Since its enactment a decade ago, the Illinois Biometric Information Privacy Act (BIPA) has seen a recent spike in attention from employees and consumers alike. This is due, in large part, to the technological advancements that businesses use to service consumers and keep track of employee time.

What Is The BIPA?

Intending to protect consumers, Illinois was the first state to enact a statute to regulate use of biometric information. The BIPA regulates the collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information. The statute defines biometric identifiers to include a retina or iris scan, fingerprint, or scan of hand or face geometry. Furthermore, the statute defines biometric information as any information, regardless of how it is captured, converted, stored, or shared, based on an individual’s biometric identifier used to identify an individual. Any person aggrieved by a violation of the act may sue to recover actual or statutory damages or other appropriate relief. A prevailing party may also recover attorneys’ fees and costs.

Since September of 2017, there have been more than thirty-five class action BIPA lawsuits with no particular industry being targeted. More commonly sued industries include healthcare facilities, manufacturing and hospitality.

The drastic increase in litigation is largely contributable to employers’ attempt to prevent “buddy punching,” a term that references situations where employees punch in for a co-worker where biometric data is not required to clock in or out. For example, in Howe v. Speedway LLC, the class alleges that defendants violated the BIPA by implementing a finger-operated clock system without informing employees about the company’s policy of use, storage and ultimate destruction of the fingerprint data. Businesses engaging in technological innovation have also come under attack from consumers. In Morris v. Wow Bao LLC, the class alleges that Wow Bao unlawfully used customers’ facial biometrics to verify purchases at self-order kiosks.

Recent Precedent

In Rivera v. Google Inc.,the District Court for the Northern District of Illinois explained that a “biometric identifier” is a “set of biometric measurements” while “biometric information” is the “conversion of those measurements into a different, useable form.” The court reasoned that “[t]he affirmative definition of “biometric information” does important work for the Privacy Act; without it, private entities could evade (or at least arguably could evade) the Act’s restrictions by converting a person’s biometric identifier into some other piece of information, like mathematical representation or, even simpler, a unique number assigned to a person’s biometric identifier.” Thus, a company could be liable for the storage of biometric information, in any form, including an unreadable algorithm.

More recently, in Rosenbach v. Six Flagsthe Illinois Appellate Court, Second District, confirmed that the BIPA is not a strict liability statute that permits recovery for mere violation. Instead, consumers must prove actual harm to sue for a BIPA violation. The court reasoned that the BIPA provides a right of action to persons “aggrieved” by a statutory violation, and an aggrieved person is one who has suffered an actual injury, adverse action, or harm. Vague allegations of harm to privacy are insufficient. The court opined that, if the Illinois legislature intended to allow for a private cause of action for every technical violation of the BIPA, the legislature could have omitted the word “aggrieved” and stated that every violation was actionable. The court’s holding that actual harm is required is consistent with the holdings of federal district courts on this issue.

Damages and Uncertainty

Plaintiffs and their counsel are attracted to the BIPA because it provides for significant statutory damages as well as attorneys’ fees and costs. The BIPA allows plaintiffs to seek $1,000 for each negligent violation, and $5,000 for each intentional or reckless violation, plus attorneys’ fees and costs.

To date, all claims have been filed as negligence claims, and, thus, it is unclear what a plaintiff must show to establish an intentional violation. Similarly, the law is unsettled on whether the statutory damages are awarded per claim or per violation. A per violation rule would exponentially increase a defendant’s potential liability. For example, some plaintiffs are currently seeking $1,000 or $5,000 for each swipe of a fingerprint to clock in or out.

How To Protect Your Business

To avoid a costly mistake when retaining biometric data, businesses should:

  1. provide employees or consumers with a detailed written policy that includes why and how the data will be collected, stored, retained, used, and destroyed;
  2. require a signed consent before collecting the data;
  3. implement a security protocol to protect the data; and
  4. place an appropriate provision in vendor contracts (e.g., for data storage) to require vendors to adhere to the law and report any data breaches.

Consent can be obtained in different ways. For example, employers may condition employment upon an individual’s consent to a data retention policy, and companies can require consumers to accept a click-through consent before accessing a company’s website or application.

