SPRINGFIELD (LN) — A federal judge on Friday granted class certification in a major biometric privacy lawsuit against Apple Inc., exposing the company to potential billions in statutory damages for allegedly collecting users' faceprints without written consent or a public data retention policy.
U.S. District Judge Nancy J. Rosenstengel of the Southern District of Illinois ruled that common questions regarding Apple’s data collection practices predominate over individualized inquiries, certifying a class action involving approximately 10 million Illinois citizens.
The suit, filed in 2020, alleges that Apple’s Photos app automatically scans facial geometry to create unique "faceprints" for the People album feature. Plaintiffs argue this constitutes the collection of biometric identifiers under the Illinois Biometric Information Privacy Act, or BIPA, without providing the required disclosures or obtaining informed, written consent. The complaint notes that Apple began syncing photographs and associated data across devices in 2017.
The court certified three distinct groups: a Local Device Class of approximately 6.5 million members whose devices placed photos into People albums; an iCloud Subclass of about 1 million members who enabled iCloud photo storage and had People albums tagged with their names or other identifiers; and an iCloud Faceprint Subclass of up to 2.6 million members who had devices running iOS 17.6 or later, enabled iCloud photo storage with at least 10 gigabytes of storage, and had at least 5,000 photos or videos in their library between March 25, 2025, and the present.
Apple had opposed certification, arguing that individualized inquiries into whether users labeled their People albums with personal identifying information, or where they were located when taking photos, would overwhelm common questions. The court rejected those arguments, finding that whether Apple collected biometric data capable of identifying users is an issue that can be resolved on a classwide basis.
The court also dismissed Apple’s concerns about the adequacy of the named plaintiffs. Apple had argued that some plaintiffs lacked legal sophistication. The court rejected the argument, citing Seventh Circuit precedent that class actions are managed by counsel.
Under BIPA, plaintiffs can recover $1,000 for each negligent violation and $5,000 for each intentional or reckless violation. A 2024 amendment to the statute limits liability to a single violation per person for the same method of collection, but the sheer size of the certified class still presents massive financial exposure for Apple.
Schlichter Bogard LLP and Montroy Law Offices, LLC were appointed as class counsel. The case has been pending for six years, after plaintiffs survived Apple’s motion to dismiss.