June 11, 2021

A Wave of Class Actions Under the Illinois Biometric Information Privacy Act is Causing Insurers and Policyholders to Consider Novel Coverage Questions Under General Liability Policies

Subscribe to Our Newsletter

Newsletter


Ross Weiner

|

June 11, 2021

Over the past few months, you have probably heard about big dollar settlements in cases brought under the Illinois Biometric Information Privacy Act (“BIPA”).  From the social media world, Facebook and TikTok both had significant settlements, agreeing to pay $650 million and $92 million, respectively.  A variety of other companies are now or soon will be facing similar BIPA class actions. 

BIPA is an Illinois statute regulating the collection and use of biometric data, including fingerprints, retina and iris scans, voiceprints, and scans of hand and face geometry.  (740 Ill. Comp. Stat. 14/1  et seq . (2008)). It prohibits private entities from disclosing a person’s biometric information without that person’s consent.  While a few other states have similar laws, only BIPA provides a private right of action. Accordingly, the plaintiffs’ bar has sought to capitalize.

Under BIPA, plaintiffs can recover $1,000 for each negligent BIPA violation and $5,000 for each intentional or reckless violation, plus attorneys’ fees.  The Illinois Supreme Court has held that when a private entity violates BIPA, any person whose biometric information was wrongfully shared can recover, even in the absence of actual injury.   Thus, BIPA class actions expose companies to tremendous potential liability. As the recent Facebook and TikTok settlements confirm, potential damages can add up quickly.   

The new cottage industry of BIPA class actions has led to a predictable result: defendant companies litigating with their insurers over whether there is coverage for the underlying BIPA case.  One case, in particular, stands out.  

West Bend Mut. Ins. Co. v. Krishna Schaumburg Tan, Inc .

In West Bend Mut. Ins. Co. v. Krishna Schaumburg Tan, Inc . (“ West Bend ”), the court was tasked with deciding whether the insurer was obligated to provide a defense for a tanning salon in a BIPA class action brought by a salon customer.  The customer alleged that the tanning salon violated BIPA by obtaining customer fingerprints and sharing them with a third-party vendor without first obtaining the required written release.  The tanning salon, which was covered by two business owners’ liability policies, sought coverage from its insurer.  In response, the insurer filed a declaratory judgment action seeking a declaration that the policy provided no such coverage.  Both parties both moved for summary judgment.  

The policies provided coverage for a “personal injury” that arises out of an “oral or written publication of material that violates a person’s right of privacy,” but also contained an exclusion for “distribution in violation of statutes.”  The parties disputed whether the salon owner’s sharing of customer biometric information with its vendor was a “publication” that violated the customer’s right to privacy and whether the policy’s exclusion applied to BIPA liabilities.

The trial court ruled for the tanning salon, finding the insurer was obligated to provide a defense in the class action. The Illinois Supreme Court affirmed. 

“Publication” and “Right of Privacy”

The insurance policies at issued stated, in pertinent part, as follows:

  1. Business Liability
    1. We will pay those sums that the insured becomes legally obligated to pay as damages because of ‘bodily injury’, ‘property damage’, ‘personal injury’ or ‘advertising injury’ to which this insurance applies. We will have the right and duty to defend the insured against any ‘suit’ seeking those damages. However, we will have no duty to defend the insured against any ‘suit’ seeking damages for ‘bodily injury’, ‘property damage’, ‘personal injury’, or ‘advertising injury’ to which this insurance does not apply.

* * *

  1. This insurance applies:

  • To ‘bodily injury’ and ‘property damage’ only if:
    • (a) The ‘bodily injury’ or ‘property damage’ is caused by an ‘occurrence’ that takes place in the ‘coverage territory’; and
    • (b) The ‘bodily injury’ or ‘property damage’ occurs during the policy period.
  • (2) To:
    • (a) ‘Personal injury’ caused by an offense arising out of your business, excluding advertising, publishing, broadcasting or telecasting done by or for you;
    • (b) ‘Advertising injury’ caused by an offense committed in the course of advertising your goods, products or services[.]”

The policies contain the following pertinent definitions:

“F. Liability And Medical Expenses Definitions

  1. ‘Advertising injury’ means injury arising out of one or more of the following offenses:

* * *

b. Oral or written publication of material that violates a person’s right of privacy;

* * *

  1. ‘Bodily injury’ means bodily injury, sickness or disease sustained by a person, including death resulting from any of these at any time.

