Apple is confronting a significant legal challenge as a class-action lawsuit alleging violations of Illinois’ Biometric Information Privacy Act (BIPA) has been certified to proceed. The case centers on the ‘People’ feature in Apple’s Photos app, which organizes images by recognizing individuals’ faces.
In March 2020, approximately ten Illinois residents initiated the lawsuit, claiming that Apple’s facial recognition technology collects and stores biometric data without obtaining explicit consent, as mandated by BIPA. This Illinois statute requires companies to inform individuals about the collection of their biometric information and to secure written consent before doing so.
BIPA stipulates penalties of $1,000 for each negligent violation and $5,000 for each intentional or reckless violation. Given the scale of the alleged infractions, Apple could potentially face damages amounting to $32.5 billion.
The lawsuit has undergone multiple amendments and extensive discovery over the past six years. Despite Apple’s efforts to dismiss the claims, the court granted class certification in June 2026. The certified classes include:
- Local Device Class: Illinois residents whose Apple devices placed their photographs into a People album between September 13, 2016, and the present.
- iCloud Subclass: Illinois residents with Apple devices that had a People album tagged with their name or identifier and had iCloud photo storage enabled during the same period.
- iCloud Faceprint Subclass: Illinois residents using devices running iOS 17.6, macOS Sonoma 14.6, or iPadOS 17.6 or later, with iCloud photo library enabled and containing at least 10 gigabytes of storage and 5,000 or more assets, from March 25, 2025, to the present.
Apple sought an immediate appeal of the class certification order, but the request was denied. Consequently, the case will proceed in district court, where plaintiffs must demonstrate that Apple’s practices violated BIPA to secure any damages.
This lawsuit is part of a broader trend of legal actions targeting tech companies over biometric data practices. Notably, Meta settled a BIPA-related lawsuit for $650 million concerning Facebook’s facial recognition system, and another for $68.5 million over Instagram’s alleged collection of biometric data without consent.
As the case advances, it underscores the growing scrutiny of biometric data usage and the importance of obtaining explicit user consent. The outcome could have significant implications for how tech companies implement and disclose facial recognition technologies, particularly in jurisdictions with stringent privacy laws like Illinois.
