June 11, 2021

A Wave of Class Actions Under the Illinois Biometric Information Privacy Act is Causing Insurers and Policyholders to Consider Novel Coverage Questions Under General Liability Policies

Subscribe to Our Newsletter

Newsletter


Ross Weiner

|

June 11, 2021

Over the past few months, you have probably heard about big dollar settlements in cases brought under the Illinois Biometric Information Privacy Act (“BIPA”).  From the social media world, Facebook and TikTok both had significant settlements, agreeing to pay $650 million and $92 million, respectively.  A variety of other companies are now or soon will be facing similar BIPA class actions. 

BIPA is an Illinois statute regulating the collection and use of biometric data, including fingerprints, retina and iris scans, voiceprints, and scans of hand and face geometry.  (740 Ill. Comp. Stat. 14/1  et seq . (2008)). It prohibits private entities from disclosing a person’s biometric information without that person’s consent.  While a few other states have similar laws, only BIPA provides a private right of action. Accordingly, the plaintiffs’ bar has sought to capitalize.

Under BIPA, plaintiffs can recover $1,000 for each negligent BIPA violation and $5,000 for each intentional or reckless violation, plus attorneys’ fees.  The Illinois Supreme Court has held that when a private entity violates BIPA, any person whose biometric information was wrongfully shared can recover, even in the absence of actual injury.   Thus, BIPA class actions expose companies to tremendous potential liability. As the recent Facebook and TikTok settlements confirm, potential damages can add up quickly.   

The new cottage industry of BIPA class actions has led to a predictable result: defendant companies litigating with their insurers over whether there is coverage for the underlying BIPA case.  One case, in particular, stands out.  

West Bend Mut. Ins. Co. v. Krishna Schaumburg Tan, Inc .

In West Bend Mut. Ins. Co. v. Krishna Schaumburg Tan, Inc . (“ West Bend ”), the court was tasked with deciding whether the insurer was obligated to provide a defense for a tanning salon in a BIPA class action brought by a salon customer.  The customer alleged that the tanning salon violated BIPA by obtaining customer fingerprints and sharing them with a third-party vendor without first obtaining the required written release.  The tanning salon, which was covered by two business owners’ liability policies, sought coverage from its insurer.  In response, the insurer filed a declaratory judgment action seeking a declaration that the policy provided no such coverage.  Both parties both moved for summary judgment.  

The policies provided coverage for a “personal injury” that arises out of an “oral or written publication of material that violates a person’s right of privacy,” but also contained an exclusion for “distribution in violation of statutes.”  The parties disputed whether the salon owner’s sharing of customer biometric information with its vendor was a “publication” that violated the customer’s right to privacy and whether the policy’s exclusion applied to BIPA liabilities.

The trial court ruled for the tanning salon, finding the insurer was obligated to provide a defense in the class action. The Illinois Supreme Court affirmed. 

“Publication” and “Right of Privacy”

The insurance policies at issued stated, in pertinent part, as follows:

  1. Business Liability
    1. We will pay those sums that the insured becomes legally obligated to pay as damages because of ‘bodily injury’, ‘property damage’, ‘personal injury’ or ‘advertising injury’ to which this insurance applies. We will have the right and duty to defend the insured against any ‘suit’ seeking those damages. However, we will have no duty to defend the insured against any ‘suit’ seeking damages for ‘bodily injury’, ‘property damage’, ‘personal injury’, or ‘advertising injury’ to which this insurance does not apply.

* * *

  1. This insurance applies:

  • To ‘bodily injury’ and ‘property damage’ only if:
    • (a) The ‘bodily injury’ or ‘property damage’ is caused by an ‘occurrence’ that takes place in the ‘coverage territory’; and
    • (b) The ‘bodily injury’ or ‘property damage’ occurs during the policy period.
  • (2) To:
    • (a) ‘Personal injury’ caused by an offense arising out of your business, excluding advertising, publishing, broadcasting or telecasting done by or for you;
    • (b) ‘Advertising injury’ caused by an offense committed in the course of advertising your goods, products or services[.]”