* * *

  1. ‘Personal injury’ means injury, other than ‘bodily injury’, arising out of one or more of the following offenses:

* * *

e. Oral or written publication of material that violates a person’s right of privacy.”

The insurer argued that the customer’s BIPA complaint did not trigger the policies’ coverage for “personal injury” or “advertising injury” because the complaint did not allege a “publication” of material that violates a person’s “right of privacy.” The insurer first contended that “publication,” as used in business liability policies, means “communication to the public at large,” and because the tanning salon disclosed the biometric information at issue to only a single entity, there was no “publication.”  The Illinois Supreme Court rejected the insurer’s position, relying on publication’s dictionary definition: “the term means both communication to a single party and communication to the public at large.” Accordingly, the tanning salon’s decision to share the biometric information with its vendor was a “publication.”  

The parties also disputed what “right of privacy” means under the policy.  Looking again to the dictionary definition, the court found that the right to privacy includes two primary privacy interests: seclusion and secrecy.  As a result, the court defined the right to secrecy as the right to keep certain information confidential.   Applying this definition, the court found that BIPA protects a secrecy interest—the right of an individual to keep his or her personal identifying information, like fingerprints, secret. Thus, the court found that the customer’s allegation that the tanning salon shared the customer’s biometric information with a third-party sufficiently alleged a potential violation of the customer’s “right to privacy” within the purview of the insurance policies. 

Violation of Statutes Exclusion 

The policies contained the following pertinent exclusions:

B. Exclusions

  1. Applicable To Business Liability Coverage

This insurance does not apply to:

* * *

      p. Personal Or Advertising Injury

         ‘Personal injury’ or ‘advertising injury’:

* * *

      (2) Arising out of oral or written publication of material whose first publication took place before the beginning of the policy period;

      (3) Arising out of the willful violation of a penal statute or ordinance committed by or with the consent of the insured.

Additionally, an endorsement to the policies added the following exclusion:

This insurance does not apply to:

DISTRIBUTION OF MATERIAL IN VIOLATION OF STATUTES

‘Bodily injury’, ‘property damage’, ‘personal injury’ or ‘advertising injury’ arising directly or indirectly out of any action or omission that violates or is alleged to violate:

(1) The Telephone Consumer Protection Act (TCPA) [(47 U.S.C. § 227 (2018))], including any amendment of or addition to such law; or

(2) The CAN-SPAM Act of 2003 [(15 U.S.C. § 7701 (Supp. III 2004))], including any amendment of or addition to such law; or

(3) Any statute, ordinance or regulation, other than the TCPA or CAN-SPAM Act of 2003, that prohibits or limits the sending, transmitting, communicating or distribution of material or information.”

The insurer argued that that the policies’ exclusions expressly ruled out claims stemming from BIPA violations. According to the insurer, the policies barred coverage for violations of statutes that “prohibit the communicating of information,” which, according to the insurers, BIPA does. In response, the tanning salon emphasized the title of the exclusion and argued that the “other than” language in the exclusion bars coverage only for violations of statutes that regulate methods of communication like telephone calls, faxes, and e-mails. The court agreed with the tanning salon. 

The court began its analysis by pointing out that the exclusion is titled “Violation of Statutes that Govern E-Mails, Fax, Phone Calls or Other Methods of Sending Material or Information.”  The court noted that all the items listed in the title are methods of communication. Next, the court referenced how the exclusion explicitly lists two statutes that regulate methods of communication: the TCPA (telephone calls and faxes) and the CAN-SPAM Act (e-mails).  Accordingly, the court construed the words “other than” in the exclusion to mean other statutes of the same general kind that regulate methods of communication like the TCPA and the CAN-SPAM Act. Because BIPA does not regulate methods of communication, the court held that the statutory violation exclusion does not apply. Furthermore, to the extent that the “other than” language in the policies could be viewed as ambiguous, the court noted that it must be construed against the insurer.  

Different Allegations, Different Policies

In West Bend , the Illinois Supreme Court focused on the specific allegations in the underling class action complaint and its holding relied heavily on the policy language.Different facts underlying an alleged BIPA violation could lead to a different result on issues such as “publication” or “right to privacy.” And of course, not all general liability policies contain definitions and exclusions that are identical to the policy provisions considered by the court. Careful review of the underlying BIPA allegations as well as all pertinent policy language is essential to determine the scope of possible coverage for claims under BIPA.

