Biometric Privacy Lawsuit News: Largest Settlements and BIPA Rulings

Biometric privacy lawsuit settlements have moved billions of dollars over the past five years, driven mostly by Illinois’s Biometric Information Privacy Act (BIPA) and, more recently, by state enforcement actions in Texas. Meta alone has paid $1.4 billion to Texas and $650 million to an Illinois class. Google has paid $1.375 billion to Texas and $100 million to an Illinois class. TikTok settled for $92 million, Clearview AI gave its class a 23 percent equity stake, and smaller settlements in the tens of millions continue to close in 2025 and 2026. A 2024 amendment to BIPA has since capped what any one person can recover, and in April 2026 the Seventh Circuit ruled that cap applies retroactively to pending cases.

The Largest Settlements to Date

Meta — $1.4 Billion (Texas)

In July 2024, Meta agreed to pay Texas $1.4 billion over five years to resolve allegations that it ran facial recognition on photos uploaded to Facebook for more than a decade without obtaining informed consent from Texans. Texas Attorney General Ken Paxton brought the case under the state’s Capture or Use of Biometric Identifier Act (CUBI), which allows civil penalties of up to $25,000 per violation but gives no private right of action.¹²³

Google — $1.375 Billion (Texas)

Paxton announced a $1.375 billion settlement with Google in May 2025. The state’s claims included unlawful capture of voiceprints and facial geometry through Google Photos and Google Assistant, along with allegations about location tracking and “Incognito” mode. A Google spokesperson said the agreement “settles a raft of old claims, many of which have already been resolved elsewhere, concerning product policies we have long since changed.”⁴⁵

Facebook — $650 Million (Illinois Class Action)

The largest BIPA class-action settlement to date resolved claims that Facebook’s “Tag Suggestions” feature extracted and stored the facial geometry of Illinois users without written consent. Judge James Donato approved the $650 million all-cash deal in the Northern District of California on February 26, 2021, calling it a “landmark result” and a “major win for consumers.” About 1.6 million class members were eligible and payments came in at $345 or more per person, with a claims rate near 22 percent. Facebook also agreed to switch face recognition off by default for users who had not opted in and to delete stored face templates for class members who had not given separate consent.⁶⁷

Google Photos — $100 Million (Illinois Class Action)

Separately from the Texas action, Google settled an Illinois class action in 2022 for $100 million over its Google Photos face-grouping tool, which organized photos by identifying similar faces without the explicit consent BIPA requires.⁸

TikTok / ByteDance — $92 Million

ByteDance agreed to a $92 million class-action settlement in 2021 to resolve 21 consolidated complaints alleging the TikTok app used facial recognition to map users’ faces for profiling without proper consent. Judge John Lee granted final approval in July 2022. TikTok agreed to stop collecting biometric data, geolocation information, and clipboard content unless expressly disclosed in its privacy policy and lawful. Illinois residents received a larger share of the payout than class members in other states.⁹¹⁰

Clearview AI — 23 Percent Equity Stake (About $51.75 Million)

The Clearview AI class action produced one of the more unusual structures in class-action history. On March 20, 2025, Judge Sharon Johnson Coleman approved a deal in which Clearview gave the class a 23 percent equity stake rather than cash, valued at roughly $51.75 million based on a January 2024 company valuation of $225 million. The payout is triggered only if Clearview goes public, is sold, elects to pay 17 percent of its revenue, or the class sells its stake.¹¹¹²

Attorneys general in 22 states and the District of Columbia filed an amicus brief opposing the deal, arguing the monetary relief was speculative and the injunctive protections inadequate. The court noted that a separate Clearview settlement with the ACLU already includes a permanent nationwide injunction barring the company from offering its app to anyone other than government law enforcement agencies acting in their official capacity.¹³¹²

Recent Settlements in 2025 and 2026

Settlements have kept closing even after the 2024 damages cap took effect.

