A class-action lawsuit against Apple regarding the face recognition feature in its Photos app is progressing after a court approved the case for certification. The plaintiffs claim that Apple breached Illinois' Biometric Information Privacy Act, which regulates how businesses handle biometric data such as facial recognition information.
Who is covered in the lawsuit
The lawsuit organizes eligible Illinois residents into three specific groups. The Local Device Class includes individuals whose Apple devices added their photos to a People album. The iCloud Subclass involves users who used iCloud with a People album. The iCloud Faceprint Subclass focuses on users with extensive photo libraries and specific iOS versions.
Each group has individual conditions. Members of the Faceprint Subclass must have at least 10 gigabytes of storage enabled with iCloud and at least 5,000 photos in their library. The eligibility period for the Local Device and iCloud Subclasses spans from 2016 to the present, while the Faceprint Subclass started in 2025.
The financial implications
The lawsuit could demand Apple pay up to $32.5 billion in damages. The BIPA statute permits $1,000 for each negligent violation and $5,000 for each intentional or reckless violation. Apple has opposed the case for several years by filing multiple complaints and motions to dismiss it.
Apple sought an immediate appeal of the court’s certification ruling, but the request was denied. The matter will now proceed back to the district court for more legal steps. Before any financial penalties can be imposed, the plaintiffs must demonstrate Apple violated Illinois law.
The lawsuit is part of a broader pattern of legal challenges targeting tech companies over biometric data. Similar issues arose in cases against Meta, which led to a $650 million settlement related to Facebook's facial-recognition system and a $68.5 million settlement over Instagram's data collection practices. These precedents show the potential scale of financial consequences under Illinois' BIPA.
According to court records, the plaintiffs aim to represent around 6.5 million Illinois residents across the three class definitions. This wide scope increases the likelihood of a substantial verdict if the plaintiffs succeed in proving their allegations. The certification decision by the court marks a significant advancement for the case.
The legal battle has involved years of procedural hurdles and amendments to the lawsuit's complaints. Following several failed attempts by Apple to get the case thrown out, the court granted class certification in June. The case is now set for additional hearings at the district court level.
Until the court rules on Apple's alleged violations, the company remains legally responsible for the potential damages. The plaintiffs must still overcome the burden of proof to ensure any financial liability is justified under the law.
Apple’s approach to face recognition in the Photos app is fundamentally different from Meta’s, as the recognition algorithm runs entirely on-device. According to Apple, the Photos app uses on-device machine learning to curate and organize photos without accessing biometric data. Apple does not collect biometric information without seeking consent, as per the Biometric Information Privacy Act.
The company argues that its privacy policy reflects this approach, and the recognition algorithm only identifies patterns to suggest that photos appear to be of the same person. It is the user who assigns names to the people in the photos. Apple’s 2021 machine learning research paper emphasizes the on-device processing and privacy-first approach of its technologies.
Critics argue that the lawsuit and similar legal challenges reflect a misunderstanding of Apple’s privacy protections, which contrast starkly with companies like Meta. The case underscores the growing challenges courts and legislators face in regulating emerging technologies without fully grasping their mechanisms.
The situation is reminiscent of debates around end-to-end encryption, where policymakers struggle to balance security and privacy without a deep understanding of the technology. In Apple's case, legal experts and the company itself emphasize the importance of ensuring that laws and court decisions accurately reflect technological advancements.