A federal court has allowed a class action lawsuit against Coinbase Global Inc. to move forward, rejecting the company’s motion to compel arbitration. The case, which centers on alleged violations of Illinois’ Biometric Information Privacy Act (BIPA), accuses the cryptocurrency exchange of collecting facial scans and other biometric data from Illinois residents without obtaining the legally required consent.
Facial Scans and Alleged BIPA Violations
The plaintiffs claim that Coinbase used facial scanning technology as part of its identity verification process, a standard component of Know Your Customer (KYC) and anti-money laundering compliance. However, they allege that Coinbase failed to secure written releases from users and did not provide a publicly available policy on the retention and destruction of biometric data, both of which are mandatory under BIPA. The law prohibits companies from collecting or storing biometric identifiers, such as facial geometry or fingerprints, without informed, written consent and clear disclosure of how the data will be handled.
Some complaints also suggest that Coinbase collected fingerprint data through its mobile app. While it remains unclear whether the company stores fingerprint data itself or whether it remains encrypted and confined to user devices, the plaintiffs argue that Coinbase bears responsibility under BIPA regardless of the underlying technical implementation.
The lawsuit further alleges that Coinbase shared users’ biometric information with third-party vendors, including Jumio Corp. and Onfido, without obtaining specific consent to do so. If proven, this would represent an additional violation of BIPA’s requirement that data subjects be informed of and approve any disclosures of their biometric data to external entities.
Class Action Implications and Industry Impact
The court’s decision to deny arbitration is a pivotal development, as it allows the case to proceed as a class action. This opens the door for a broader pool of Illinois-based users to participate in the suit. Under BIPA, companies found in violation may face statutory damages of $1,000 per negligent violation or $5,000 for each intentional or reckless infraction. Recent rulings have also clarified that insurance policies may not cover BIPA-related claims, increasing the potential financial exposure for companies facing litigation.
Legal experts note that BIPA has emerged as one of the strictest biometric privacy laws in the United States. The Coinbase case joins a growing wave of BIPA lawsuits targeting companies that collect biometric data without adequate safeguards. In recent months, Illinois courts have upheld the law’s scope in several key decisions, including the reinstatement of lawsuits involving workplace hand scanners and consumer-facing facial recognition systems.
Some plaintiffs argue that Coinbase has wrongfully benefited from users’ biometric data and failed to implement appropriate safeguards to prevent data breaches. Unlike passwords, biometric identifiers cannot be reset, and a breach involving this type of data may result in lasting harm to affected individuals. The case has attracted attention as a potential inflection point for biometric compliance in the cryptocurrency industry, where identity verification is increasingly automated but often lacks transparency regarding data handling practices.
Sources: Bloomberg Law, ClassAction.org
—
May 15, 2025 – by Ji-seo Kim
