Match, Tinder Facial Scans for Verification BIPA Class Action

Match Group, Inc. owns around forty-five dating companies around the world, including Match.com, Tinder, OKCupid, and PlentyOfFish, among others. This class action brings suit against Match Group, Inc., Match Gorup, LLC, and Tinder, Inc., claiming that Tinder uses biometric facial scans for verification, including for verification of identities of people in Illinois, without fulfilling the requirements of an Illinois law, the Biometric Information Privacy Act (BIPA).

The class for this action is all Illinois residents who directly or indirectly used Match’s and Tinder’s biometric authentication products and subsequently had his or her biometric facial scan captured, collected, stored, or otherwise obtained by Match or Tinder during the applicable statutory time frame.

Tinder uses selfie biometrics for identity verification to make sure the user matches their profile image, running both a Liveness Check and a 3D Face Authentication to grant a Photo Verified status.

The user takes a selfie video, and the Liveness Check scans the user’s face to make sure that the video was taken by a real person and not digitally altered, the complaint claims. Similarly, the complaint says, the 3D Authentication uses both the video selfie and the profile photo “and extracts facial geometrics using facial recognition technology to generate a unique number or facial geometry ‘template.’” The complaint claims that this information is then stored, without the consent of the user.

Biometric information is different from other identifying information in that it cannot be changed or replaced, the complaint alleges: “If a biometric database is hacked, breached, or otherwise exposed … employees have no means by which to prevent identity theft, unauthorized tracking, and other improper or unlawful use of this highly personal and private information.”

The complaint alleges that there is an illegal market for this kind of information. Illinois passed BIPA to set some basic rules for the collection, storage, or use of biometrics. BIPA requires that private companies that wish to collect, store, or use the biometrics do certain things:

• They must inform subjects in writing of the specific purpose and length of time for which their biometrics are being collected, stored, or used.
• They must have a publicly-available retention schedule and guidelines which they will use to permanently destroy the biometrics.
• They must get a written release from the subject to collect, store, or use the biometrics.
• They must get a written release from the subject to disclose or share the biometrics with third parties.

The complaint alleges that Tinder and Match did none of these things. Among other things, the complaint protests Tinder’s and Match’s “failure to destroy their biometric data when the initial purpose for collecting or obtaining such data has been satisfied or within three years of [the] individual’s last interactions with” the companies.

Article Type: Lawsuit
Topic: Privacy
Tags: BIPA, Biometric Data, Taking/Storing/Using Biometric Data, Your Privacy