The case was part of a growing trend of similar actions brought by insurers seeking to avoid coverage in the context of Illinois BIPA class actions. Even beyond the Illinois statute, companies need to recognize the increasing concern regarding privacy and protecting biometric information. Insurers will continue to challenge coverage in this area, and some may even seek to introduce changes to policy language to limit coverage. Policyholders need to scrutinize past, present, and future policies and carefully evaluate whether they are covered for possible BIPA violations. And companies without existing general business liability coverage for such claims may need to pursue other insurance options if faced with a potentially damaging class action.  

—

Ross Weiner is the Legal Director at Risk Settlements, a team of highly experienced legal, insurance and risk specialists. He helps companies assess legal and financial risk and create optimal settlement designs and risk transfer options. Prior to joining Risk Settlements, he was a litigator at Kirkland & Ellis LLP and focused on class actions among other matters .

Certum Group Can Help

Get in touch to start discussing options.

Recent Content

By Patrick Dempsey • October 13, 2026
This is the fourth post in Certum Group's seven-part series bringing our Trade Secret Litigation Playbook to the blog. It draws on Part IV of the Playbook, What Your Case Is Worth. Read or download the full Playbook here . Ask a business owner what a trade secret case is worth, and the first instinct is almost always the same: what did we lose? It is the intuitive measure, and it is usually the smallest one on the table. Trade secret law rewards claim holders who think about damages more expansively than "our lost sales," and the gap between the intuitive number and the recoverable number is often enormous. There are four measures worth understanding, and lost profits is only the first. Lost profits: what you would have earned The revenue you would have earned absent the misappropriation — contracts you would have signed, renewals you would have held, pricing power you could have sustained. Lost profits require you to prove causation between the taking and the foregone revenue, which is where most of the work goes. It is a real number, but it is anchored to your own historical performance, and that ceiling is frequently lower than what the case is actually worth. Unjust enrichment: what the defendant gained This is usually the largest measure, and by a wide margin. Unjust enrichment captures everything the defendant gained by taking the shortcut: the R&D and engineering it avoided, the head-start value of reaching the market faster than an independent developer could have, the savings and margins it captured, and — in the strongest cases — disgorgement of the revenue its product earned because it was built on your secret. In software, manufacturing, and pharmaceutical cases, the avoided-time-to-market term alone can dwarf your lost profits, because it measures the defendant's entire economic benefit rather than your specific loss. Reasonable royalty: the floor An objective measure grounded in what the defendant would have paid to license the secret in an arm's-length deal. It is typically the smallest of the three, but it functions as a floor when lost profits are speculative and unjust enrichment is contested. Sophisticated claim holders do not treat it as a fallback; they treat it as an independent anchor that constrains how small the number can reasonably be. Exemplary damages and fees: what willful conduct adds If the misappropriation was willful and malicious, the DTSA and most state statutes allow enhanced damages of up to twice the compensatory award, plus attorney's fees. 1 Willfulness is not a rhetorical flourish; it is a doubling, sometimes a tripling, of the core recovery. And the evidence that establishes it — an internal email, a board slide, a pattern of ignored warnings — is exactly the kind of material that discovery tends to surface. That is why intent belongs at the center of the case from day one. The Versata signal If you want a live illustration of how large the gap can be, look at the Federal Circuit's 2026 decision in Versata Software v. Ford. The trial court had tried to cap Versata's trade secret damages at a licensing-based model — essentially, what Ford would have paid — and zeroed out the rest as an undeserved "windfall." The Federal Circuit disagreed, holding that the DTSA's text expressly allows recovery of the unjust enrichment the defendant captured, even when that figure is far larger than any license fee. The message to corporate defendants is blunt: if you misappropriate rather than license, you assume the risk that the damages will dwarf what you could have paid. The message to claim holders is just as clear — the ceiling on your case is often much higher than your accountant's first estimate. Why this matters before you file Claim holders who engage a damages expert early consistently do better — not because the expert changes the facts, but because an early damages view changes three downstream decisions. It changes which counsel you hire, because the firms built for a $50 million case are different from the firms built for a $5 million case. It changes your fee structure, because a firm weighing a contingency needs a damages view to price it. And it changes settlement posture, because a plaintiff who can articulate a well-supported range anchors the negotiation, while one who cannot is negotiating against the defendant's number. The defendant almost always knows what you might get at trial. The only question is whether you do. Go deeper with the Playbook. This post covers one piece of a much larger picture. For the full framework — what the law requires, what a strong pre-filing case looks like, how damages experts value these matters, how counsel fee structures change your economics, and how litigation finance fits in — read Certum Group's Trade Secret Litigation Playbook , our field guide for business owners and the counsel who advise them: certumgroup.com/the-trade-secret-playbook . And if you are evaluating a live dispute — or simply want to pressure-test what a matter is worth and how it might be funded — get in touch. A confidential conversation with Certum is free and carries no obligation, whether or not you ultimately seek funding. Reach us at certumgroup.com/contact-us . Sources 1. 