The Chicago Cubs have been named in a proposed class action lawsuit alleging that Wrigley Field used facial recognition technology to scan fans without obtaining legally required consent. The case, filed September 15, 2025, in the Northern District of Illinois, accuses the team and its security partners of violating the Illinois Biometric Information Privacy Act (BIPA).
Allegations Under Illinois Law
According to the complaint, the Cubs, along with Blue Star Security, LLC and Security Services Holdings LLC (doing business as Protos Security), deployed security systems at Wrigley Field that collected facial biometric data from attendees. The filing claims that “millions of fans” had their faces scanned without written notice or explicit consent, as required under BIPA Section 15(b).
Enacted in 2008, BIPA is one of the strongest biometric privacy laws in the United States. It requires organizations to provide individuals with written notice and obtain a signed release before collecting or storing biometric identifiers such as facial geometry or fingerprints. The law allows private individuals to bring lawsuits and recover statutory damages, even if they cannot show additional harm beyond the violation itself, a standard affirmed by the Illinois Supreme Court in Rosenbach v. Six Flags.
Broader Legal and Industry Context
The lawsuit highlights growing tensions between enhanced security measures at large venues and the strict compliance requirements of biometric privacy statutes. Stadiums and arenas across the country are increasingly experimenting with biometric entry systems to improve security and streamline fan access. However, in the absence of comprehensive federal regulation, states have pursued their own frameworks. Illinois, Texas, and Washington have enacted specific biometric privacy laws, while many others have included biometric protections in broader consumer privacy statutes.
The plaintiffs argue that the scale of alleged biometric collection at Wrigley Field could expose the Cubs and their security providers to substantial liability. Under BIPA, companies found in violation may owe statutory damages of $1,000 per negligent violation or $5,000 per reckless or intentional violation. With claims that millions of fans were affected, the potential damages could be significant if the plaintiffs succeed.
While the outcome remains uncertain, the case underscores the compliance challenges facing venues that adopt biometric technologies. Similar disputes have emerged in other industries, leading to large settlements, and this lawsuit may serve as a test of how courts apply BIPA to stadium security practices.
Sources: Law360
–
By Ji-seo Kim