For questions or additional information, please contact Esther Slater McDonald at or Paul Yovanic Jr. at

A seemingly innocuous recruitment text message from the United States Navy has led to the official unraveling of a tactic long-used and widely-favored by defendants to escape a class action lawsuit before class certification. In a 6-3 decision, the United States Supreme Court rejected the argument that an unaccepted settlement offer or offer of judgment moots a plaintiff’s claim and thus a class action as well.

Background and Procedural History

In Campbell-Ewald Company v. Gomez, Petitioner, Campbell-Ewald Company, was retained by the United States Navy to conduct a multimedia recruitment campaign aimed at young adults. One branch of this campaign included sending text messages to potential recruits encouraging them to consider the Navy. The Navy approved the text messages as long as they were only sent to those who “opted-in” to receive marketing materials.

Campbell then contracted with another company, Mindmatics LLC, to identify cell-phone users between 18 and 24 years old who had consented to receiving text messages from the Navy. In May of 2006, Mindmatics transmitted the Navy’s recruitment text to over 100,000 recipients.

One of those recipients was the Respondent, Jose Gomez. Gomez was, at the time, a 40-year-old man who had not consented to receiving text messages from the Navy. Gomez alleged that Campbell violated the Telephone Consumer Protection Act (TCPA), which “prohibits any person, absent the prior express consent of a telephone-call recipient, from “mak[ing] any call . . . using any automatic telephone dialing system . . . to any telephone number assigned to a paging service [or] cellular telephone service.” 47 U.S.C. §227(b)(1)(A)(iii).

Gomez filed a class action complaint in the District Court for the Central District of California seeking treble and statutory damages, costs, and attorney’s fees, as well as an injunction against Campbell’s involvement in unsolicited messaging.  Prior to the deadline for filing a motion for class certification, Campbell made a Rule 68 offer of judgment that included paying Gomez his costs excluding attorneys’ fees, $1,503 per message received and an injunction which barred Campbell from sending text messages in violation of the TCPA, but denied any liability. Gomez did not accept the offer. Before Gomez filed his motion for class certification, Campbell filed a motion to dismiss, arguing the district court lacked subject matter jurisdiction over the matter since no case or controversy remained now that Gomez had been provided with complete relief for his injury, and thus the putative class claims also became moot. The district court denied the motion.

Campbell subsequently filed a motion for summary judgment, arguing the U.S. Navy enjoys sovereign immunity from the TCPA and that as a contractor for the Navy, Campbell acquired that immunity. The district court agreed and dismissed the case. The Ninth Circuit Court of Appeals reversed the lower court, holding that Campbell was not entitled to sovereign immunity and that an unaccepted Rule 68 offer of judgment does not moot an individual claim or a class action. The Supreme Court granted certiorari to settle a disagreement amongst the courts of appeals as to whether a Rule 68 offer of judgment does or does not moot a plaintiff’s claim.

The Supreme Court Opinion

Adopting Justice Kagan’s reasoning from her dissenting opinion in Genesis HealthCare Corp. v. Symczyk (in which the Court reserved the issue of whether an offer of judgment moots a claim) the Court found that, “[w]hen a plaintiff rejects such an offer—however good the terms—her interest in the lawsuit remains just what it was before. And so too does the court’s ability to grant her relief. An unaccepted settlement offer—like any unaccepted contract offer—is a legal nullity, with no operative effect.”

The Court further reasoned that once the offer expired, the parties remained adversaries, as both retained the same stake in the litigation they had at the outset. The Court noted that Rule 68 provides that an unaccepted offer is only admissible when determining costs, and for no other reason.

Since Gomez’s individual claim still stood, the Court ruled “a would-be class representative with a live claim of her own must be accorded a fair opportunity to show that certification is warranted.”

Of note, however, is the caveat offered by the Court at the end of its analysis, in which it reserves ruling on a hypothetical situation in which “a defendant deposits the full amount of the plaintiff’s individual claim in an account payable to the plaintiff, and the court then enters judgment for the plaintiff in that amount.”

The Court also rejected Campbell’s sovereign immunity argument, determining that it did not follow the Navy’s implicit instructions to confirm the messages complied with the TCPA.

