Class Action Says Coinbase Captured, Stored Illinois Users’ Biometric Data Without Consent

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action claims Coinbase has wrongfully collected, stored, shared and profited from Illinois residents’ biometric data, including facial and fingerprint scans.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

The 19-page lawsuit alleges that the cryptocurrency exchange has unlawfully captured and stored thousands of face templates and fingerprint scans from consumers who use the Coinbase app, in particular by requiring new users to upload selfies and photos of their state-issued IDs and to scan their fingerprints to log in.

The suit says that the company has run afoul of the Illinois Biometric Information Privacy Act (BIPA) by collecting, storing and disclosing to numerous third parties users’ biometric data without notice or express consent. In addition, the case claims that Coinbase, in direct violation of the BIPA, has failed to publish specifics about the purpose and length of time for which it will store the biometric information.

A consumer who opens a new Coinbase account is required to upload a real-time photo of their face and a picture of a valid ID card, which the platform then uses to create a detailed template of the user’s facial geometry and verify their identity, the complaint explains. Coinbase users are also required to scan their fingerprint each time they log into the mobile app, the filing states.

By Illinois law, biometric information must be permanently destroyed once the purpose for collecting it has been fulfilled, or after three years have passed since a user last accessed the platform, the lawsuit shares. As the suit tells it, Coinbase should have deleted the facial scans at issue after a consumer had successfully opened an account, and destroyed the fingerprint scans after the person had logged out or closed their account. However, according to the case, Coinbase failed to do so on both counts.

What’s more, the complaint alleges that the company has unlawfully disseminated consumers’ biometric data to numerous third parties such as Jumio Corporation, Onfido, Inc., Au10tix LTD, Solaris AG and Liquid Co., Ltd, among others.

The plaintiff, an Illinois resident and Coinbase user, was unaware that the company had collected, stored and shared his biometric information because he never received notice or gave his consent, the filing says.

The lawsuit looks to represent any Illinois residents whose biometric information was collected by Coinbase at any point since May 1, 2018.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.