automatically analyzes faces appearing in users' photo libraries and creates digital representations known as faceprints.
According to the plaintiffs, this process involves scanning facial geometry and generating biometric information that can be used to identify or distinguish individuals. They argue that Apple collected and retained this information without providing the disclosures and obtaining the written consent required under Illinois law.
The case concerns the People album feature in Apple's Photos app, which organizes photographs according to the people appearing in them. The feature allows users to find pictures of particular individuals without manually searching through their entire libraries.
Although the functionality may appear harmless, the plaintiffs argue that creating biometric representations of faces raises privacy concerns beyond ordinary photo organization.
The legal question is not simply whether Apple can analyze photographs. Instead, the court must determine whether the information created through that analysis qualifies as a protected biometric identifier or biometric information under BIPA and, if so, whether Apple's practices violated the statute.
In June 2026, the federal court certified a class in the case. In a ruling issued on September 30 and made public on October 8, 2026, the judge rejected most of Apple's request for summary judgment, allowing the central dispute to proceed toward trial. The jury trial is scheduled for April 2027.
Reuters reported on October 16, 2026, that the case could affect how courts interpret biometric privacy protections as facial recognition and other advanced technologies become more widespread.
Source: Reuters — Apple 'faceprints' case tests reach of biometric privacy law.
It is important to understand what these developments mean. Class certification allows a case to proceed on behalf of a defined group of people who share relevant legal or factual questions. It does not establish that the defendant violated the law. Similarly, denying summary judgment means that the case's unresolved issues can proceed; it is not a final finding of liability.
Biometric data refers to information derived from distinctive physical or behavioral characteristics that can help identify or distinguish an individual.
Common examples include:
Ordinary photographs are not automatically treated as biometric identifiers under every privacy law. The legal analysis can change, however, when software extracts facial measurements or processes a photograph into information used to identify an individual.
For example, a photograph showing a person's face is not necessarily the same thing as a mathematical representation generated by a facial recognition system. The representation may be used to compare faces across different photographs, recognize a returning individual, or group images according to the person depicted.
That distinction is central to the Apple lawsuit.
The plaintiffs contend that Apple's technology generates protected biometric information from facial geometry. Apple disputes the legal characterization of its technology, arguing that its system compares images without identifying people in the manner contemplated by the statute.
The outcome may depend on the technology's actual capabilities, the meaning of the statutory language, and the evidence presented at trial.
Biometric identifiers differ from many other forms of personal information because people generally cannot replace them easily.
A person whose password is exposed can change it. Someone whose credit card information is stolen may be able to obtain a replacement card. A person's face, fingerprint, and iris, however, remain largely the same throughout life.
If biometric information is improperly collected, exposed, or misused, the consequences may extend beyond a single compromised account.
That is one reason lawmakers have introduced specific rules governing biometric data collection, storage, disclosure, and destruction. Illinois is particularly important because its biometric privacy law gives individuals a private right to bring certain civil claims.
The Illinois Biometric Information Privacy Act, commonly called BIPA, became law in 2008. It regulates how private entities collect, possess, use, retain, and disclose certain biometric identifiers and biometric information.
The statute was designed to address privacy risks associated with the growing commercial use of biometric technology.
Under 740 ILCS 14/10, protected biometric identifiers include retina or iris scans, fingerprints, voiceprints, and scans of hand or face geometry. The law also defines biometric information as information based on a person's biometric identifier that is used to identify an individual.
The exact definitions matter because not every piece of information associated with a person's face automatically qualifies for protection under BIPA.
Official source: Illinois General Assembly — Biometric Information Privacy Act.
Section 15(b) generally prohibits a private entity from collecting, capturing, purchasing, receiving through trade, or otherwise obtaining covered biometric identifiers or biometric information unless it first satisfies specified notice and consent requirements.
The company must inform the individual in writing that the information is being collected or stored. It must also explain the specific purpose and length of time for which the information will be collected, stored, and used. The company must then obtain a written release from the individual or the individual's legally authorized representative.
These requirements are particularly important when biometric processing occurs automatically.
A user might knowingly take a photograph or activate a smartphone feature without necessarily understanding that the underlying software generates a separate biometric representation. Whether a company's disclosures and consent procedures satisfy BIPA depends on the facts and the applicable legal requirements.
Section 15(a) requires covered entities possessing biometric data to develop and make publicly available a written policy establishing a retention schedule and guidelines for permanently destroying that data.
Generally, the law requires destruction when the original purpose for collecting or obtaining the information has been satisfied or within three years of the individual's last interaction with the entity, whichever occurs first.
