Steak ‘n Shake class action alleges ordering kiosks collect biometric data

Steak ‘n Shake ordering kiosks class action overview: 

• Who: An Illinois resident is suing Steak ‘n Shake.
• Why: The plaintiff claims the company illegally collected his facial data.
• Where: The Steak ‘n Shake class action lawsuit was filed in an Illinois federal court.

Casual dining chain Steak ‘n Shake has been hit with a class action lawsuit alleging that it illegally uses people’s facial information at its self-service kiosks.

Plaintiff Michael Massel filed the class action lawsuit against Steak N Shake Inc. on Aug. 28 in an Illinois federal court, alleging violations of state consumer laws. 

Massel’s lawsuit claims Steak ‘n Shake violated Illinois’ Biometric Information Privacy Act (BIPA) by unlawfully collecting, storing, and using customers’ facial geometry data without proper consent.

The case centers on the restaurant’s recent implementation of biometric check-in kiosks, which utilize facial recognition technology to streamline customer orders and loyalty tracking. 

According to Massel’s lawsuit, these practices have raised “serious concerns” about data security and privacy.

Lawsuit: Steak ‘n Shake ordering kiosks violate privacy law

In 2024, Steak ‘n Shake introduced self-service kiosks at its locations, allowing customers to check in and pay for their meals using facial recognition. The system was marketed as a convenient way for customers to access loyalty rewards, reorder past meals, and complete transactions more quickly, the lawsuit says. 

However, Massel claims that these kiosks collected and stored his facial geometry data without his informed consent when he visited a Steak ‘n Shake location earlier this year. 

He alleges that Steak ‘n Shake failed to provide adequate notice or obtain a written release from customers before collecting their biometric data, as required under Illinois law.

Facial geometry is a type of biometric identifier that is permanent, the lawsuit says. Once compromised, it cannot be changed or replaced, unlike other forms of identification such as social security numbers. This makes the unauthorized use of biometric data particularly risky, potentially leading to identity theft and other security breaches.

The lawsuit alleges that Steak ‘n Shake violated BIPA, which requires private entities to inform individuals in writing about the collection and storage of biometric identifiers, such as facial scans, as well as to disclose the purpose and duration for which the data will be used. 

Companies must also obtain written consent before collecting such data and provide a publicly available policy for data retention and destruction, the lawsuit says. The complaint claims Steak ‘n Shake did not follow these requirements.

As a result, Massel is seeking to represent anyone who had their biometric information collected by Steak ‘n Shake in Illinois at any point in the past five years. 

He is seeking certification of the class action, damages of up to $5,000 per violation, fees, costs and a jury trial.

In August, a federal judge in Illinois approved a $9.39 million class action settlement ending claims White Castle violated its employees’ biometric privacy with allegedly improper fingerprint scans.

What do you think of the allegations in this Steak ‘n Shake class action lawsuit? Let us know in the comments. 

The plaintiff is represented by Michael L. Fradin of Fradin Law and James L. Simon of Simon Law Co.

The Steak ‘n Shake BIPA lawsuit is Michael Massel v. Steak ‘n Shake Inc., Case No. 1:24-cv-07827 in the U.S. District Court for the Northern District of Illinois.

Read About More Class Action Lawsuits & Class Action Settlements:

• Capital One class action alleges it shares data with Meta, Google
• Talkspace class action alleges telehealth provider installed tracker on site
• Appeals court reverses Chrome data privacy lawsuit dismissal
• LinkedIn class action over DMV data collection to proceed