A federal court has certified a class-action lawsuit against Apple over the Photos app’s “People” feature, clearing the way for a case that could expose the company to more than $30 billion in damages under Illinois’ Biometric Information Privacy Act. The certification decision was delivered after the lawsuit spent six years working through the courts, surviving four amended complaints, years of discovery, and multiple attempts by Apple to have the claims dismissed.
The lawsuit was originally filed in March 2020 by roughly 10 Apple users. Its path to class status included a level of procedural attrition typical of complex consumer privacy cases, with Apple contesting certification at every stage before the court ruled in the plaintiffs’ favour.
Illinois’ Biometric Information Privacy Act gives residents the right to control their biometric information by requiring companies to obtain informed consent before collecting it, and giving individuals the power to withhold that consent. The plaintiffs argue that Apple’s People feature, which uses facial recognition to organize photos by the individuals in them, collected biometric data from Illinois residents without meeting that standard. Apple disputes that it creates or stores faceprints, an argument that is likely to form a central part of its defense on the merits.
The certified class spans three proposed groups encompassing roughly 6.5 million people, including every Illinois citizen whose Apple device placed a photograph of that citizen into a People album at any point between September 13, 2016, and the present. That window of nearly a decade, combined with BIPA’s statutory damages structure of $1,000 per negligent violation and $5,000 per intentional or reckless violation, is what produces the $30 billion exposure figure. A comparable class-action over Apple’s iCloud storage pricing illustrates how quickly statutory damages scale when millions of users are involved.
This is the same statute that ended Facebook’s facial-recognition feature with a $650 million settlement and produced a separate $68.5 million settlement over Instagram’s alleged collection and storage of biometric data without user consent. Those two outcomes, totalling $718.5 million from Meta alone, established that courts and companies take BIPA claims seriously, and that settlements at significant scale are the more common resolution than drawn-out trials. Whether Apple follows Meta’s path here is an open question. The company’s on-device processing architecture, which it has long positioned as a privacy differentiator, could form a meaningful part of its defense.
Class certification is a procedural milestone, not a verdict. The case now returns to district court for the substantive phase, where plaintiffs still need to prove that Apple actually violated BIPA before any damages can be awarded. Apple retains the ability to challenge those claims on the facts, and BIPA litigation tends to be detail-intensive around exactly what data was collected, how it was processed, and what disclosures were made to users. Prior Apple cases, including the M1 MacBook screen class action, show that even certified classes face a long road before any payout materialises.
A realistic timeline puts trial or settlement somewhere in the 12 to 24 month range, though BIPA cases of this scale have a way of stretching further. Given that $30 billion in exposure almost certainly exceeds what Apple would pay in a negotiated resolution, the stronger bet is that this eventually settles, as Meta’s cases did, for a fraction of the statutory maximum. The harder question is what fraction Apple is willing to accept.
