ID.me lawsuit claims company violates data storage requirements

Top Class Actions’s website and social media posts use affiliate links. If you make a purchase using such links, we may receive a commission, but it will not result in any additional charges to you. Please review our Affiliate Link Disclosure for more information.

ID.me lawsuit overview: 

• Who: An Illinois woman who used ID.me to verify her identity is suing the company.
• Why: She says the company had a policy to store biometric data for longer than is legally allowed under the Illinois Biometric Information Privacy Act.
• Where: The lawsuit was filed in an Illinois court.

Identity verification company ID.me stored Illinois users’ geometric facial data twice as long as it was allowed to under the Illinois Biometric Information Privacy Act (BIPA), a new class action lawsuit alleges.

Plaintiff Latisha Skinner, a former employee of Ann & Robert H. Lurie Children’s Hospital in Chicago, filed the class action lawsuit against ID.me Inc. on Aug. 8 in an Illinois circuit court, alleging violations of BIPA.

Consumers have become growingly concerned with their right to data privacy and data security when it comes to biometric data made vulnerable by devices such as fingerprint and facial scanners. 

Lawmakers introduced the Illinois Biometric Information Privacy Act (BIPA) in 2008 as a way to combat these concerns, and it has since been at the center of a number of class action lawsuits and settlements. 

Under the law, private companies are allowed to hold onto a person’s biometric information for only up to three years after the individual’s last interaction with that company, Skinner states.

However, in her case, she says she created an account with ID.me and uploaded a photo of her face for biometric identification verification while the vendor had policies allowing it to store users’ biometric data for up to seven and a half years after they close their account with the company.

That policy was illegal for Illinois data, she says. The company has since changed its policy for Illinois. 

ID.me contracts with many Illinois companies, lawsuit alleges

The children’s hospital is one of only several companies in the state that contract with ID.me for identity verification services, according to Skinner’s lawsuit. She was required to register an account with ID.me when she worked at the hospital in January 2020, she says.

ID.me took the biometrics of “hundreds, if not thousands” of individuals within the state while its unlawful biometric data retention policy was still in place, Skinner alleges. 

She’s looking to represent anyone who scanned their face into the company’s system before it changed its retention policy for Illinois.

Skinner is seeking certification of the class action, damages of $1,000 for every negligent BIPA violation and $5,000 for every willful violation found, plus interest, fees and a jury trial.

A similar class action lawsuit filed earlier this summer alleges the Photos application on Microsoft’s Windows 10 and Windows 11 operating systems obtains the facial biometric data of Illinois residents without their consent, violating biometric privacy laws. 

Did you use ID.me in Illinois prior to the policy change? Let us know your thoughts on the class action in the comments! 

Skinner is represented by Carl Malmstrom, Philip Fraietta, Alec Leslie, Max Roberts and Christopher Reilly of Bursor & Fisher PA.

The ID.me BIPA Class Action Lawsuit is Latisha Skinner v. ID.me Inc., Case No. 2022-CH-07688, in the Circuit Court of Cook County, Illinois, Chancery Division.

Read About More Class Action Lawsuits & Class Action Settlements:

• Bloomberg class action alleges company shares subscriber information with Facebook
• Jame Roll Form Products biometric privacy $538K class action settlement
• R.R. Donnelley class action alleges data breach result of company negligence
• OneTouchPoint data breach class actions allege cyberattack affected over 1M patients