18 U.S.C. Section 1836(b)(3)(B) (permitting recovery of unjust enrichment not addressed in computing actual loss); Section 1836(b)(3)(C)-(D) (exemplary damages up to twice the compensatory award, and attorney's fees, for willful and malicious misappropriation).
By Patrick Dempsey • September 29, 2026
This is the third post in Certum Group's seven-part series bringing our Trade Secret Litigation Playbook to the blog. It draws on Part III of the Playbook, Before You File. Read or download the full Playbook here . The call usually comes from a sales leader, a head of engineering, or a chief of staff, and it usually starts the same way: "We think someone took X, and we think they took it to Y." What happens in the next three days is disproportionately important. The most expensive mistake in trade secret practice is waiting — every week that passes lets the defendant commercialize your advantage, and worse, lets the evidence quietly disappear. Slack messages, badge records, and git histories often sit behind auto-delete settings as short as ninety days. So before you do anything else, move to preserve. Here is what good early triage looks like. Issue a litigation hold — in writing, within 24 hours A written instruction to preserve any document, chat, email, calendar, or file relating to the possible misappropriation, sent to the full legal, HR, IT, and leadership teams. It should be specific enough to be useful, broad enough to catch the unexpected, and documented enough that you can produce it later. This is the single most important thing you can do in the first day. Lock down forensic images — and don't let internal IT do it Laptops, phones, and company devices belonging to any suspected party should be forensically imaged by an outside forensics firm, not wiped or "checked" by internal IT. Chain of custody matters, and internal teams generally cannot testify to it at trial. The right instinct is to image broadly and review narrowly: you can always decline to look at a device you preserved, but you can never go back for one that was reissued, wiped, or sold. And don't forget the non-obvious sources — personal cloud drives, USB connection histories, printer spooler logs, and screen-capture utilities are often where the decisive evidence actually lives. Extend retention on cloud and platform logs Have IT extend retention on the relevant accounts and export the log data — access logs, download histories, egress traffic — before anything rolls off. The forensic story of who did what, when, and with which file is usually more persuasive to a judge than any human witness. A download at 11:47 p.m. the night before a resignation is powerful evidence because of what the timing means. Do not tip off the adversary Resist the urge to confront the suspected employee, their new employer, or their counsel. Confrontation at this stage tends to accelerate deletion and pull communications behind privilege claims. A carefully timed cease-and-desist letter, sent after preservation is secure, is a very different move — and a far more effective one. Investigate under privilege Any investigation you run should be conducted under attorney direction, so that the work product is privileged and your witness interviews do not become admissions used against you later. This is not about secrecy for its own sake. It is about making sure the investigation helps your case rather than becoming evidence in it. Consider — but do not rush — the early public filing Ex parte seizure orders, temporary restraining orders, and preliminary injunctions all have their place, and an early injunction can be the single most valuable outcome in the whole case. 1 But these motions require a level of evidentiary support you rarely have on day three. It is almost always better to spend a week building the record than to file fast and lose the first motion, which hands the defendant a narrative and hands you a hole to climb out of. The triage checklist If you want a single page to keep by the phone, it looks like this: litigation hold issued in writing within 24 hours; outside forensics firm retained and imaging scheduled; cloud and platform log retention extended; a list of suspected individuals plus their managers and peers; a list of the specific secrets that may have been taken; copies of every NDA, employment agreement, and IP assignment covering them; a review of the last 90 days of their calendar for unusual patterns; and outside trade secret counsel engaged under privilege. Do the first 72 hours well and you preserve every option that follows — injunction, damages, settlement leverage. Do them poorly and you may spend the next two years litigating around evidence you could have saved in an afternoon. If you are in the opening days of a matter and want a fast, confidential read on what to do now versus later, that is exactly the conversation we have most often. Go deeper with the Playbook. This post covers one piece of a much larger picture. For the full framework — what the law requires, what a strong pre-filing case looks like, how damages experts value these matters, how counsel fee structures change your economics, and how litigation finance fits in — read Certum Group's Trade Secret Litigation Playbook , our field guide for business owners and the counsel who advise them: certumgroup.com/the-trade-secret-playbook . And if you are evaluating a live dispute — or simply want to pressure-test what a matter is worth and how it might be funded — get in touch. A confidential conversation with Certum is free and carries no obligation, whether or not you ultimately seek funding. Reach us at certumgroup.com/contact-us . Sources 1. The ex parte seizure procedure is authorized by the Defend Trade Secrets Act, 18 U.S.C. Section 1836(b)(2), and is available only in extraordinary circumstances.