Motorola Solutions agreed to $47.5 million in mid-2025 in Simmons v. Motorola Solutions, Inc., which alleged that Motorola and its Vigilant Solutions subsidiary used “FaceSearch” facial recognition technology and a gallery of law enforcement booking photos to collect biometric data of Illinois residents without meeting BIPA’s consent requirements. Payments to approved claimants began going out in February 2026.¹⁴
Speedway settled in September 2025 for $12 million over allegations that it tracked employee hours using finger scanners at Illinois locations without proper consent.¹⁵
Google Education settled H.K. et al. v. Google LLC for $8.75 million, resolving claims that Google collected voice and face models from about 660,000 Illinois students through its Google Workspace for Education platform. Final approval came in October 2025 and distribution began in February 2026.¹⁶
YouTube settled in August 2025 for $6 million over the alleged illegal use of a “Face Blur” tool on videos in Illinois.¹⁵
Kenvue (Neutrogena) agreed to $4.7 million in Melzer v. Kenvue Inc., which alleged that the Neutrogena Skin360 app collected users’ facial geometry through an AI skin analysis feature without informed consent. The proposed settlement covers roughly 11,000 Illinois residents who used the tool between December 2019 and May 2023, with preliminary approval sought in February 2026.¹⁷

How the 2024 Damages Cap Changed the Math

Governor J.B. Pritzker signed Senate Bill 2979 in August 2024. The amendment resolved a question the Illinois Supreme Court had left open in Cothron v. White Castle System, Inc.: whether every biometric scan of a person counts as a separate violation. The court had ruled in 2023 that claims accrue with every scan, a reading it acknowledged could produce “annihilative” damages. Under the amendment, repeated collection of the same biometric identifier from the same person using the same method now counts as a single violation, capping recovery at one award per person.¹⁸¹⁹

Whether the cap reached lawsuits already on file was the next fight. In November 2024, Judge Elaine Bucklo of the Northern District of Illinois became the first federal judge to rule the amendment retroactive, dismissing Gregg v. Central Transport LLC after finding the plaintiff’s potential recovery had dropped to about $15,000, below the $75,000 threshold for federal diversity jurisdiction. Other district courts went the other way, holding that the amendment applied only going forward.²⁰²¹

The Seventh Circuit settled the split on April 1, 2026, in Clay v. Union Pacific Railroad Co. The court held that the amendment is “remedial” rather than substantive, meaning it limits available remedies without changing what conduct the law prohibits, and therefore applies retroactively to all pending cases. The ruling ends the per-scan damages theory in federal cases within the circuit and requires lower courts to reassess damages and, in many cases, whether the dollar threshold for federal jurisdiction is still met. Large classes can still produce meaningful total recoveries under a per-person cap, and the underlying notice-and-consent rules are unchanged.²²¹⁹

Why BIPA Drives Most of These Cases

BIPA, enacted in 2008, requires companies to obtain informed written consent before collecting biometric data such as fingerprints, facial scans, and voiceprints. It is still the only state biometric privacy statute that lets individuals sue for damages without proof of actual harm. In Rosenbach v. Six Flags Entertainment Corp. (2019), the Illinois Supreme Court confirmed that a person qualifies as “aggrieved” the moment a company fails to comply with the statute, with no separate injury required. Statutory damages run $1,000 per negligent violation and $5,000 per intentional or reckless violation.²³ The Illinois Supreme Court separately established a five-year statute of limitations for all BIPA claims in Tims v. Black Horse Carriers (2023).⁸

Where Similar Suits Can Happen Outside Illinois

Illinois remains the only state where individuals can personally sue under a biometric-specific statute. Texas and Washington have biometric privacy laws, but enforcement rests with government authorities, which is why the Meta and Google mega-settlements in Texas came from the attorney general and not from consumers. Colorado added biometric protections to its Privacy Act in 2024, including retention and destruction requirements, without a private right of action. New York City requires signage when commercial establishments collect biometric information and bars profiting from its sale, and Portland, Oregon, bans private facial recognition in places of public accommodation with damages of $1,000 per day of violation.³²⁴

Massachusetts has proposed a BIPA-style bill with a private right of action and statutory damages of at least $5,000 per violation. Nebraska, Minnesota, Missouri, New York, and Pennsylvania have bills at various stages that would add consent requirements, signage mandates, or other protections.³

