Walmart, Best Buy, Kohl’s, Home Depot Scanned Illinois Shoppers’ Faces Without Consent, Class Actions Allege

New to ClassAction.org? Read our Newswire Disclaimer

Walmart, Best Buy, Kohl’s and Home Depot have each been hit with a proposed class action that alleges the retailers violated an Illinois privacy law by using in-store surveillance technology to capture and share shoppers’ biometric data without their knowledge or consent.

According to the four cases, the retailers have, over the past five years, captured images of shoppers’ faces from in-store security footage and uploaded the information to a biometric database operated by non-party Clearview AI, Inc. The lawsuits say that the defendants use Clearview’s database, a vast collection of facial templates “covertly” generated from images uploaded to the internet by millions of Americans, to identify individuals who appear in the stores’ surveillance footage.

The lawsuits, filed on August 12 by two Illinois residents who have patronized the defendants’ Chicagoland locations with their minor children, allege that the retailers have run afoul of the state’s Biometric Information Privacy Act (BIPA) by collecting and sharing consumers’ biometric data without first providing required disclosures and obtaining consent.

The Illinois BIPA was enacted in 2008 to regulate companies who deal in consumers’ biometric information, i.e., fingerprints, iris or retinal scans, voiceprints, and scans of hand or face geometries, the similarly worded cases relay. According to the suits, the BIPA prohibits private entities from collecting, capturing, purchasing, receiving through trade or otherwise obtaining Illinois residents’ biometrics without first:

• Informing the person in writing that their biometric information will be collected or stored;
• Informing the person in writing of the specific purpose and length of time for which their information will be collected, stored or used;
• Receiving a written release from the individual for the collection of their data; and
• Publishing a publicly available retention policy and guidelines for the permanent destruction of the data.

The cases claim the retailers have further violated the BIPA by profiting from Illinois residents’ biometric data and failing to obtain their consent before sharing the information with a third party, Clearview AI. Per the suits, the defendants have each obtained access to Clearview’s database in order to upload shoppers’ images and identify them—all without the individuals’ knowledge or permission.

According to the complaints, Clearview, who is not named as a defendant in any of the suits, has failed to provide notice or obtain consent before scraping billions of photos from the internet from which to build its vast biometric database. The New York-based startup is no stranger to legal trouble over its controversial data collection practices and, as one case argued, the overly broad access it provides to its database.

The complaints each note that private entities who violate the BIPA may be required to pay Illinois residents up to $5,000, or the amount of their actual damages if it’s higher than that, for each violation of the statute.

The lawsuits look to represent several classes of Illinois residents who had their biometric information or biometric identifiers collected, captured or otherwise obtained by the defendants during visits to the retailers’ Illinois stores.

The four complaints can be read below.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s newsletter here.