Apple can’t shake huge class action over Photos face scans

In the ruling, Rosenstengel swatted down Apple's attempts to argue the lawsuit shouldn't be treated as a class action, saying the questions in the case are essentially questions of law and don't require any kind of "individualized inquiries" to determine if Apple may have allegedly violated anyone's rights under Illinois law.

"Plaintiffs have framed one of the common questions as whether Apple collected biometric data from each class member and used it to identify the class member. Plaintiffs have presented evidence that the Photos app scans each image for potential faces and collects faceprints, which are feature vectors that uniquely identify face images but do not associate a name with the face," Rosenstengel wrote.

"Specifically, the app deploys 'machine learning algorithms' on the device to recognize people from their visual appearance. It is also undisputed that Apple knows the identities of its device users, including their names and email addresses, which are associated with their Apple IDs.

"Thus, whether Apple can identify users from their faceprints, alone or in combination with users’ personal information, is an issue that can be resolved on a classwide basis," the judge wrote.

The case carries with it the risk of a payout potentially worth hundreds of millions or even billions of dollars from Apple.

The lawsuit landed in court in southern Illinois in 2020, when attorneys from the firms of Schlichter Bogard, of St. Louis, and Montroy Law Offices, of Maryville, filed the complaint in St. Clair County Circuit Court.

Apple quickly removed the case to federal court in the U.S. District Court for the Southern District of Illinois, where the case has remained since.

The lawsuit centers on claims that Apple has, since at least 2017, allegedly violated the Illinois Biometric Information Privacy Act (BIPA) in the way it handles photos uploaded by users through their Apple devices to the Photos app.

Specifically, the lawsuit accuses Apple of allowing the app to scan the faces of people imaged in those photos, and then assigning them a unique facial template that the Photos app can then use to identify that person across all uploaded photos.

The lawsuit further asserts Apple can then use its own data, including user names, email addresses and other identifiers, to match those photos to actual people and identify them by name.

The lawsuit asserts those scans and identification processes violated the BIPA law because Apple did not first secure consent from users or provide them with required notices containing information about how the face scans would be stored, used, shared or ultimately destroyed by Apple.

The lawsuit follows a familiar pattern laid out by a growing cadre of trial lawyers across thousands of cases filed in Illinois courts under the BIPA law since 2015.

The overwhelming bulk of such lawsuits, to date, have been used by trial lawyers to target Illinois employers of all sizes and types. Those lawsuits have typically accused such employers of violating the law by scanning workers' fingerprints, voices, faces and other so-called biometric identifiers in the work place, allegedly without notice or consent.

But through the years, the law has generated headlines thanks to a collection of class action lawsuits lodged against tech giants, like Google and Meta.

As in the Apple case, class actions against those companies have famously accused them of improperly scanning photos uploaded to their platforms, such as Facebook or Instagram. Those cases have resulted in settlements worth hundreds of millions of dollars.

All told, it is estimated that the Illinois BIPA law has extracted settlements worth billions of dollars from companies across thousands of lawsuits filed mostly in Chicago courts, but in other courts in Illinois and even in other states, including California, Washington and Delaware.

Such settlements have also proven to be huge revenue generators for trial lawyers, who typically claim about a third of all the money generated from settlements in fees. Collectively, trial lawyers have raked hundreds of millions of dollars in fees from BIPA class action settlements through the years.

The driving force behind the lawsuits and resulting settlements has remained the potential for even bigger potential payouts, should the cases advance to trial.

To coerce compliance, the law gave plaintiffs the so-called right of private action, allowing them to sue businesses accused of violating the BIPA law. Those sued can face potentially steep payment demands of $1,000-$5,000 per violation.

Under Illinois Supreme Court rulings, the law was interpreted broadly, as plaintiffs could bring their lawsuits against businesses without showing they were ever actually harmed, and they could demand payment for each and every allegedly illegal biometric scan, rapidly ratcheting potential payouts into the many millions or even billions of dollars.

The potential impact of such BIPA lawsuits appear to have been blunted somewhat in recent years. Illinois state lawmakers in 2024 passed legislation explicitly declaring that the law should be understood to mean damages should be paid on a per victim basis, not "per scan."

And the U.S. Seventh Circuit Court of Appeals ruled in 2026 that the reform legislation should apply retroactively to cases that were filed before 2024 and are still pending.

However, even with such reforms, Apple could still face a potentially massive payout under the BIPA law. In her ruling, for instance, Rosenstengel noted plaintiffs have estimated as many as 6.5 million people could be included in the potential class action.

When multiplied against the damages allowed under the BIPA law, the potential damages could soar to amounts ranging from $6.5 billion to $32.5 billion.

In the years since the lawsuit was filed, Rosenstengel has denied attempts by Apple to dismiss the case. In 2022, the judge said she believed plaintiffs had done enough to show Apple both scanned the photographs and "possessed" users' data, allegedly without notice and consent, as allegedly required by BIPA.

The parties have since each moved for summary judgment on the competing claims over whether Apple may have violated the Illinois law. A judge can issue summary judgment in a case when the judge determines the facts of a dispute and the law favor one party over another substantially enough to avoid trial.

Rosenstengel has not yet ruled on those requests.

In the meantime, the judge granted the plaintiffs' requests to move forward with the case as a class action, finding the claims and legal questions at the heart of the case could be decided collectively, rather than individually.

The judge again said the plaintiffs have provided enough evidence to show that "Apple indeed collected faceprints from users and automatically uploaded them to the iCloud Photo Library" without notice or consent.

The judge further said it doesn't matter for the case if Apple users included "personal identifying information" when they uploaded photos through their devices.

And the judge rejected Apple's contention that at least some of the plaintiffs should be removed from the case because Apple claims their testimony has revealed they were recruited by trial lawyers to join the case.

Named plaintiffs in the case include Richard Robinson, of Troy; Yolanda Brown, of Godfrey; Jonathan LeBlond, of Milstadt; Patricia Orris, of Granite City; Angela Stevens, of West Frankfort; Jessica Jackson, of Metropolis; Melissa Oatman, of Collinsville; Justin Revelo, of Fairfield; and Taylor Vall, of Springfield.

Plaintiffs are represented by attorneys Andrew D. Schlichter, Jerome J. Schlichter, Troy A. Doles, Alexander L. Braitberg and Chen Kasher, of Schlichter Bogard; and Christian G. Montroy, of Montroy Law Offices.

Apple is represented by attorneys Purvi G. Patel, Emma Burgoon, Katie Viggiani and Tiffani B. Figueroa, of Morrison & Foerster, of Los Angeles and New York.