Conclusion and Implications

The Supreme Court’s ruling settles once and for all the effect of an unaccepted Rule 68 offer of judgment or settlement offer on a plaintiff’s claim. However, the Court appears to have left the door cracked for defendants via its unanswered hypothetical on the possibility of depositing the full amount of plaintiff’s claim into a bank account payable to the plaintiff. While it is unclear how the Court would rule in such a case, it will not likely be long before a defendant tests the waters.

imagesCAB1RIWURecently GNC Holdings, Inc. (“GNC”) was hit with a proposed nationwide class action alleging that GNC deceptively labeled its own brand of ginko biloba supplements. See Wright v. GNC Holdings, Inc., Case No. 2:15-cv-00566-WB (E.D. Penn. February 5, 2015). The complaint was filed just three days after the New York Attorney General’s office sent GNC a cease and desist letter demanding GNC immediately stop the sale of five “Herbal Plus” dietary supplements, after tests conducted by the AG’s office determined that no plant DNA was identified in the products. See id., Exhibit A. Several other retailers have been hit with similar lawsuits following similar investigation by the New York Attorney General’s Office. These lawsuits were filed in the U.S. District Court for the Northern District of California, and allege claims for unfair competition and false advertising under California’s unfair competition laws, Cal. Bus. & Prof. Codes §§ 17200 et seq., and 17500 et seq., and the California Consumer Legal Remedies Act, Cal. Civ. Code § 1750 et seq. (among other state law claims).


Plaintiff Stacey Wright alleges she purchased GNC’s ginko biloba supplement on various dates since 2009. She alleges each bottle of the supplement stated that it contained “Ginko biloba Leaf Extract” on the “Supplemental Facts” section of the label. The complaint goes on to allege that the product in fact contains “no Gingko Biloba whatever” (based on the New York AG’s tests), which constitutes “false, written affirmative statements on the product label[.]”

The lawsuit asserts three causes of action for (1) declaratory relief, (2) violation of Pennsylvania’s Unfair Trade Practices and Consumer Protection Law, 73 P.S. § 201-2(4)(xxi), and (3) breach of express and/or implied warranty. The plaintiff seeks certification of a nationwide class of all United States citizens who purchased GNC’s ginko biloba store-brand supplement between February 6, 2009 and the present, as well as a Pennsylvania sub-class of individuals who purchased the product at one of GNC’s Pennsylvania locations. In addition to class certification, the complaint prays for injunctive and declaratory relief, damages and attorneys’ fees.


As typical in the class action world, these lawsuits tag along to the actions of a governmental agency related to the advertising and/or marketing efforts of companies. As such, the cases will inevitably rise and fall on the soundness of the investigation and the veracity of the underlying claims. Businesses should take note of these cases, for several reasons. First, this may be only the initial wave of ongoing investigation within the New York Attorney General’s office. Second, similar investigations may be inspired across the country. Finally, these investigations may not only expose businesses to potential liability through consumer actions, but may also result in FTC enforcement actions.

Notably, the FTC frequently brings enforcement actions against the makers of dietary supplements for asserting false, misleading or deceptive claims about their products’ efficacy. The FTC’s publication, Dietary Supplements: An Advertising Guide For Industry, provides insight into how the FTC views such claims. It is important to remember that the FTC requires “competent and reliable scientific evidence” to support weight loss and other health claims. This can be a high bar: some recent FTC consent orders have required defendants substantiate such claims with at least two “well-controlled” or “double-blind” human clinical studies. Generally, products related to consumer health and safety require a higher level of substantiation than other types of products. Bottom line: businesses should take care to understand the relevant laws and regulatory obligations, and undertake necessary preliminary efforts to ensure that any labeling complies with all requirements.

Seyfarth Shaw LLP maintains an internal group, Food, Beverage & Supplement Safety and Labeling, that assists clients in monitoring changes and new developments in this area of the law, and can assist with any issues that may arise, either through governmental agencies or litigation.  For more information, you can contact the author directly, or either Jay Connolly ( or Gina Ferrari (

The Third Circuit recently ruled in Grandalski v. Quest Diagnostics, Inc., that the common law claims in a nationwide class action were not appropriate for class treatment because the court would be required to conduct an individual analysis and application of each state’s law and therefore common questions of law did not predominate.   767 F.3d 175 (3d Cir. 2014).