The policies contain the following pertinent definitions:

“F. Liability And Medical Expenses Definitions

  1. ‘Advertising injury’ means injury arising out of one or more of the following offenses:

* * *

b. Oral or written publication of material that violates a person’s right of privacy;

* * *

  1. ‘Bodily injury’ means bodily injury, sickness or disease sustained by a person, including death resulting from any of these at any time.

* * *

  1. ‘Personal injury’ means injury, other than ‘bodily injury’, arising out of one or more of the following offenses:

* * *

e. Oral or written publication of material that violates a person’s right of privacy.”

The insurer argued that the customer’s BIPA complaint did not trigger the policies’ coverage for “personal injury” or “advertising injury” because the complaint did not allege a “publication” of material that violates a person’s “right of privacy.” The insurer first contended that “publication,” as used in business liability policies, means “communication to the public at large,” and because the tanning salon disclosed the biometric information at issue to only a single entity, there was no “publication.”  The Illinois Supreme Court rejected the insurer’s position, relying on publication’s dictionary definition: “the term means both communication to a single party and communication to the public at large.” Accordingly, the tanning salon’s decision to share the biometric information with its vendor was a “publication.”  

The parties also disputed what “right of privacy” means under the policy.  Looking again to the dictionary definition, the court found that the right to privacy includes two primary privacy interests: seclusion and secrecy.  As a result, the court defined the right to secrecy as the right to keep certain information confidential.   Applying this definition, the court found that BIPA protects a secrecy interest—the right of an individual to keep his or her personal identifying information, like fingerprints, secret. Thus, the court found that the customer’s allegation that the tanning salon shared the customer’s biometric information with a third-party sufficiently alleged a potential violation of the customer’s “right to privacy” within the purview of the insurance policies. 

Violation of Statutes Exclusion 

The policies contained the following pertinent exclusions:

B. Exclusions

  1. Applicable To Business Liability Coverage

This insurance does not apply to:

* * *

      p. Personal Or Advertising Injury

         ‘Personal injury’ or ‘advertising injury’:

* * *

      (2) Arising out of oral or written publication of material whose first publication took place before the beginning of the policy period;

      (3) Arising out of the willful violation of a penal statute or ordinance committed by or with the consent of the insured.

Additionally, an endorsement to the policies added the following exclusion:

This insurance does not apply to:

DISTRIBUTION OF MATERIAL IN VIOLATION OF STATUTES

‘Bodily injury’, ‘property damage’, ‘personal injury’ or ‘advertising injury’ arising directly or indirectly out of any action or omission that violates or is alleged to violate:

(1) The Telephone Consumer Protection Act (TCPA) [(47 U.S.C. § 227 (2018))], including any amendment of or addition to such law; or

(2) The CAN-SPAM Act of 2003 [(15 U.S.C. § 7701 (Supp. III 2004))], including any amendment of or addition to such law; or

(3) Any statute, ordinance or regulation, other than the TCPA or CAN-SPAM Act of 2003, that prohibits or limits the sending, transmitting, communicating or distribution of material or information.”

The insurer argued that that the policies’ exclusions expressly ruled out claims stemming from BIPA violations. According to the insurer, the policies barred coverage for violations of statutes that “prohibit the communicating of information,” which, according to the insurers, BIPA does. In response, the tanning salon emphasized the title of the exclusion and argued that the “other than” language in the exclusion bars coverage only for violations of statutes that regulate methods of communication like telephone calls, faxes, and e-mails. The court agreed with the tanning salon. 

The court began its analysis by pointing out that the exclusion is titled “Violation of Statutes that Govern E-Mails, Fax, Phone Calls or Other Methods of Sending Material or Information.”  The court noted that all the items listed in the title are methods of communication. Next, the court referenced how the exclusion explicitly lists two statutes that regulate methods of communication: the TCPA (telephone calls and faxes) and the CAN-SPAM Act (e-mails).  Accordingly, the court construed the words “other than” in the exclusion to mean other statutes of the same general kind that regulate methods of communication like the TCPA and the CAN-SPAM Act. Because BIPA does not regulate methods of communication, the court held that the statutory violation exclusion does not apply. Furthermore, to the extent that the “other than” language in the policies could be viewed as ambiguous, the court noted that it must be construed against the insurer.  

