Apple Hit With Illinois Biometric Privacy Suit Over Eye Scans

Apple Inc. is facing a proposed class action in federal court in Illinois over claims that its Face ID system secretly captures detailed scans of users' irises and retinas without the written consent required under the state's biometric privacy law.

The complaint, filed Saturday, was brought by Samantha Mettler, an Illinois resident who says her eye data was gathered both when she set up Face ID and later through the feature's ongoing attention-tracking function.

According to the filing, Apple is upfront with customers that it captures facial geometry to power its facial recognition system. Still, the company never separately discloses that the same process also involves scanning the eyes at a much more granular level. Mettler's attorneys argue that obtaining permission to collect one category of biometric data does not automatically extend to a different type of data gathered through the same feature.

Central to the suit is the claim that Face ID cannot even be activated unless the device's camera detects the user's eyes, a requirement the complaint says exists specifically so the system can verify a person is actually looking at the phone. That verification step, the lawsuit contends, depends on capturing iris or retinal information, whether or not the person ever finishes enrolling in facial recognition.

The suit further alleges this scanning continues in the background through what Apple calls attention-aware features, which dim the screen when a user looks away or quiet notifications when the user's gaze is on the device. Those functions, the complaint argues, cannot work without the phone continuously tracking the position of a person's eyes, and Apple has never told users that this tracking amounts to biometric collection under the law.

The Illinois Biometric Information Privacy Act, commonly known as BIPA, requires companies to obtain explicit written authorization before collecting biometric identifiers such as scans of the face, eyes, or voice. Mettler's suit contends Apple has fallen short of that standard specifically with respect to eye scans, even though the company discloses its facial-mapping practices elsewhere.

The complaint also points to Apple's own public statements describing how Face ID assesses whether a user's eyes are open and directed at the screen, a safeguard Apple has said helps prevent someone from unlocking a device while its owner is asleep or otherwise unaware.

Beyond the initial capture of eye data, the lawsuit claims Apple converts those scans into mathematical representations that are then used to refine and train its own recognition algorithms, a use the complaint says was never communicated to consumers before the fact.

Apple has maintained that this information is kept in an on-device security system called the Secure Enclave, which the company says even it cannot access.

But the suit argues that inaccessibility cuts both ways: because the data is locked away, users have no ability to view, retrieve, or delete the biometric information generated about them, nor can they stop Apple from continuing to use it to improve its products.

Mettler is seeking to represent a class of Illinois residents whose iris or retinal data was collected, captured, or otherwise obtained by Apple through Face ID or its related attention-tracking features. She describes the alleged surveillance as a source of real distress, saying she was harmed both by the privacy intrusion itself and by Apple's failure to secure the consent state law demands.

The attorney representing the proposed class, Blake Yagman, framed the case as part of a broader shift in privacy litigation, arguing that companies increasingly build features that harvest sensitive personal data without consumers realizing it. He compared biometric identifiers to a person's DNA, saying that scans of the eyes and face are unique markers of identity and that collecting them without consent threatens fundamental privacy interests.

Yagman said the case is among the first nationwide to specifically target the collection of iris and retinal scans under Illinois' biometric privacy statute, and he said he intends to pursue it vigorously in the months ahead.