‘They have to tell you they’re going to collect it’: The Illinois biometric law companies violate, resulting in big settlements

CHICAGO (CBS) — Right now, you and thousands of others in Illinois may be expecting a check from Google thanks to a $100 million class action lawsuit.

It’s far from the first lawsuit of its kind, and as CBS 2 Investigator Megan Hickey reports, certainly not the last, thanks to a special law here in Illinois.

It’s the Illinois Biometric Information Privacy Act. It’s not that companies can’t use technology that collects this type of information. It’s that they have to tell you about it.

Biometric data helps make our fast-paced world even faster. Buying a cup of coffee with your finger print. Scanning your eye instead of your passport. Sounds easy, but there’s a catch.

“That type of personal information, once somebody has it, they have it. There’s nothing you can do to get it back.”

Ed Yohnka with the ACLU of Illinois tells us that was the idea behind the Illinois Biometric Information Privacy Act, which passed in 2008.

It basically says you can collect iris scans, fingerprints, voiceprints, facial geometry scans, but you have to get written consent to do so. Since the law passed, Facebook was saddled with a $650 million settlement for its “face templates.”

TikTok was ordered to pay $93 million for their facial recognition software. Snapchat had to pay $35 million to Illinois residents for their “lenses” and “filters.”

And just this week, Google was ordered by a Cook County judge to pay $100 million for their “face grouping tool” and 14 years later, businesses in Illinois are still violating this law.

There’s been pushback from lawmakers who have tried, so far unsuccessfully, to repeal the law. Many believe it is too strict.
And it’s true, Illinois’ biometric protections are the tightest in the country.

Yohnka warns that some businesses may not realize that their data collection violates Illinois law. So how do businesses protect themselves from a possible legal battle?

There are three things to keep in mind:

“If a company is going to collect that information, they have to tell you they’re going to collect it, they have to tell you how they’re going to use it and they have to get written consent from you,” Yohnka said.

 The state of Maine was actually very close to passing a law recently that would mirror Illinois’ but it did not pass so as it stands, Illinois is the only state in the country with this kind of a biometric privacy law on the books.