It should have been no surprise to MAC Cosmetics that last week, an Illinois judge denied their motion to dismiss the class action suit brought against them last year. Like Texas and Washington, Illinois has strict biometric information privacy legislation prohibiting companies from capturing, collecting, obtaining, storing, and using biometric information without an individual’s prior informed written consent.
The lawsuit alleges that MAC was in violation of the Illinois Biometric Information Privacy Act (“BIPA”) by capturing the plaintiff’s biometric data without her prior written consent, and that MAC could use the collected biometric data to later identify her. According to legal documents, plaintiff Fiza Javid was not shown disclosures nor asked for consent before she (and others) used the company’s augmented-reality (AR) virtual try-on technology in-store and online.
The plaintiff’s attorneys argued in their complaint that the brand could use the plaintiff’s biometric data to later identify her. “Once an image of an individual's face is scanned and its biometric measurements are captured, computers can use that data, with facial recognition technology that exists now and continues to mature, to identify that particular individual any other time that individual's face appears on the internet.”
This is not the first time MAC's parent company, Estée Lauder, has faced potential litigation over this issue, though last time it had the opposite outcome. In 2024, an Illinois judge granted Estée Lauder’s motion to dismiss a class action suit over biometric information privacy because the plaintiff did not provide proof the company could identify customers through their facial scans.
The MAC motion to dismiss was denied because, according to the judge, plaintiff Fiza Javid “must plausibly allege that MAC was capable of identifying her using collected biometric data. Javid has met this burden, so the matter may proceed.”
Numerous beauty brands and retailers utilize some form of AR or AI to enable consumers to “try on” products before they buy. But with legislation varying by state, the risk may not be worth the reward if it means paying a hefty price for potential litigation. For now, brands and retailers must be diligent in obtaining consumers’ written consent before capturing their biometric data.