By Patrick Dempsey • September 15, 2026
This is the second post in Certum Group's seven-part series bringing our Trade Secret Litigation Playbook to the blog. It draws on Part II of the Playbook, Trade Secret Law in Plain English. Read or download the full Playbook here . Here is a statistic that surprises most executives: in federal trade secret cases that reach a verdict, plaintiffs win roughly 84% of the time. 1 That is dramatically better than the plaintiff win rate in commercial litigation generally. It does not mean every case is easy — the cases strong enough to reach a jury are a selected group — but it tells you something important about what happens when a well-built trade secret claim gets in front of a fact-finder: courts tend to enforce the rights the statute was designed to protect. So why do good claims still fail? Usually not at trial. They fail earlier, on assumptions the claim holder never stopped to test. In more than a decade of evaluating these matters, the same handful of misconceptions come up again and again. Here are six worth clearing up before they cost you a case. Myth 1: "It's only a trade secret if we stamped it CONFIDENTIAL." Marking helps, but it is not required. What matters is whether your overall secrecy program is reasonable under the circumstances — a holistic look at contractual, physical, and technical controls. A perfect stamp on an otherwise open system is worth less than a coherent program with a few gaps. Myth 2: "If part of it is public, none of it is protected." Courts routinely protect a combination of individually public facts when the particular combination delivers competitive advantage. The recipe can be assembled from ingredients anyone can buy. What you protect is the assembly. Myth 3: "Our employees signed NDAs, so we're covered." NDAs are a foundation, not a program. The full set of reasonable measures a serious claim holder is expected to have includes access controls, badging, egress monitoring, exit procedures, and technical segmentation. An NDA in the drawer and nothing behind it is exactly the gap a well-resourced defendant will press on first. Myth 4: "We didn't sue the last person who left, so it's too late now." Trade secret protection is evaluated case by case. Declining to act on one departure does not forfeit your rights as to the next one. Every matter stands on its own facts. Myth 5: "We're too small to enforce against a big company." This one gets the economics backwards. A well-funded claim against a large, solvent defendant is often easier to win — and easier to collect — than a disorganized claim against a small one. Resources can be added to a strong case; facts cannot be added to a weak one. The right capital partner exists precisely so that a smaller plaintiff can stand toe-to-toe with a much larger adversary and neutralize the outspend-them tactics that used to decide these fights. Myth 6: "It's just know-how — courts don't protect that." Courts protect integrated know-how constantly. The question is never whether know-how is capable of protection; it is whether you can identify it with enough particularity to describe what was taken. 2 That is the single most consequential early decision in the case, and it is the one most claim holders do not realize they are making when they plead "our proprietary software" instead of the specific, described combinations that actually give them an edge. The through-line Notice what these myths have in common: each one leads a claim holder to under-invest in a case that the numbers say is very winnable. The 84% figure is not a promise. It is an invitation to take the early work seriously — the secrecy program, the identification, the evidence — because that work is what turns a strong set of facts into a strong case. Get those right, and the law is on your side more often than in almost any other kind of commercial dispute. Go deeper with the Playbook. This post covers one piece of a much larger picture. For the full framework — what the law requires, what a strong pre-filing case looks like, how damages experts value these matters, how counsel fee structures change your economics, and how litigation finance fits in — read Certum Group's Trade Secret Litigation Playbook , our field guide for business owners and the counsel who advise them: certumgroup.com/the-trade-secret-playbook . And if you are evaluating a live dispute — or simply want to pressure-test what a matter is worth and how it might be funded — get in touch. A confidential conversation with Certum is free and carries no obligation, whether or not you ultimately seek funding. Reach us at certumgroup.com/contact-us . Sources 1. Stout, Trends in Trade Secret Litigation (2024), reporting an approximately 84% plaintiff-favorable outcome rate across 271 federal trade secret cases reaching a verdict since 2017. 2. Both the federal Defend Trade Secrets Act (18 U.S.C. Section 1836) and the state Uniform Trade Secrets Act define a trade secret as information that derives independent economic value from not being generally known or readily ascertainable, and that is the subject of reasonable measures to keep it secret.