Plaintiffs in Grandalski, a group of patients, filed a putative class action alleging that Quest Diagnostics, Inc. routinely overbilled patients.  Id. at 177.  Plaintiffs proposed two nationwide litigation classes and asserted multiple causes of action against both classes including a state law claim for consumer fraud.  Id. at 178.  Plaintiffs moved for class certification on all its claims for both its nationwide classes.  Id. 

The Third Circuit’s Decision

When faced with a nationwide class action alleging state law claims, courts must engage in a choice of law analysis to determine what state law should be used to substantively decide the legal issues.  Consistent with choice of law tenets, courts apply the choice of law rules of the forum state to determine the controlling law.  Applying New Jerseys conflicts of laws, the Grandalski court found that these factors weighed in favor of applying the laws of the putative class members’ home state law because the plaintiffs received and acted in reliance on the representation in their home state.  Id. at 182.  Accordingly, the consumer fraud laws of several states would have to be analyzed and applied to resolve the plaintiffs’ consumer fraud claim on a class wide basis.

After determining that the laws of several states would need to be applied, the Grandalski Court considered whether plaintiffs’ claim were appropriate for class treatment pursuant to Federal Rule of Civil Procedure 23.  The Grandalski court determined that “class litigation involving dozens of state consumer fraud laws was not viable and that common facts and common course of conduct did not predominate.”  Id. at 184.  Accordingly, the court affirmed the district court’s denial of certification as to the state law consumer fraud claims.  Id.

The plaintiffs in Grandalski proposed grouping together the laws of various states as an alternative to denying certification, however, the court found that the plaintiffs failed to demonstrate how the grouping it proposed would apply to the facts and issues presented in the case and failed to meet their burden of demonstrating that grouping was warranted and workable.  Id. at 183.  The court noted that this was a heavy burden and that in cases where a grouping proposal was accepted the plaintiff set for a comprehensive analysis of the various states’ laws potentially applicable and how the proposed grouping would work and no such analysis was provided by plaintiffs.  Id. (citations omitted).  Because plaintiffs “provided no indication as to how the jury could be charged in some coherent manner” relative to the proposed grouping and instead asserted only that the differences between the state laws within each group were “insignificant or non-existent,” the court rejected the proposed grouping.  Id. at 183-84.


Grandalski adds to the growing trend among federal courts which have ruled that the predominance and superiority requirements of Rule 23 cannot be met where the substantive law of several different states would need to be applied.  It also reaffirms that plaintiffs bear a heavy burden to articulate alternative frameworks, such as grouping, in order to stave off denial of class certification.  In this way, Grandalski and several other federal courts have raised the bar for plaintiffs seeking class certification as they have become increasingly more focused on the manageability of a class action where multiple state laws are at issue.

The United States District Court for the Eastern District of Missouri recently granted class certification of an opt-out only junk fax class in St. Louis Heart Center, Inc. v. Vein Centers for Excellence, Inc., No. 12-cv-174 (E.D. Mo. Dec. 12, 2013).   In so doing, the Court soundly rejected several common defenses asserted in TCPA class actions, making such cases even more onerous to defend.


In 2008 and 2009, Vein Centers for Excellence, Inc. (“Vein Centers”) sent over 35,000 fax advertisements to doctors and medical centers, whose fax numbers it had obtained from various third-parties.  Each of the faxes had an opt-out notice; however, the notice did not contain all of the detailed language set forth in the relevant Code of Federal Regulations.

On September 15, 2009, Plaintiff St. Louis Heart Center, Inc. (“Heart Center”), a serial TCPA Plaintiff brought a putative class action against Vein Centers on behalf of all persons or entities who received a fax from Vein Centers with a non-compliant opt-out notice, regardless of whether the fax was “unsolicited” within the meaning of the TCPA.  Slip Op. at 8.