The statute also requires entities to comply with their applicable retention and destruction policies, subject to the law's provisions and exceptions.
These rules address a basic privacy concern: companies should not retain sensitive biometric information indefinitely without an appropriate basis.
BIPA places restrictions on selling, leasing, trading, or otherwise profiting from biometric identifiers or biometric information. It also limits disclosure and redistribution, subject to specified exceptions.
The statute additionally requires covered entities to protect biometric information using reasonable industry standards and at least the level of protection applied to other confidential and sensitive information.
The precise obligations depend on the statutory provision and the circumstances. A company does not automatically violate BIPA simply because it possesses biometric data; the relevant question is whether its conduct breaches an applicable legal requirement.
The Apple lawsuit raises two major questions: whether the Photos app creates biometric information covered by BIPA and whether Apple possesses or controls that information in a way that triggers the law's requirements.
The plaintiffs allege that Apple's Photos application scans facial geometry, creates faceprints, and uses the resulting information to group images and distinguish individuals.
They argue that this process falls within BIPA's definition of protected biometric processing and that Apple failed to obtain the required written consent or provide the necessary disclosures.
The plaintiffs also challenge aspects of Apple's handling of biometric information, including its retention and storage practices.
Their argument is that a company's privacy obligations should not disappear merely because biometric processing occurs automatically or serves a convenient consumer feature.
Apple has disputed the allegations and the plaintiffs' interpretation of its technology.
According to Reuters' reporting on the litigation, Apple has argued that its face-recognition system compares images rather than identifying people by name. Its lawyers have also argued that the digital representations at issue are not necessarily scans of facial geometry within the meaning of BIPA.
Apple has further relied on the way its systems handle and protect information, including encryption and the company's asserted limitations on access to certain photo-library data.
These arguments raise questions about how courts should apply a law enacted in 2008 to modern software systems.
A technology company may argue that its system does not create a legally covered identifier, does not use the information for a prohibited purpose, or does not exercise the kind of control the statute requires. Plaintiffs may respond that the technology's actual functions and the company's ability to manage the information bring the conduct within the law.
The court has rejected most of Apple's summary-judgment arguments, but the remaining issues require resolution at trial.
The distinction matters: the case is a test of statutory interpretation and evidence, not proof that Apple has already been found liable.
Potentially, yes. But whether an individual can bring a successful lawsuit depends on the applicable law, the company's conduct, the type of biometric information involved, and the evidence available.
Illinois residents may have grounds to investigate a BIPA claim if a private company collected or obtained protected biometric information without satisfying the law's notice and written-consent requirements.
However, not every facial recognition feature creates a viable claim. A person generally needs facts connecting the company's conduct to a specific legal violation.
Consider these examples.
Example 1: A workplace fingerprint system
An employer requires workers to scan their fingerprints to enter a building but allegedly fails to provide the required written notice or obtain written consent. Depending on the facts, this may raise questions under BIPA.
Example 2: Facial recognition in a consumer application
An application creates facial representations from uploaded photographs. If the information qualifies as protected biometric data and the company fails to meet applicable statutory requirements, affected individuals may have grounds to consult an attorney about a possible claim.
Example 3: Ordinary photo storage
A service stores photographs without extracting or using covered biometric information. The mere fact that the images contain people's faces does not automatically establish a BIPA violation.
These examples illustrate why technical details matter. A lawyer evaluating a potential claim would need to understand what information the system generates, how it is used, where the relevant conduct occurs, and which legal requirements apply.
BIPA is an Illinois statute, so it should not be treated as a nationwide biometric privacy law.
The location of the individual, the company's conduct, and other jurisdictional facts can affect whether the law applies. People living in other states may have rights under different state privacy laws, consumer-protection statutes, or other applicable legal rules.
For that reason, a person should not assume that a lawsuit involving Illinois residents automatically gives every smartphone user in the United States a claim against the same company.
BIPA provides statutory damages for certain violations, subject to the statute's terms and applicable judicial interpretations.
Under 740 ILCS 14/20, the law provides:
The statute also allows for other forms of relief, including injunctive relief, in appropriate cases.
However, these figures do not mean that every person can automatically collect $1,000 or $5,000 simply because a company processes facial data. A claimant must establish an applicable violation, and the amount of any award depends on the legal and factual circumstances.
Reuters reported that the certified class was estimated to include approximately eight million Illinois residents. At the maximum statutory rate of $5,000 per person, a hypothetical calculation could reach $40 billion.
That figure is not a court-ordered payment, a settlement amount, or a prediction that a jury will award that sum.
The calculation is illustrative and depends on assumptions about liability, the applicable damages provision, and how the relevant violations are counted.
