SPRINGFIELD (LN) — U.S. District Judge Nancy J. Rosenstengel of the Southern District of Illinois granted class certification on June 5 in a major Illinois Biometric Information Privacy Act lawsuit against Apple Inc. The ruling exposes the company to potential billions in statutory damages for allegedly collecting users’ faceprints without written consent or a public data retention policy.
Judge Rosenstengel certified three classes totaling approximately 10 million Illinois citizens who used the People album feature in the Photos app. The Local Device Class includes approximately 6.5 million members; the iCloud Subclass includes approximately 1 million; and the iCloud Faceprint Subclass includes approximately 2.6 million.
The Local Device Class covers every Illinois citizen whose Apple device placed a photograph of that citizen into a People album between September 13, 2016, and the present. The iCloud Subclass includes those who also had an iCloud account enabled for photo storage with a People album tagged with their name or other identifier during that period. The iCloud Faceprint Subclass targets users with at least 5,000 photos and 10 gigabytes of iCloud storage who used the feature between March 25, 2025, and the present, following a software update that began syncing faceprints directly to Apple’s servers.
The ruling clears the path for trial on claims that Apple’s facial recognition technology scans face geometry to create unique “faceprints” — a biometric identifier under Illinois law — and stores that data on devices and, more recently, on Apple’s iCloud servers.
BIPA allows for $1,000 in damages for each negligent violation and $5,000 for each intentional or reckless violation. A 2024 amendment to the statute limits liability to a single violation per person for the same method of collection, but the sheer size of the certified class keeps total exposure in the billions.
Apple opposed certification, arguing that individualized inquiries into whether users labeled their albums with personal identifying information would predominate over common questions. The company also contended that proving where users were located when they took photos would require mini-trials for each class member.
The court rejected those arguments, holding that whether Apple collected biometric data capable of identifying users is a common question that can be resolved in one stroke. It noted that Apple possesses user location data and could use common proof to determine where relevant activities occurred.
The court also rejected Apple’s argument that named plaintiffs were inadequate representatives because they lacked a deep understanding of BIPA. Citing Seventh Circuit precedent, the court noted that class representatives need only a basic understanding of their claims, acknowledging that class action suits are managed by class counsel.