Snapchat Violated Ill. Users’ Privacy by Collecting Biometric Information Without Consent, Class Action Alleges

Snapchat has come under fire in a recent proposed class action that claims the social media app unlawfully collects users’ biometric information without their informed consent.

More specifically, the 33-page lawsuit filed on May 11 alleges defendant Snap Inc. has run afoul of the Illinois Biometric Information Privacy Act (BIPA), a law designed to protect residents from the unauthorized use of their biometric identifiers—such as fingerprints, iris and retina scans, and, at issue in this case, voiceprints and scans of facial geometry.

The lawsuit claims Snapchat, a social media platform that allows users to communicate through short videos and images called “snaps,” collects, stores and shares users’ unique facial features and voices without first providing required disclosures about how the information will be used and for how long. Moreover, Snap fails to obtain a written release from users authorizing the company’s collection of their private information as required by the BIPA, the suit alleges.

All told, the lawsuit claims that Snap has violated the privacy rights of Illinois Snapchat users whose facial scans and voiceprints were collected, stored and shared without their permission.

Snapchat’s alleged biometric data collection practices

The case claims Snapchat has unlawfully collected users’ voiceprints and scans of their facial features through its lenses and filters features.

Per the suit, lenses allow Snapchat users to modify their facial features with special effects using their smartphone camera. After opening the camera screen within the Snapchat app, users can swipe left to access the different lenses, follow any on-screen prompts such as “raise your eyebrows,” and tap or hold the “capture” button to take a Snap or video, the complaint relays.

Snapchat’s sponsored lenses and filters work in a similar way, allowing users to send images and videos of their faces with special effects applied, the suit says.

According to the case, Snapchat’s lenses feature uses facial recognition technology developed by Looksery, Inc. to scan users’ faces and assemble a “detailed map of their facial features”—which the suit argues constitutes a biometric identifier or biometric information as defined by the Illinois BIPA. The filters feature likewise scans users’ faces and obtains their unique biometric identifiers, the suit says.

As such, Snap was obligated under the BIPA to make certain disclosures and obtain users’ written consent before collecting their data, the lawsuit contends.

BIPA requirements

The case explains that the Illinois BIPA specifies that no entity may “collect, capture, purchase, receive through trade, or otherwise obtain” a person’s biometric identifier or information without first taking certain actions.

For one thing, the company must inform the person in writing that their biometric information is being collected or stored, and the purpose and length of time for which the data will be collected, stored and used.

The company is also required to obtain a written release from the individual authorizing the use of their biometric identifier or information and refrain from disclosing that information to third parties without the person’s consent.

The BIPA also requires private entities to develop a publicly available retention policy and guidelines for the permanent destruction of biometric data once its initial purpose has been satisfied or within three years of the individual’s last interaction with the company, whichever occurs first.

The case claims that Snap has failed to comply with all of these requirements despite collecting its users’ biometric information through its lenses and filters features.

Who is covered by the lawsuit?

The lawsuit aims to cover all Illinois citizens who used the Snapchat app and had their biometric information or identifiers obtained through the app without first providing a written release as defined by the Illinois BIPA.

The suit also looks to cover Illinois residents whose biometric information or identifiers were collected through Snapchat and then sold, leased, traded or otherwise used for profit by Snap, or were disclosed, redisclosed or otherwise disseminated without the individuals’ consent.

How do I join the lawsuit?

There’s usually nothing you need to do to join or be considered part of a proposed class action when it’s first filed. If the case moves forward and settles, which could take months or even years, that’s when those affected, called the class members, would receive notice of the settlement with instructions on how to file a claim for their share.

Why is this lawsuit only for Illinois residents?

The case only covers people who live in Illinois because the BIPA is an Illinois state law that only applies to its residents.

Although some other states have laws that regulate the use of residents’ biometric information, the Illinois BIPA is the only statute so far to include a private right of action, meaning private citizens are allowed to sue companies for alleged violations of the law.

The BIPA received significant attention during litigation against Facebook that accused the social media giant of unlawfully collecting Illinois users’ face templates through its “tag suggestions” feature. Facebook agreed to pay $650 million to settle those claims in what the judge described as “one of the largest settlements ever for a privacy violation.” 

More recently, another BIPA lawsuit against Facebook over its allegedly unlawful collection of Instagram users’ facial scans was sent to arbitration.