Judge certifies Illinois biometric class against Amazon over face grouping in Amazon Photos

A federal judge has certified a class of Illinois residents suing Amazon.com Inc. under the Illinois Biometric Information Privacy Act over facial analysis in the Amazon Photos service. Co-lead counsel Wexler Boley & Elgersma said in a November 11 announcement that United States District Judge John J. Tharp Jr. of the Northern District of Illinois granted certification on November 10 in Hogan v. Amazon.com, Inc., No. 1:21-cv-3169.

The certified class, as counsel describes it, covers Illinois residents whose faces appeared in at least one photograph uploaded to their own Amazon Photos account in Illinois while the service's image recognition feature was turned on, for the period from October 18, 2016 through January 31, 2023. Amazon has identified 339,847 accounts with Illinois billing addresses where image recognition was enabled at some point in that window, according to the firm's announcement and to Biometric Update, which reported the ruling on November 12. Not all of those accounts necessarily qualify.

The plaintiffs allege that Amazon Photos ran facial recognition on uploaded images, generated numerical representations of the faces it found and grouped photographs of the same person, without the written notice and informed written consent Illinois law requires before a private entity collects biometric identifiers. In the firm's account of the certification order, the court found that Illinois users could switch on image recognition without encountering the statutory notices, and that Amazon's terms of use did not expressly describe the information as biometric. Amazon argued that whether any individual user gave informed consent is a question that varies person by person, which would defeat class treatment. The announcement quotes the order as saying: "Amazon insists that 'informed consent' is an individualized issue, but this is not a subjective inquiry."

The judge declined to certify a second proposed class of non-users whose faces appeared in photographs uploaded by other people, according to Biometric Update. That keeps the case to account holders rather than everyone photographed by someone else.

More than five years of procedural fighting

The case was filed in 2021 in Cook County Circuit Court by Angela Hogan and her minor child and then removed to federal court. In a memorandum opinion dated March 30, 2022, Judge Harry D. Leinenweber rejected Amazon's attempt to apply Washington law under a choice-of-law clause in the Amazon Photos terms, noting that Washington's biometric statute creates no private cause of action and leaves enforcement to that state's attorney general. Enforcing the clause would violate fundamental Illinois public policy, the court held, because applying Washington law "would rob Plaintiffs of control over their individual biometric information."

That opinion allowed the Section 15(b) notice-and-consent claim to proceed, remanded the Section 15(a) retention-policy claim and the Section 15(c) profiting claim to state court for lack of federal standing, and dismissed an unjust enrichment count as too attenuated. In analyzing notice, the court found that a reference in Amazon's terms to retaining image recognition data including data about faces was not clear enough to signal that a biometric identifier was being collected.

Exposure in BIPA cases comes from the statute's fixed damages: $1,000 for each negligent violation and $5,000 for each intentional or reckless one, as Biometric Update noted. Co-lead counsel are Kenneth A. Wexler and Justin N. Boley of Wexler Boley & Elgersma, joined by Gustafson Gluek, Stephan Zouras and Keller Rohrback.

What this means for in-house counsel

The ruling is a reminder that a choice-of-law clause and a dense set of terms of use are weak defenses to an Illinois biometric claim. On the plaintiffs' account of the order, the adequacy of notice was treated as a question answerable from the company's own interfaces rather than user by user, and that is the kind of finding that makes certification possible. Legal teams whose products use facial grouping, voice matching, fingerprint login or similar features should assume the consent flow itself will be the evidence, and should be able to produce screenshots and release histories showing what a user in a given state saw and when.

Companies should also check whether their notices use the statutory vocabulary. The concern counsel attributes to the court, that the terms never called the data biometric and that the feature could be enabled without the notices appearing, points to a practical fix: a standalone written disclosure that names biometric identifiers and biometric information, states the purpose, gives a retention and destruction schedule, and captures a written release before collection begins rather than somewhere in an account settings path.

The split between the two proposed classes is worth watching as the order is digested. Account-holder classes are bounded by records the company already keeps, while claims on behalf of people who never had an account are harder to define. That distinction should inform how legal departments scope reserves and instruct outside counsel on early class-definition fights.