Different Allegations, Different Policies

In West Bend , the Illinois Supreme Court focused on the specific allegations in the underling class action complaint and its holding relied heavily on the policy language.Different facts underlying an alleged BIPA violation could lead to a different result on issues such as “publication” or “right to privacy.” And of course, not all general liability policies contain definitions and exclusions that are identical to the policy provisions considered by the court. Careful review of the underlying BIPA allegations as well as all pertinent policy language is essential to determine the scope of possible coverage for claims under BIPA.

The case was part of a growing trend of similar actions brought by insurers seeking to avoid coverage in the context of Illinois BIPA class actions. Even beyond the Illinois statute, companies need to recognize the increasing concern regarding privacy and protecting biometric information. Insurers will continue to challenge coverage in this area, and some may even seek to introduce changes to policy language to limit coverage. Policyholders need to scrutinize past, present, and future policies and carefully evaluate whether they are covered for possible BIPA violations. And companies without existing general business liability coverage for such claims may need to pursue other insurance options if faced with a potentially damaging class action.  

Ross Weiner is the Legal Director at Risk Settlements, a team of highly experienced legal, insurance and risk specialists. He helps companies assess legal and financial risk and create optimal settlement designs and risk transfer options. Prior to joining Risk Settlements, he was a litigator at Kirkland & Ellis LLP and focused on class actions among other matters .

Certum Group Can Help

Get in touch to start discussing options.

