Instacart is facing a new biometric privacy lawsuit in Illinois over allegations that it violated the state’s Biometric Information Privacy Act (BIPA) by improperly collecting facial scan data from its delivery workers during identity verification procedures. The complaint, filed in Illinois state court, centers on facial geometry data allegedly gathered without the legally required disclosures and written consent.
The lawsuit claims that Instacart, in partnership with identity verification vendor Jumio, scanned workers’ facial features without first providing a clear, publicly available policy on how biometric data would be collected, stored, and destroyed—actions that, if proven, would contravene several provisions of BIPA. The statute, enacted in 2008, mandates that companies obtain informed written consent prior to collecting biometric identifiers and maintain data retention schedules that are accessible to the public.
The plaintiffs argue that neither Instacart nor Jumio adequately informed shoppers about the purpose and scope of biometric data collection, nor did they provide documentation on how long the data would be retained or how it would eventually be deleted. These alleged failures form the basis for claims of both negligent and willful violations of the statute.
Under BIPA, companies can face penalties of $1,000 for each negligent violation and $5,000 for each intentional or reckless one. While a 2024 amendment to the law now limits damages to one recovery per person rather than per scan, that provision may not apply retroactively. If the court rules based on earlier interpretations—as established in cases like Cothron v. White Castle, where each instance of data collection was considered a separate violation—Instacart could face substantial financial exposure given the scale of its workforce in Illinois.
The legal risks are compounded by a recent Illinois Supreme Court ruling that insurers are not obligated to cover costs related to BIPA violations. This significantly raises the stakes for defendants, who may be liable for both settlements and litigation expenses.
This case adds to a growing wave of BIPA litigation in Illinois, where courts have increasingly interpreted the law in favor of plaintiffs. Recent rulings have allowed individuals to sue even in cases of incidental or passive biometric data collection, clearing the path for large class actions. The Illinois Supreme Court has also confirmed a five-year statute of limitations for BIPA claims, allowing retrospective challenges to remain viable well after the initial data collection took place.
The complaint also highlights broader concerns about the risks of biometric data breaches. Because facial geometry and other biometric markers are immutable, unauthorized access could lead to long-term identity theft or fraud—threats that have prompted states like Colorado and California to consider or implement stricter biometric data regulations. Colorado’s recent legislative actions underscore the growing national focus on regulating facial recognition and other biometric technologies.
As of this writing, Instacart has not issued a public response to the lawsuit. Legal experts note that the case could have wide-ranging implications for companies using biometric verification tools, especially in states with strict privacy laws like Illinois. The outcome may further define the liability landscape for businesses relying on third-party vendors for identity authentication technologies.
Source: Bloomberg Law
—
April 9, 2025 – by Cass Kennedy
