Virtual Hair Care Try-On Feature Violates Ill. BIPA, Says Complaint
A class action filed in U.S. District Court for Central Illinois in Peoria Tuesday seeks a preliminary and permanent injunction against Henkel from collecting users’ facial geometry in its virtual try-on feature for hair care products, said the privacy complaint…
Sign up for a free preview to unlock the rest of this article
Export Compliance Daily combines U.S. export control news, foreign border import regulation and policy developments into a single daily information service that reliably informs its trade professional readers about important current issues affecting their operations.
(docket 1:23-cv-1015). Plaintiff Sarah Watkins of Peoria alleged Henkel’s Schwarzkopf brand collects users’ facial geometry data with its virtual try-on feature, without their prior consent, a violation of Illinois’ Biometric Information Privacy Act (BIPA), which makes them at “heightened risk for identity theft.” Visitors to the Schwarzkopf website who use the feature enable their computer webcam or phone camera to take a photo to be used by Schwarzkopf, which collects, “unbeknownst to the website user,” detailed and sensitive biometric identifiers and information, including “complete facial scans,” alleged the complaint. “It does this without first obtaining their consent, or informing them that this data is being collected.” In violation of BIPA, Schwarzkopf “does not provide users with a schedule setting out the length of time during which their biometric information or biometric identifiers will be collected, stored, used or will be destroyed,” said the complaint. Though the defendant provides a link to its North American privacy policy, the policy doesn’t inform users how their facial geometry is collected, used or retained in order for the try-on feature to operate, said the plaintiff, saying biometric identifiers are protected by BIPA. Schwarzkopf lacks a publicly available written policy establishing a retention schedule and guidelines for permanently destroying biometric identifiers obtained from consumers, as required by BIPA, the complaint said. In addition to an injunction preventing further collection of biometric identifiers without written release, plus a written policy governing retention and deletion of biometric data, the class seeks $1,000 per negligent violation, $5,000 per willful violation, or actual damages to be determined by the court or jury at trial.