Recent Content

By Certum Team May 19, 2026
MLex, a LexisNexis publication covering global regulatory intelligence, recently interviewed and quoted Certum Group’s William Marra in an article examining the U.S. International Trade Commission’s proposed rule that would require disclosure of third-party litigation funding in Section 337 patent investigations. The proposed rule, published in the Federal Register on April 30, 2026, would require parties and intervenors in Section 337 investigations to disclose certain entities that provide funding or hold approval rights over litigation or settlement decisions. The ITC stated that the proposal is intended to identify conflicts of interest, clarify whose rights are at issue, and promote settlement and transparency. Comments are due June 29, 2026. Marra expressed concerns about the asymmetrical nature of the proposed disclosure requirements. While the rule would reach third-party litigation funding, it would not require disclosure of personal loans, bank loans, insurance funding, or contingent fee arrangements. “If you want to have a rule requiring the disclosure of third-party finance… it is more appropriate to have a rule requiring the disclosure of any and all forms of third-party finance,” Marra told MLex, including contingency-fee arrangements. Marra argued that selectively targeting only certain forms of funding creates an uneven playing field. “To the extent that you have disclosure rules that are targeted only at specific forms of third-party funding and not others, you are going to give certain parties a strategic advantage or disadvantage,” he said. “We have nothing to hide. We don’t want to give the other side of litigation a strategic advantage.”  Marra also highlighted the outsized burden that overly broad disclosure requirements can impose on smaller parties. “TPLF disclosure tends to impose a burden disproportionately on small- and medium-sized enterprises,” he said, drawing on arguments he made in a recent co-authored article in the Southern California Law Review . The full MLex article is available here .
By W. Tyler Perry May 14, 2026
We tend to view regulation and litigation as wholly separate enterprises. But federal regulatory agencies have always operated alongside private civil litigation, with each supplying functions the other cannot. Agencies set prospective standards and monitor compliance at scale. Litigation responds to concrete harm, remedying often unanticipated—or minimized—risks. Prior posts in this series traced the procedural mechanics of mass aggregation —from the equitable origins of representative litigation through Rule 23 to the modern MDL—and explained why those mechanisms exist as a structural response to the access failures of bilateral litigation . This post addresses a related but distinct question: Why private enforcement matters not just as a substitute for bilateral litigation, but as a necessary complement to public regulation. This symbiotic dynamic has held for decades, and an examination of that history underscores the importance of mass tort litigation as a regulatory backstop. The Structural Limits of Administrative Oversight The relationship between regulatory agencies and private litigation is complementary rather than redundant. Even at full capacity, administrative agencies face structural constraints that limit their effectiveness as enforcement mechanisms. The resource gap is the most straightforward. Regulated industries consistently outspend the agencies that oversee them. The pharmaceutical industry employs scientists, lawyers, and regulatory specialists whose collective depth of knowledge exceeds what any federal agency can match across its full portfolio of regulated products. An agency charged with monitoring thousands of products and reviewing hundreds of new applications annually necessarily operates with inherent informational disadvantages relative to the firms it oversees. The capture problem is more subtle but no less significant. Regulatory agencies are staffed, in significant part, by individuals who move between government service and the industries they regulate . This is not an indictment of those individuals—it reflects the reality that domain expertise concentrates in the private sector. But it nonetheless creates structural pressures that shape enforcement priorities in ways that do not always align cleanly with public interests. The latency problem is perhaps the most consequential. Pre-market approval is a snapshot, not an ongoing guarantee. An agency that approves a pharmaceutical compound based on clinical trial data cannot know what population-scale, long-term use will reveal. Post-market surveillance is resource-intensive and chronically underfunded . Harms that emerge years or decades after initial regulatory clearance may never trigger administrative enforcement action. These are not new problems. They have characterized the administrative state for decades, and they are precisely why private litigation has long served as a necessary counterpart to administrative enforcement. The Opioid Crisis: What Happens When Regulation Falls Short The opioid epidemic illustrates—at enormous human cost—what happens when regulatory oversight fails to keep pace with private-sector harm, and what private enforcement can accomplish when it fills the gap. The FDA approved OxyContin in 1995 based on clinical data that did not capture the addiction potential of mass-market, long-duration prescribing. Regulators, empowered to act against manufacturers and distributors flooding suspicious channels, were slow to exercise that authority at scale. State medical boards, operating in an environment shaped by industry-funded campaigns redefining pain management standards, did not flag prescribing patterns that, in hindsight, were plainly problematic. By the time the regulatory apparatus mobilized a meaningful response, hundreds of thousands of Americans had died. The tens of billions of dollars in settlements and judgments that followed came not through administrative action but through litigation— state attorneys general, municipalities, and private plaintiffs coordinated in MDL proceedings—that forced production of internal documents demonstrating what manufacturers and distributors knew