Illinois amended BIPA in 2024 to clarify that repeated collection of the same person's biometric data using the same method in violation of Section 15(b) generally constitutes a single violation. The amendment also addresses repeated disclosures under Section 15(d).
A federal appellate decision has applied the amendment retroactively to certain pending cases. The legal effect of the amendment and the facts of the Apple case are therefore important when assessing any potential damages.
The number of people included in a class does not, by itself, determine the final amount a defendant must pay.
A class-action lawsuit allows one or more named plaintiffs to bring claims on behalf of a larger group of people who share sufficiently similar legal or factual issues.
Class actions can be particularly useful when the alleged conduct affects many consumers in a similar way. Instead of requiring each person to bring an entirely separate lawsuit, the court can consider common issues through a representative proceeding.
In the Apple case, the federal court granted class certification in June 2026. The certified class and any subclasses are defined by the court's order, so eligibility depends on the exact definitions and the facts of the case.
Class certification is an important procedural step, but it is not the same as a final judgment on the merits.
The plaintiffs still must establish the elements of their claims. Apple can continue to present defenses, challenge the plaintiffs' interpretation of the law, and dispute whether the alleged conduct satisfies BIPA.
Not necessarily. Whether someone is included in a class depends on the court-approved class definition and any other applicable requirements.
The Apple case concerns Illinois residents and specified conduct involving Apple devices and the Photos app. A person living elsewhere should not assume they are included.
Individuals interested in a potential class action should consult official court information or a qualified attorney rather than relying on social media posts or unofficial claims about eligibility.
Consumers should also be cautious about websites promising guaranteed compensation or requesting unnecessary personal information to determine whether someone qualifies.
Evidence can play an important role in determining whether a company's biometric practices violate the law.
Depending on the circumstances, potentially relevant materials may include:
Not every individual will have access to all of these materials. Technical evidence may be controlled by the company and may require discovery through litigation.
A consumer who suspects unlawful biometric collection should preserve relevant documents that are already available, including privacy notices, emails, and screenshots of settings. They should avoid attempting to access systems or obtain information they are not authorized to access.
It is also important to distinguish between evidence that a feature exists and evidence that the feature violates the law. Showing that an application recognizes faces may establish that facial analysis occurs, but it does not necessarily prove that the resulting data qualifies as a protected biometric identifier or that required consent was missing.
Consumers do not need to wait for a court ruling before reviewing their privacy settings and understanding how their devices process personal information.
The following steps can help people make informed decisions.
Check the privacy and photo settings on your smartphone, tablet, or computer. Review the features that organize photographs, recognize people, or synchronize photo libraries across devices.
The available controls vary by operating system and software version. Disabling a feature may limit certain processing, but it does not necessarily erase information already generated or resolve questions about previous collection.
Review the provider's privacy policy and product-specific explanations. Look for information about facial recognition, biometric processing, storage, sharing, retention, and deletion.
Pay attention to whether the company explains what information is collected, why it is collected, and how long it is retained.
A general privacy statement may not answer every technical question, but it can help identify what the company represents about its practices.
A stored photograph and a biometric template are not necessarily the same thing.
Some systems analyze images to organize them, while others generate data designed to compare or identify people. The legal implications depend on the system's functions and the applicable statute.
Consumers should avoid assuming that every application with facial recognition is unlawful or that every company collecting facial data is violating BIPA.
If you have a specific concern about a company's data practices, save relevant notices, consent screens, communications, and account information that you can lawfully access.
Record the name of the feature, the device and software version involved, and the approximate period when you used it. These details may help an attorney assess the circumstances.
A lawyer familiar with biometric privacy law can help determine whether a potential claim falls within BIPA or another applicable law.
The analysis may involve jurisdiction, class membership, the definition of biometric information, the company's collection practices, consent, statutory deadlines, and available remedies.
An attorney can also explain whether an existing class action may be relevant and whether any action is necessary on your part.
The case could influence how companies design and explain facial recognition systems, particularly when the systems operate automatically in consumer products.
Companies developing biometric technology may need to consider whether their systems generate information covered by existing privacy statutes, even when the technology is marketed as a simple organizational or convenience feature.
If a jury finds that Apple's practices violated BIPA, the ruling could strengthen arguments that certain automated facial-analysis processes fall within the law's protections. If Apple prevails, the decision could clarify the limits of the statute's definitions and how they apply to the technology involved.
The outcome could also influence how other courts evaluate claims involving facial recognition, voiceprints, and artificial intelligence systems.
Other companies have faced biometric privacy litigation involving different technologies and alleged conduct. These cases are not identical, and their outcomes depend on their own facts and governing laws.
