A landmark data privacy class action lawsuit against a major national retailer has settled for $380 million, one of the largest privacy-related settlements in U.S. history. The case alleged the company collected and sold customer biometric data without consent through its self-checkout facial recognition system.
The settlement covers an estimated 25 million customers who used self-checkout kiosks at the retailer's stores between 2021 and 2025. Each class member is expected to receive between $50 and $150 depending on the frequency of their visits.
The case was brought under Illinois' Biometric Information Privacy Act, which provides a private right of action for violations and has become the most powerful consumer privacy law in the country. Similar cases have been filed in other states with biometric privacy laws.
The retailer denied wrongdoing but agreed to the settlement to avoid the uncertainty of trial. As part of the agreement, the company will disable facial recognition features at all self-checkout stations and delete all previously collected biometric data.
Privacy advocates say the case sends a clear message that businesses cannot collect biometric data without explicit consent. "This settlement shows that BIPA has real teeth," says ACLU privacy attorney David Kim.