and when they knew it. That information entered the public record through discovery. It informed subsequent regulatory responses, shaped public health policy, and produced one of the largest coordinated public health settlements in American history. PFAS and the Limits of Pre-Market Review Per- and polyfluoroalkyl substances—PFAS, or “forever chemicals”—illustrate a different dimension of the same structural problem. Manufacturers possessed internal research suggesting health risks associated with certain PFAS compounds for decades before that information became public. The EPA, constrained by the evidentiary standards of the Toxic Substances Control Act and facing significant industry opposition, did not set enforceable drinking water limits for the most common PFAS compounds until 2024 —roughly seventy years after their widespread industrial introduction. Private litigation, brought by communities near manufacturing facilities, military bases, and industrial sites, has produced more actionable information about PFAS health effects than decades of administrative process. Discovery in PFAS proceedings has surfaced internal documents , epidemiological data, and risk assessments that were never voluntarily disclosed. Those materials have informed subsequent regulatory action and generated the factual record on which ongoing public health policy depends. This is the information function of private litigation operating precisely as it should: Reaching into corporate decision-making in ways that administrative oversight either cannot compel or has not yet prioritized. Social Media and the Enforcement Frontier The current mass tort litigation against social media platforms for harms to adolescent mental health illustrates how private enforcement operates at the frontier of regulatory capacity. Congress has repeatedly attempted and failed to pass legislation governing platform design, algorithmic amplification, and the targeting of minors. The FTC’s authority is potentially applicable but has not been deployed at scale. The regulatory frameworks needed to establish clear standards remain, years into public awareness of the problem, largely unbuilt. Into that gap have stepped coordinated proceedings in federal MDL and state courts, alleging that platform features were designed with internal knowledge of their addictive potential and their disproportionate effects on adolescent development. Whatever the ultimate resolution of those cases, the litigation has already begun forcing into the public record information about internal product decisions and user research that no regulatory proceeding has yet reached. In March 2026, a California jury found Meta and YouTube liable for negligent platform design, rejecting both Section 230 and First Amendment defenses—the first bellwether verdict to hold platforms accountable for design-based harms to adolescents. Private enforcement is not a substitute for thoughtful legislation. But it is filling the gap that legislation has not occupied. The social media cases are, it should be noted, the most legally contested example in this series. Unlike pharmaceutical or chemical exposure litigation, platform liability claims must navigate Section 230’s broad immunity provisions and First Amendment questions that the opioid and PFAS cases did not present. The ultimate merits of these cases may differ from the prior examples. But even litigation that does not ultimately succeed forces into the public record information that regulatory silence cannot reach—and that distinction matters regardless of outcome. The Practical Consequence of a Smaller Administrative Footprint The structural argument for private enforcement as a complement to regulation is well-established. What fluctuations in agency capacity add is urgency.  Regulation and private litigation each supply what the other cannot. Regulation operates ex ante , setting prospective standards based on information available at approval. Litigation operates ex post , responding to harm that has materialized with discovery tools that can reach information never voluntarily shared. Regulation generalizes across industries; litigation develops facts specific to individual defendants and affected populations. Where these functions operate in tandem, the enforcement system is more complete. Where one contracts, the other must bear more weight. When agency enforcement capacity declines—whether through budget reductions, staff attrition, or shifts in enforcement priorities—the civil justice system is not simply one option among several. For many categories of diffuse harm, it becomes the only remaining mechanism capable of generating accountability. Companies that externalize costs onto the public face reduced administrative scrutiny. The deterrence effect of potential enforcement weakens. The information that litigation forces into the public record, and that regulators themselves have often relied upon, is no longer generated. One need not have a settled view on the optimal scope of the administrative state to recognize this dynamic. The practical question is not whether federal agencies should be larger or smaller. It is whether, given the enforcement landscape that actually exists, the civil justice system is equipped to do the work that system requires. Conclusion The debate over federal regulatory scope will continue, as it should. Reasonable people hold genuine disagreements about the appropriate role of administrative agencies, and those disagreements deserve serious engagement. But the institutions available to enforce safety norms and produce corporate accountability do not wait for that debate to resolve. When the administrative footprint contracts, courts and private litigation occupy the space. Mass tort aggregation, as this series has argued from the beginning, is not a procedural anomaly or an artifact of plaintiff-side opportunism. It is a structural feature of how diffuse harm gets addressed in a system where regulation has never been sufficient on its own. That function does not become less important when regulatory capacity declines. It becomes more so. Oliver Wendell Holmes once observed that “[t]he life of the law has not been logic: it has been experience.” The Common Law 1 (1881). The experience of the opioid epidemic, the decades of PFAS contamination, and the accumulating evidence of adolescent harm from platform design all point to the same structural lesson: Regulation and private enforcement are not competitors in an institutional zero-sum game. They are partners in an enforcement system that neither can sustain alone. The debate about their proper balance will continue. But dismissing private enforcement as mere opportunism ignores what experience has consistently shown: When private enforcement is absent, no one else fills the gap.
