Is the Future Private? A Look Into Litigation Under Illinois’s “BIPA” Law

At Meta’s 2019 “F8” virtual development conference, Mark Zuckerberg stood in front of a presentation screen displaying the words, “the future is private.”¹ Zuckerberg’s talking points centered on “build[ing] a more privacy-focused social media platform.”² Increasing Meta’s focus on privacy, apparently, does not include ensuring compliance with Illinois’s Biometric Information Privacy Act (“BIPA”).³ While not exactly the first of its kind,⁴ a recent class action lawsuit against Meta alleges the company violated Illinois’s BIPA law by capturing, retaining, and profiting from the use of plaintiff’s “voiceprint” without disclosing or creating a meaningful retention policy for doing so.⁵ This suit has important implications for the Illinois BIPA and the federal adjudication of data privacy claims at large.

The complaint alleges that Meta is capturing users’ voices through Facebook and Messenger services and analyzing each user’ voice “to determine a digital voiceprint of the user.”⁶ In 2016, Meta sought a patent for its own method of developing voiceprints,⁷ which Plaintiffs in the instant action argue is used for more than just identification, but also serve as a means of additional profit for Meta, either through the sale, lease, or trade of this data or by improving (and in turn, increasing the value of) its machine learning programs.⁸

“The full ramifications of biometric technology are not fully known.”⁹ The concern for protecting this information is twofold: first, some recognize that there is an inherent right to digital privacy, and second, there are concerns about the potential misuse or breach of this data.¹⁰ The inability to change your voice or fingerprint, unlike a password or social security number, significantly increases the potential risks of a breach.¹¹

BIPA addresses both of the above-referenced aspects of the need for biometric privacy. The law is often touted as the “gold standard” for protecting individual biometric privacy as a right.¹² Under BIPA, corporations must disclose if they are collecting or using biometric data in any way, and they must develop and disclose meaningful retention and storage policies.¹³ Further, BIPA is the only state biometric privacy law that provides a private right of action for individuals to seek statutory damages and injunctive relief.¹⁴ Its outcomes have also been effective for individual plaintiffs and, arguably, consumers more broadly. Most notably, in 2021, a class of 1.6 million plaintiffs settled with Meta (then Facebook) for a total of $615 million and a significant change in its business practices.¹⁵ Facebook agreed to “delete all existing and stored face templates” for the relevant class members, and set the default for all users to “off,” meaning that they will not collect or create “face templates” automatically from photos any users upload.¹⁶

For all of the protection it offers, BIPA is still only state law.¹⁷ Many of the large corporations that the law seeks to regulate are based outside of the state’s jurisdiction.¹⁸ The Delgado action itself relies on Illinois law, but Meta’s choice-of-law provision in its user agreements requires the action to be litigated in California.¹⁹ Moreover, BIPA claims brought in federal court are at risk of not meeting the Article III standing requirements post-Transunion v. Ramirez.²⁰

Mere statutory violations are not sufficient to achieve Article III standing without evidence of a concrete, particularized injury.²¹ Where someone’s voiceprint, facial template, or retinal scan has been used without their consent, it may be wrong and a violation of BIPA, but without an allegation of an obvious “harm”, it can be challenging for claims to proceed through litigation. In fact, BIPA actions have been bifurcated on the standing issue—meaning that some of the claims in the proceeding have been sent out of federal court to the state court—and it’s unclear which claims can be resolved within the federal courts.²² The Delgado case is moving forward, but the Court appears to have advised Delgado to address the standing issues in future briefings as well, and the fate of this litigation at this point is entirely uncertain.²³

BIPA and any future state or federal adjudications do not guarantee the right to privacy. The only way to end piecemeal legislation and claim bifurcation is to establish a universal, federal standard to protect biometric privacy. Many individuals have proposed their own solutions to this problem, ranging from recognizing standing for some of the finer points of BIPA²⁴ to outright updating the Bill of Rights.²⁵ Whether the advocacy is done through the legislative branch or through expanding the interpretation of the constitutional right to privacy,²⁶ the protection of biometric data becomes increasingly important as companies find exponentially more ways to use such information.

Paige Green is a second-year law student at the Benjamin N. Cardozo School of Law and a Staff Editor at the Cardozo Arts & Entertainment Law Journal. Paige is interested in exploring the connection between culture, entertainment, capital, and public law and she enjoys researching a wide variety of legal topics. This semester she is clerking at the United States District Court for the Eastern District of New York through the Alexander Fellows program.