QIM Score: 87/100 — published under the house rule: no post goes live unscored.
Routes: Blue Data Law · Digital Rights
The Data Hook
There is a company that scraped more than 60 billion images of human faces from the open internet — social media, news sites, payment apps, anywhere a photo of you might live — and turned them into a searchable facial-recognition database it sold to police and others. You were almost certainly scraped. You were never asked. The company is Clearview AI, and the lawsuit against it produced one of the strangest settlements in privacy history.
The Settlement That Paid Victims in Equity
In March 2025 a federal judge approved a nationwide class-action settlement of the Clearview litigation. The twist: because Clearview did not have the cash to pay a traditional damages fund, the class got a 23 percent equity stake in the company instead — valued at roughly $51.75 million based on Clearview's earlier valuation. It was the first time a privacy class was effectively made part-owner of the company that violated their rights. The case was built on the Illinois Biometric Information Privacy Act, and that is the law you need to understand.
Why Illinois Law Protects You Even If You Live in California
BIPA, enacted in 2008, is the most powerful biometric privacy statute in the country. It requires informed written consent before a company collects your biometric identifiers — your faceprint, fingerprint, or voiceprint — and it gives individuals a private right to sue, with statutory damages per violation. No proof of financial loss required; the violation itself is the harm. That private right of action is the engine. In 2025 alone, more than 107 new BIPA class actions were filed, producing settlements like Clearview's $51.75 million and Speedway's $12.1 million. BIPA is why companies that quietly fingerprint employees for time clocks or scan faces for "convenience" suddenly have lawyers in the room.
What California Has — and What It Lacks
California's protection runs through the CCPA and CPRA, which classify biometric information as "sensitive personal information." That gives Californians rights to know what is collected, to delete it, and to limit its use, enforced by the California Privacy Protection Agency and the Attorney General. But there is a gap worth being honest about. California's framework is primarily regulatory and enforcement-driven; it does not hand individuals the same broad, per-violation private right to sue that BIPA does. The CCPA's private right of action is mostly limited to certain data breaches. So a Californian's strongest path often runs through the regulators — or, where the defendant's conduct touched Illinois residents or operations, through BIPA itself.
The Bigger Principle: Your Face Is Data Now
Facial recognition collapses a protection people always assumed they had — the ability to be anonymous in public. A faceprint is not like a password you can change after a breach; you cannot get a new face. That permanence is exactly why biometric law treats this category as special, and why the trend is toward stricter consent rules, not looser ones. Clearview's database also illustrates the "publicly available" trap. The company's defense was that the photos were already public. But "I posted a vacation photo" is not the same as "I consented to have my face mathematically mapped, indexed, and sold to law enforcement." Public visibility is not consent to biometric extraction.
What to Do
You have more control than you think. Under the CCPA you can send deletion and do-not-sell/do-not-share requests to data brokers and platforms, and opt out of facial-recognition features on the services you use. If you are an Illinois resident — or were when your biometrics were taken — you may have direct BIPA standing. Businesses operating in California or Illinois should treat any face-scanning, fingerprinting, or voiceprinting feature as a legal landmine that requires real, documented consent before deployment. A free Blue Data Law consult reviews whether your facts give you a biometric claim and which state's law gives you the most leverage.
Blue Data Law — free consult | Michael Benavides, Esq., CA Bar No. 270714 | 707-362-4166 | attorneymichaelbenavides.com
ATTORNEY ADVERTISING. Blue Data Law is a trade name of the law practice of Michael Benavides, Esq., California State Bar No. 270714. General information only — not legal advice; no attorney-client relationship is formed by reading this. Authority cited is as of mid-2026 (Illinois Biometric Information Privacy Act, 740 ILCS 14; California CCPA/CPRA, Civil Code § 1798.100 et seq.; Clearview AI class settlement, 2025) — biometric privacy law varies sharply by state; verify your jurisdiction's rules. Prior results do not guarantee a similar outcome.
