Estée Lauder Virtual Try-On Biometrics Collection Illinois BIPA Class Action

Companies nowadays are comfortable collecting large amounts of personal information from consumers—but should consumers be equally comfortable with this? At issue in this class action is the Virtual Try-On feature of Estée Lauder Companies, Inc. and the collection of facial scans in Illinois, without first meeting the requirements of the state’s Biometric Information Privacy Act (BIPA).

The class for this action is all persons living in Illinois whose biometric identifiers were captured by Estée Lauder through the use of the Virtual Try-On feature on Estée Lauder websites, between May 20, 2018 and the present.

Estée Lauder’s Virtual Try-On feature at its website allows consumer to try on its makeup products, or view their faces with the makeup applied. The complaint alleges, “All a user has to do is enable their computer or phone camera, after which Estée Lauder’s website creates a live video feed of the user’s face, with the selected makeup products applied on top of the live feed.” As an alternative, they can use a photo of themselves, uploading it to the website.

In either case, the feature takes a scan of the user’s face, the complaint alleges, without telling the consumer that it is doing this and without the user’s consent to the collection or storage of this biometric data.

Biometric information can be used as identification for such purposes as timekeeping, premises access, and financial transactions. However, biometrics are very different from other means of identifying and transacting with people because of its unchangeable nature: If a credit card number is stolen, the card can be cancelled and a new card issued, with a different number. But if a facial scan is stolen, the person cannot get another face, with a different facial geometry.

Illinois passed BIPA to apply some basic rules to the collection, storage, and use of biometrics by private companies. They include the following:

• The company must tell the subject in writing that the biometric information is being collected.
• The company must tell the subject in writing of the specific purpose and length of time for which the biometric information will be collected, stored, and used.
• The company must obtain the subject’s consent in writing.
• The company must make available to the public a written policy with a retention schedule for the biometric information and guidelines for permanently destroying it. The biometrics should be destroyed either when the initial purpose for collecting them has ended or within three years of the subject’s last interaction with the company.

According to the complaint, Estée Lauder has fulfilled none of these requirements. The complaint reviews the procedures at the site for using the Virtual Try-On feature and asserts that “Estée Lauder does not inform visitors anywhere in its Privacy Policy, Terms & Conditions, nor anywhere else on its website that it collects, captures, possesses, or otherwise obtains biometric data.”

Article Type: Lawsuit
Topic: Privacy
Tags: BIPA, Facial Scans, Taking/Storing/Using Biometric Data, Your Privacy