The Seventh Circuit Court of Appeals has upheld a lower court’s decision to certify a class action lawsuit against Amazon, stemming from allegations that the company’s Virtual Try-On (VTO) feature violated the Illinois Biometric Information Privacy Act (BIPA). The appellate court found that the common legal and factual questions surrounding Amazon’s data handling practices predominate over the individualized issues, thus satisfying the demanding requirements for class certification under Federal Rule of Civil Procedure 23(b)(3).
The case centers on claims brought by Tanya Svoboda and Antonella Ortiz Colosi, who alleged that when they used Amazon’s VTO feature—which superimposes makeup or eyewear onto a user’s face via live video or photo—Amazon collected, captured, and used their facial geometry without adhering to BIPA’s strict consent and policy requirements.
BIPA and the Virtual Try-On Technology
BIPA is a strict privacy law designed to protect Illinois residents’ biometric data, such as fingerprints and facial geometry, recognizing that this information is unique and unalterable if compromised. The law mandates that private entities developing, publishing, and complying with written data retention and destruction policies (Section 15(a)), and critically, requires them to obtain written notice and informed written release before collecting or storing biometric identifiers (Section 15(b)).
The VTO feature, used by Amazon through both in-house software and a program by ModiFace, requires users to grant camera access. If the user chooses to preview products on their own image, the software captures facial geometry to render the product overlay. The plaintiffs alleged Amazon violated both Sections 15(a) and 15(b) by failing to secure proper consent or establish retention policies for the facial data collected during these virtual try-ons.
The parties agreed that BIPA violations must have occurred within Illinois for the claims to proceed, meaning that proving a class member was physically in Illinois during the VTO use is a necessary element.
Predominance: Commonality vs. Individual Location Proof
Amazon appealed the district court’s class certification, focusing primarily on the predominance prong of Rule 23(b)(3). This rule requires that common questions of law or fact overwhelm any individualized questions.
The Seventh Circuit acknowledged that the location requirement—proving a user was in Illinois—is an individualized question that requires proof varying from member to member. Amazon argued this individualized proof defeated predominance.
However, the appellate court, deferring to the district court’s discretion, found this individualized element manageable and insufficient to defeat certification. The court highlighted that common questions regarding Amazon’s liability were central and would resolve the bulk of the dispute:
1. Whether the facial data captured by the VTO software qualifies as “biometric identifiers or information” under BIPA.
2. Whether the VTO operation constitutes “collection, capture, obtainment, or possession” by Amazon.
3. Whether Amazon failed to comply with the notice, release, or policy requirements of Sections 15(a) and 15(b).
The court relied on established precedent stating that Rule 23(b)(3) does not demand that *every* element of a claim be resolved on a classwide basis. If common questions central to liability predominate, individualized proof—such as establishing location or calculating damages—can be handled in a subsequent, “final phase” of litigation.
To address the location issue, the plaintiffs proposed using a combination of billing addresses, IP addresses, geolocation data, and personal affidavits. While the court noted this data might not be perfect—IP addresses can be imprecise, and billing addresses can be outdated—the evidence suggested that Amazon maintained sufficient records (including full IP addresses) to make class-wide location proof manageable for a large segment of the class. For disputes where data conflicted or was missing, individual affidavits would suffice, but these individual inquiries were deemed manageable and secondary to the core liability questions.
Affirmative Defenses and Damages
Amazon also suggested that common law affirmative defenses, such as consent, estoppel, and waiver, required individualized assessment and therefore undermined predominance. The court found that the initial act of clicking the “try on” button was a uniform action, making the consent question common. Furthermore, the court reiterated that even if other defenses or damages calculations required individual attention, these issues were ancillary to the central question of Amazon’s systemic conduct and liability.
Superiority: Efficiency of Class Action
Regarding superiority, the court found that a class action was the most efficient method. BIPA provides for significant statutory damages ($1,000 for negligent violations, $5,000 for intentional ones) per violation, meaning aggregate damages could be substantial, potentially reaching tens of millions of dollars.
While high individual damages sometimes argue *against* class certification (as individuals might be incentivized to sue alone), the court noted that the complexity and high cost of litigation—the plaintiffs themselves spent over $100,000 on expert discovery concerning the VTO software—suggested that most affected users would be unwilling or unable to pursue individual lawsuits. Therefore, the class action served as a superior vehicle to vindicate the rights of thousands of users whose individual claims might otherwise go unaddressed.
The Seventh Circuit concluded that the district court did not abuse its discretion in finding that the common issues predominated and that the class action mechanism was superior for efficiently resolving these virtually identical claims against Amazon.