OnlyFans.com Hit with Class Action Over Content Creator Facial Scans

New to ClassAction.org? Read our Newswire Disclaimer

The company behind OnlyFans.com has run afoul of an Illinois privacy law by capturing and storing without authorization content creators’ facial biometrics as part of the website’s verification process, a proposed class action alleges. 

The 16-page complaint alleges Fenix Internet LLC, whose OnlyFans.com site affords subscription-based access to content creators, has violated the Illinois Biometric Information Privacy Act (BIPA) by matching a content creator’s facial scan with the biometric profile it extracts from the individual’s government ID without first making certain statutory disclosures. More specifically, OnlyFans.com has failed to make publicly available a valid written policy as to its retention and deletion practices, a requirement of the BIPA, concerning the facial biometrics it gathers from content creators, the suit alleges. 

Given the fact that most of the content on OnlyFans is of an adult nature, prospective content creators must undergo a registration process that includes verification of their age and identity, the case says. To be approved to create content, OnlyFans requires a person to submit a photo of a government ID in addition to a selfie of them holding the government ID, after which they may be verified by the site within 24 to 48 hours, per the lawsuit. OnlyFans also offers an automated verification process that utilizes a web portal wherein a content creator is asked to submit a selfie and the front and back of a valid government ID card that features their face, the case adds. 

According to the complaint, OnlyFans’ automated verification process extracts an individual’s facial biometrics to create a geometric profile of their face that’s then compared to the profile extracted from their ID document to see if they match. 

In the summer of 2021, OnlyFans began to receive complaints about the apparently insufficient efforts in place to ensure that content creators on the site were not minors, the case says. In response, OnlyFans rolled out a mass age/identity verification campaign that required many of its content creators selling paid content on the platform to re-verify their age and identity through an automated biometric identity verification process, the lawsuit states. Per the suit, content creators had to go through the verification process before they could sell any more content or even withdraw fund balances on their OnlyFans accounts.

The lawsuit says that in addition to failing to make public a valid retention and deletion policy with regard to what happens to content creators’ biometrics when they no longer work for OnlyFans, the company has also unlawfully profited from the facial scans it obtains. More specifically, the suit contends that due to the nature of the content on OnlyFans, the company necessarily relied upon proposed class members’ facial biometrics in order to operate and obtain revenue. 

The pseudonymous plaintiff goes on to allege that OnlyFans further violated the BIPA by having a “substandard level of care” compared to other entities who deal with highly sensitive information in that the platform failed to prevent ex-employees from gaining access to the biometric data in its possession. 

The BIPA is a state law that governs private entities’ collection, use, storage, retention and destruction of Illinois residents’ biometric information, which includes facial, fingerprint and retinal scans, as well as voiceprints. The requirements imposed by the law on private entities who deal in Illinois residents’ biometrics include obtaining informed, written consent before doing so and providing certain disclosures with regard to the storage and permanent destruction of the data. 

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.