Lawsuit Claims Target Stores Illegally Collected Shoppers' Biometric Data

Have you ever wondered what those cameras in the aisles are really for? We tend to assume it’s just for security and to catch shoplifters, but according to a recent lawsuit involving Target stores, those cameras do a lot more than you think.

A federal judge has given the green light for a class-action lawsuit against Target that accuses the store chain of secretly collecting and storing customers' biometric data without their consent. This legal battle, rooted in the alleged violation of Illinois' Biometric Information Privacy Act (BIPA), raises critical questions about privacy and data use in retail environments. The case could have significant implications for how your personal data is handled every time you step into a store—whether that store is Target or one of the countless retailers that use security cameras.

A Brief on BIPA

The Illinois Biometric Information Privacy Act (BIPA) was enacted in 2008 to address the growing concerns surrounding the collection and handling of biometric data. This technology collects and analyzes unique identifiers like fingerprints, retina or iris scans, voiceprints, and scans of hand or face geometry. Recognizing the potential for serious privacy invasions, the Illinois Legislature sought to establish clear guidelines and protections for individuals' biometric information.

BIPA mandates that private entities must inform individuals in writing before collecting or storing their biometric data. This notice must specify the purpose and duration of the data collection, and entities must obtain a written release from the individuals. Furthermore, BIPA prohibits the sale, lease, or trade of biometric data and requires entities to develop a publicly available policy outlining the retention and destruction of such data.

The legislative intent behind BIPA is rooted in the understanding that biometrics are biologically unique to individuals and, once compromised, cannot be changed, unlike other identifiers such as Social Security numbers. This uniqueness heightens the risk of identity theft and privacy invasions, prompting the need for stringent regulatory measures to ensure individuals are informed and their biometric data is safeguarded.

Lawsuit Launched at Target

In the court filing, the plaintiffs allege that Target Corporation engaged in the collection, capture, and use of biometric data without obtaining the necessary informed consent as required by the BIPA. The data at issue specifically is that pulled from scans of facial geometry.

The complaint asserts that Target collected and stored biometric identifiers of customers visiting its stores in Illinois. It apparently did so through its security cameras and video surveillance systems equipped with facial recognition technology.

To make matters worse, this surveillance and data collection allegedly occurred without permission or notice. The complaint claims that Target neither provided written notice to the individuals, explained the purpose and duration of the data collection, or obtained a written release from them--all of which are mandated by BIPA.

The filing further details Target's security measures. Target has been using sophisticated surveillance technologies, systems which the plaintiffs claim were designed to combat retail theft and organized crime. They say that Target employs advanced video surveillance systems and facial recognition cameras in its stores (especially in self-checkout lanes) to monitor and identify individuals.

The plaintiffs argue that Target's failure to disclose these practices and to establish publicly available policies for the retention and destruction of biometric data constitutes a violation of BIPA, thereby infringing on the privacy rights of the affected individuals.

Plaintiffs Recount Their Experiences

In the court filing, each plaintiff provides a detailed account of their interactions with Target and the alleged collection of their biometric data.

Lindsay Schumm recounts her frequent visits to the Target store in Normal, Illinois, including a specific incident this past summer. During this visit, she noticed that shortly after she entered the store, she received a notification on her phone that a Target Asset Protection Operations Manager had viewed her LinkedIn profile. This incident led her to believe that Target used facial recognition technology to identify her.

Similarly, Denise Arnold, a frequent Target shopper, believes her biometric identifiers—specifically, scans of her facial geometry--were collected and stored without her consent during her visits. Blaire Brown and Sandre Wilson wrote similar accounts expressing the same concern from their experiences.

Each plaintiff emphasizes that at no point were they informed in writing about the collection or use of their biometric data, nor did they provide written consent, as required by the BIPA.

Target Concealed Its Practices

For some of these plaintiffs, the accounts they describe were long enough ago that normally, the statute of limitations would serve to keep them from bringing lawsuit. These plaintiffs argue that any applicable statute of limitations should be “tolled” (meaning, lifted for them) because they claim that Target used security cameras and facial recognition technology to collect biometric data without informing the individuals affected.

Because the plaintiffs and class members could not have discovered these practices through reasonable diligence, they argue that the statute of limitations should be tolled, allowing them to pursue their claims even if the standard time limit for filing has passed. This tolling is intended to prevent defendants from benefiting from concealing their wrongful conduct until after the statute of limitations has expired.

Target has until December 13 to respond to the complaint.

Related Resources:

• White Castle Employee Claims Burger Vendor Violated Biometric Privacy Law for a Decade (FindLaw's Federal Courts)
• AIs Have Eyes on Impulse Buys: How Tech is Targeting Retail Theft (FindLaw's Law and Daily Life)
• Why You Should Care About Biometric Data Privacy Laws (FindLaw's Don't Judge Me Podcast)