By Ross Weiner May 5, 2026
Class action litigators who practice in the BIPA space received clarity in April 2026 following the Seventh Circuit Court of Appeals’ decision in Clay v. Union Pacific Railroad Co. (“Clay”).[1] In a concise 17-page opinion, the court held that the Illinois General Assembly’s 2024 BIPA amendments, which established that BIPA damages should be evaluated on a per-person basis, should be applied retroactively to cases pending at the time of enactment. This decision is a setback for plaintiffs’ counsel who had invested heavily—in time and resources—in BIPA litigation as the next major vehicle for class action recovery. An overview of how we got here is below followed by a summary of the decision. History of BIPA In 2008, Illinois enacted the Biometric Information Privacy Act to respond to the “increasing use of biometric data in commerce.”[2] BIPA was intended to give individuals the right to control their biometric identifiers and information while providing a right of action and meaningful damages against entities that mishandled them. But one question quickly came to the fore: was a new claim accruing each and every time an employer collected the same information from the same employee? As one defendant argued, such a per-scan theory of claim accrual would create “potentially crippling financial liability” for employers who violate BIPA by “repeatedly collecting the same information in the same way.”[3] Recognizing the question’s importance, the Seventh Circuit, in Cothron v. White Castle System, Inc., certified the question of claim accrual to the Supreme Court of Illinois. During briefing, the defendant invoked Section 20—which sets the damages a plaintiff can recover “for each violation”—to dissuade the court from adopting its per-scan reading of Section 15, citing potentially astronomical awards. In a 2023 decision, the Illinois Supreme Court sided with the plaintiffs and held that pursuant to Section 15, claims accrue “with every scan or transmission” of biometric information.[4] The Illinois Supreme Court acknowledged the prospect of “potentially excessive damage awards,” but noted that concern is “best addressed by the legislature.”[5] Accordingly, the court concluded its opinion by “respectfully suggest[ing] that the legislature review these policy concerns and make clear its intent regarding the assessment of damages under the Act.”[6] The Illinois General Assembly Acts Less than a year and a half after Cothron, the Illinois General Assembly heeded the court’s call and passed an amendment that added two clauses to Section 20. The first provided that any entity that collects biometric information “in more than one instance… from the same person using the same method of collection in violation of subsection (b) of Section 15 has committed a single violation…for which the aggrieved person is entitled to, at most, one recovery under this Section.[7] The second added the same operative language for violations of Section 15(d).[8] Going forward, it was now clear that only “one recovery” was available per person (regardless of how many scans there were), transforming potentially excessive damages into more modest ones. But the legislature left one question open: should the amendments apply retroactively to cases already in progress? The Clay Decision According to the Seventh Circuit, Illinois courts have a simple decision tree when it comes to assessing retroactivity. First, did the legislation expressly indicate the temporal reach of the amendment? If yes, case closed. If not, then the court must assess whether the amendment in question constituted a substantive or procedural change to the law. Under Illinois law, a substantive amendment “prescribes the rights, duties, and obligations of persons to one another as to their conduct or property and … determines when a cause of action for damages or other relief has arisen.”[9] Conversely, a procedural amendment involves the “rules that prescribe the steps for having a right or duty judicially enforced, as opposed to the law that defines the specific rights or duties themselves.”[10] While the Clay court acknowledged that the distinction between the two can, in many different contexts, “be unclear,”[11] the court had no trouble deciding the case at bar for one simple reason: the “amendment to BIPA Section 20 is a remedial change,”[12] and “the Supreme Court of Illinois treats remedial changes as procedural, not substantive.”[13] Two features of the amendments were critical: First, the legislature located the amendments in Section 20, which governs liquidated damages, rather than Section 15, which sets the substantive standards for liability under the Act. Second, the amendments’ plain language “focuses on remedies,”[14] indicating that an “aggrieved person is entitled to, at most, one recovery under this Section.”[15] The court’s analysis was straightforward. For those BIPA litigants involved in currently pending cases, the litigation terrain just got bumpier for plaintiffs and more favorable for defendants. Plaintiffs’ settlement leverage in these cases has been significantly reduced. Nevertheless, with enough putative class members, BIPA cases could still be worth bringing, even if they are no longer as valuable. We will continue to monitor the ramifications of this decision. Notes: [1] No. 25-2185 (7th Cir. Apr. 1, 2026). [2] Id. at 3. [3] Id. [4] Cothron v. White Castle System, Inc., 216 N.E.3d at 921 (Ill. 2023). [5] Id. at 929. [6] Id. [7] 740 ILCS 14/20(b). [8] Id. at 14/20(c). [9] Perry v. Dept. of Fin. & Prof. Regulation, 106 N.E.3d 1016, 1034 (Ill. 2018). [10] Id. [11] Clay at 8. [12] Id. at 9. [13] Id. at 8. [14] Id. at 10. [15] 740 ILCS 14/20(b), (c) (emphasis added).