Jankowski, a regular shopper at Home Depot, claims that when checking out at a Chicago store location on June 22 of this year, he spotted something he hadn’t agreed to: a biometric scan [1].
The suit seeks to represent all individuals whose facial geometry was collected while visiting a Home Depot store in Illinois.
The case raises questions about the way big brands collect and maintain sensitive user data — particularly when these practices may conflict with consumer protections.
Home Depot collecting biometric data
According to the Jankowski lawsuit, the self-checkout register was equipped with a camera and a screen.
On that screen, Jankowski saw a green box around his face, indicating that the system was capturing his facial geometry — his biometric information.
The practice, he charges, directly violates the state’s Biometric Information Privacy Act (BIPA). That’s because Home Depot failed to obtain customers’ informed, written consent before collecting their biometric data, or to make its data retention policies publicly available when checking out.
The lawsuit seeks a punitive judgment of $5,000 for each alleged violation of the law. Home Depot currently operates 76 stores across Illinois, meaning the potential fines could amount to millions of dollars.
What the law says
Illinois isn’t the only state offering consumers protection from illicit biometric data collection practices.
Texas and Washington also have comprehensive biometrics laws, while California, Colorado, and Virginia include biometric data within their general consumer privacy statutes. Additionally, some cities, such as New York City and Portland, Oregon, have introduced local biometric privacy ordinances.
The precedent for Jankowski’s lawsuit was established in a landmark 2019 case in which a mother successfully sued the theme park for unlawfully collecting her son's fingerprints without providing BIPA-compliant notice and consent [2].
New technologies spurring concerns
Collecting digital data is a common practice among retailers, often through methods such as browsing history, on-site cookies and other tracking tools. But these practices require the consumer to either opt-in or be notified in writing.
