Coinbase faces lawsuit over alleged breaches of Illinois biometric privacy law

Coinbase Faces Class-Action Lawsuit over Biometric Data Collection in Illinois

A class-action lawsuit has been filed against Coinbase in Illinois, alleging violations of the state’s Biometric Information Privacy Act (BIPA). The plaintiffs, Scott Bernstein, Gina Greeder, and James Lonergan, contend that Coinbase’s identity verification process, which requires users to upload a photo ID and selfie for facial recognition analysis, constitutes unlawful biometric data collection.

The lawsuit, filed on May 13th in federal court, claims Coinbase failed to obtain informed written consent from users before collecting, storing, and sharing their biometric data – specifically faceprints – with third-party verification vendors such as Jumio, Onfido, Au10tix, and Solaris. The plaintiffs argue that Coinbase’s failure to provide a public retention schedule or guidelines for data destruction further violates BIPA.

The complaint highlights the lack of notification regarding the collection, storage, use, and retention of biometric data, a key requirement under BIPA. It emphasizes that the facial recognition process captures biometric identifiers without explicit user consent, a central violation alleged in the suit. Furthermore, the sharing of this data with third-party vendors is also cited as a breach of BIPA.

The lawsuit also mentions over 10,000 individuals who initiated arbitration demands with the American Arbitration Association over similar concerns. Coinbase’s alleged refusal to pay the associated arbitration fees resulted in the dismissal of these claims. The plaintiffs are seeking $5,000 per willful or reckless violation and $1,000 per negligent violation, along with injunctive relief and litigation costs. The lawsuit includes three counts of BIPA violations and one count of consumer fraud under the Illinois Consumer Fraud and Deceptive Business Practices Act.

This is not the first time Coinbase has faced litigation regarding BIPA violations. A similar lawsuit in May 2023 was paused pending arbitration and subsequently dismissed after a mutual agreement between the parties. The current class-action lawsuit adds to the mounting legal challenges Coinbase is facing, including at least six lawsuits stemming from a recent data breach involving bribed customer support agents.