The broader challenge is that privacy statutes often must be applied to technology that has evolved considerably since the laws were enacted. Courts must interpret the language adopted by lawmakers rather than simply treating every new technology as unlawful or exempt.
The Apple litigation therefore has significance beyond the immediate dispute. It highlights the continuing tension between useful automated features, corporate control of digital information, and consumers' ability to understand and consent to the processing of sensitive data.
The lawsuit also offers lessons for businesses that use facial recognition, voice analysis, fingerprint authentication, or other biometric systems.
Companies should begin by identifying the biometric information their products collect or generate. A privacy review should examine the system's technical functions rather than relying solely on how the feature is described to customers.
Businesses operating in jurisdictions with biometric privacy requirements should consider the following measures:
Provide clear, legally appropriate notices. Explain what biometric information is collected, why it is collected, how it is used, and how long it will be retained.
Obtain the required consent. Where applicable law requires written consent or a written release, companies should use a process designed to meet those requirements before collecting protected information.
Establish retention and deletion policies. Document how long biometric information is retained and how it is securely destroyed when retention is no longer justified or legally permitted.
Limit access and protect stored data. Use appropriate safeguards to reduce the risk of unauthorized access, disclosure, or misuse.
Evaluate third-party providers. Review how vendors and service providers handle biometric information, including whether data is transferred, stored, or processed by other entities.
Review products as technology changes. A software update can change where information is stored, how it is synchronized, or what the system can infer. Privacy assessments should reflect actual system behavior.
Maintain records of compliance. Companies should preserve appropriate documentation of notices, consent procedures, security controls, retention policies, and legal reviews.
These measures cannot guarantee that a company will never face litigation. They can, however, help businesses understand their obligations and identify potential problems before they develop into larger disputes.
The Apple lawsuit is scheduled for a jury trial in April 2027. The remaining issues include whether the faceprints created by the Photos app qualify as scans of face geometry under BIPA and whether they are capable of identifying individuals in the legally relevant sense.
The parties are expected to present evidence and arguments concerning the technology, the statutory definitions, and Apple's handling of the information.
A jury's decision could help determine how the law applies to the specific system at issue. Depending on the outcome, further proceedings or appeals may follow.
Until the dispute is resolved, readers should be cautious about treating projected damages, class-size estimates, or arguments from either side as final conclusions.
The case is a reminder that legal disputes involving emerging technology can take years to reach trial. It also demonstrates why a court's procedural decisions must be distinguished from a final determination of liability.
For consumers, the most useful lesson is to understand the difference between ordinary personal information and data that may receive special legal protection. For businesses, the case emphasizes the importance of examining how software actually processes information rather than assuming that a convenient feature falls outside privacy regulation.
The Apple biometric privacy lawsuit is an important test of how Illinois law applies to facial recognition technology in everyday consumer products. The plaintiffs allege that Apple's Photos app generated and stored protected facial biometric information without obtaining the consent required by the Illinois Biometric Information Privacy Act. Apple disputes their interpretation of its technology and the law.
The federal court has certified a class and allowed most of the central claims to proceed toward a jury trial scheduled for April 2027. Those developments make the case significant, but they do not establish that Apple has violated the law or guarantee compensation for consumers.
For individuals, the case highlights the value of reviewing privacy settings, understanding biometric disclosures, and preserving relevant records when a specific concern arises. People considering legal action should obtain advice based on their circumstances, the applicable jurisdiction, and the requirements of the relevant statute.
For technology companies, the dispute reinforces the importance of transparent data practices, appropriate consent procedures, clear retention policies, and safeguards for sensitive information.
As facial recognition and artificial intelligence become more sophisticated, courts will continue to confront difficult questions about what counts as biometric data and when companies must obtain permission to collect it. The outcome of this case may help clarify those questions, but the broader principle remains clear: convenient technology does not eliminate the need to understand and comply with applicable privacy laws.
Disclaimer: This article is for general informational purposes only and does not constitute legal advice. Laws and court proceedings can change, and individual rights depend on the applicable facts and jurisdiction. Consult a qualified attorney about a specific legal issue.
Written by
BeastBeast is a seasoned legal content creator and law research specialist with 15+ years of experience in legal writing, legal research, and publishing educational law content. Specializing in Personal Injury, Family, Business, Immigration, Criminal, Tax, and Real Estate Law, Beast creates accurate, well-researched, and SEO-optimized legal guides that help readers understand complex legal topics with confidence. Every article is written with a focus on accuracy, trust, and Google's E-E-A-T guidelines, making Jurnza.com a reliable source for legal information and legal services.