Vein Centers made several arguments in opposition to Heart Center’s motion for class certification, raising a number of commonly asserted defenses including: (1) Congress did not envision the TCPA to be used as a class action vehicle; (2) lack of ascertainability; (3) lack of typicality; (4) class scope should be limited to the single date of faxing; (5) variance in state laws; and (6) unconstitutionality of a class damages award. The Court, in turn, rejected each argument.

No Clear Expression of Congressional Intent to Exempt Class Actions

First, the Court rejected Defendant’s argument that the TCPA does not permit class actions, ruling that there was no “clear expression of congressional intent to exempt class actions” from the statutory scheme.  Slip Op. at 6-7.

Neither Different Transmissions Nor Proof of Receipt Are Necessary for Class-Wide Proof

Second, Defendant argued that the class was not ascertainable because (a) there was insufficient information from which Plaintiff could match the fax numbers at issue to names of persons or entities, as the fax list used had only partial identifying information and was over six years old; (b) the fax definition included persons who may have been sent, but never actually received the faxes at issue; and (c) some of the class members may have received faxes in electronic, not paper, form.  Id. at 9-13.  The Court rejected each of these arguments.  It found that Plaintiff had identified a technology officer who testified via affidavit that he could match the fax numbers to names of persons or entities, making identification a non-issue.  Id. at 9-10.  Further, the Court found that whether a class member had actually received a fax was irrelevant because the TCPA measures violations by faxes sent, not received.  Id. at 11-13.  Lastly, the Court ruled that faxes received in electronic form still constituted a violation of the TCPA because they burden the class members’ computer networks, even if they do not waste paper and ink.  Id. at 14-15.

Failure of Absolute Compliance with Opt-Out Gives Rise to Private Right of Action

Third, Defendant argued that Plaintiff’s claim was not typical of the class because it received a fax with an opt-out notice, even if that notice did not comply with all of the language set forth in the federal regulations.  Id. at 17-19.  The Court rejected this argument, noting that a private right of action exists when either the statutory language or the implementing regulations, which include the detailed opt-out language requirements, are violated.  Id. at 18.

Receipt of One Fax Is Sufficient to Represent Larger Class Where Defendant Engaged in Same Course of Conduct

Fourth, Defendant argued that Plaintiff was not an adequate class representative because it had only received one fax – on September 15, 2009 – and therefore had no legal basis to represent individuals who had received faxes on other dates.  Id. at 21-22.  Because Heart Centers had produced evidence showing that Vein Centers engaged in the same course of conduct, e.g., using the same fax list, with regard to each of the dates on which faxes were sent within the class period, the Court ruled that Plaintiff could adequately represent the entire class.  Id. at 22.

Mims Controls: Federal Procedural Law Trumps State Laws Prohibiting Class Actions

Fifth, Defendant argued that the predominance requirement could not be met because the class was nationwide in scope, and several states have laws which do not permit class actions.  Id. at 23-24.  Citing the Supreme Court’s recent decisions in Mims v. Arrow Financial Services, LLC, 132 S. Ct. 740 (2012) and Shady Grove Orthopedic Associates, P.A. v. Allstate Ins. Co., 559 U.S. 393 (2010), the Court ruled that the class mechanism provided in Federal Rule of Civil Procedure 23 was available even where state procedural rules barred class-wide relief.  Id. at 25.

Where Class Certification Is Otherwise Appropriate, Large Damages Do Not Warrant Denial on Constitutionality Grounds

Lastly, Plaintiff argued that resolution on a class basis was not superior to individual suits because if a class were to be certified, it faced unconstitutionally excessive damages.  Id. at 26-27.  The Court found that damages under the TCPA are not punitive and, therefore, where class certification is otherwise appropriate, the potential of large damages should not prevent it.  Id. at 27.  Accordingly, the Court certified the class.


Vein Centers is exemplary not in the novelty of the arguments made by Defendant against class certification but in the Court’s willingness to summarily dispose of each of them.  It is yet another example of the ease with which opt-out only classes – classes which do not address issues of consent, which are often individualized – are certified.  It also serves as a reminder to businesses engaged in fax advertising of the risks posed by purchasing contact information from third-parties.