What’s Still Pending

The most closely watched unresolved case is Cisneros v. Nuance Communications, Inc. in the Seventh Circuit. It tests whether a company that supplies voiceprint authentication to a financial institution, Charles Schwab, can invoke BIPA’s exemption for entities covered by the Gramm-Leach-Bliley Act. Oral arguments took place in October 2025, the panel ordered supplemental briefing on standing, and as of mid-2026 the decision is still pending. A ruling for the vendor would shield a broad category of companies that process biometric data for financial institutions; a rejection would represent what one commentator called “one of the first dents” in BIPA’s strict-liability framework.²⁵²⁶

At the federal level, the SECURE Data Act (H.R. 8413), from Republican Representatives John Joyce and Brett Guthrie, is the most advanced proposal to create a national privacy framework. A House Energy and Commerce subcommittee held a hearing on the bill in June 2026. The bill includes broad preemption language, with BIPA and the Texas CUBI Act explicitly cited as laws it would displace. The Electronic Privacy Information Center called the bill “a disaster for Americans’ privacy,” arguing it favors technology companies and offers weaker enforcement than the state laws it would replace. Its prospects remain uncertain, with a clear partisan split at the subcommittee.²⁷²⁸²⁹

Illinois lawmakers are pulling in the other direction. Several proposals would further narrow BIPA, including bills that would exempt biometric time clocks, shorten the statute of limitations to one year, and create an opportunity to cure violations before a lawsuit can proceed.³

1
Texas Attorney General. Attorney General Ken Paxton Secures $1.4 Billion Settlement With Meta
2
Politico. Meta Texas Settlement
3
BCLP. US Biometric Laws and Pending Legislation Tracker
4
Texas Attorney General. Attorney General Ken Paxton Finalizes Historic Settlement With Google
5
Hunton Andrews Kurth. Texas AG Announces $1.375 Billion Settlement With Google for Privacy Violations
6
Robbins Geller Rudman & Dowd LLP. In Re Facebook Biometric Info. Privacy Litig.
7
IAPP. Facebook’s $650M BIPA Settlement: A Make-or-Break Moment
8
Commercial Litigation Update. Biometric Backlash: The Rising Wave of Litigation Under BIPA and Beyond
9
Hunton Andrews Kurth. Judge Approves $92 Million TikTok Settlement
10
NBC Chicago. Judge Approves $92 Million TikTok Settlement With Illinois Claimants Receiving Biggest Share
11
Justia. In Re: Clearview AI, Inc., Consumer Privacy Litigation
12
Regulatory Oversight. $51.75M Settlement in Clearview AI Biometric Privacy Litigation
13
University of Miami Law Review. Take It at Face Value: Court Approves Equity-Based Settlement in Clearview AI Facial Recognition Class Action
14
PR Newswire. Simmons v. Motorola Solutions Class Action Settlement Notice
15
ClassAction.org. Illinois Biometric Information Privacy Act
16
Google Education BIPA Settlement. H.K. et al. v. Google LLC Settlement
17
IDTechWire. Kenvue Agrees to $4.7M BIPA Settlement Over Neutrogena Skin Scanning App
18
Illinois Courts. Cothron v. White Castle System, Inc., 2023 IL 128004
19
Sidley Austin LLP. Seventh Circuit Limits Potential Damages Under BIPA, Holds 2024 Amendment Applies Retroactively
20
Capitol News Illinois. Judge Dismisses Biometric Data Privacy Lawsuit Citing Revised State Law
21
WilmerHale. Seventh Circuit Weighs In on Critical BIPA Retroactivity Question
22
Inside Privacy. Seventh Circuit Holds That BIPA Amendment Applies Retroactively
23
Justia. Cothron v. White Castle System, Inc., 2023 IL 128004
24
StateScoop. Future State Biometric Privacy Body Data
25
Courthouse News Service. Seventh Circuit Dubious of Data Collection Class Action
26
Goldberg Kohn. David Morrison Comments on the Seventh Circuit’s Pending Decision
27
House Energy and Commerce Committee. Examining Legislation to Establish a Federal Comprehensive Privacy and Data Security Law
28
StateScoop. House Subcommittee Examines SECURE Data Act That Preempts State Privacy Laws
29
EPIC. America Needs a Strong Privacy Law, the SECURE Data Act Isn’t It