Apple is facing a proposed $32.5 billion class-action lawsuit in Illinois over allegations that its Photos app collected and processed users' biometric data without obtaining the consent required under state law.
The complaint claims Apple's Photos app uses facial recognition technology to analyse faces in users' photo libraries and generate unique facial templates, or "faceprints," to identify individuals across images. It further alleges that the data is synced across Apple devices through iCloud without users' informed consent.
The plaintiffs argue that the practice violates the Illinois Biometric Information Privacy Act (BIPA), which requires companies to obtain consent before collecting or storing biometric identifiers.
Apple has denied the allegations, arguing that the technology used by the Photos app does not meet the legal definition of a biometric identifier. The company says the data cannot be used to reconstruct a person's face and is not linked to an individual's identity.
The lawsuit has successfully passed two major legal milestones. In June, an Illinois court granted class-action status to the case, and on June 30, the US Court of Appeals for the Seventh Circuit rejected Apple’s attempt to reverse that ruling. The proposed class covers roughly 6.5 million users in Illinois, and potential damages could total $32.5 billion if the maximum penalties allowed under BIPA are imposed.
Enacted in 2008, the Illinois Biometric Information Privacy Act regulates how companies collect, store and share biometric identifiers, including fingerprints, retinal scans, voiceprints and facial data. The law allows statutory damages of $1,000 per violation, increasing to $5,000 for intentional or reckless violations.
The law has previously led to major settlements involving technology companies, including Meta's $650 million settlement over Facebook's facial recognition feature.