Apple's 'Faceprint' Problem: The $40 Billion Illinois Privacy Trial, Explained

Open the Photos app on your iPhone and tap the People album, and the software has quietly done something remarkable: it has scanned the faces in thousands of your pictures, turned each one into a string of numbers, and sorted your life into faces it recognizes. As of October 2026, an Illinois federal court says that string of numbers may be a biometric identifier collected without your consent, and a jury will get to decide. On September 30, U.S. District Judge Nancy J. Rosenstengel refused to dismiss most of a class action against Apple over the feature, in a ruling unsealed on October 8. A trial is now scheduled for April 2027.

The stakes are enormous. Lawyers for the plaintiffs estimate the certified class covers about 8 million Illinois residents. The Illinois Biometric Information Privacy Act carries damages of up to $5,000 per person for intentional or reckless violations, which puts Apple's maximum exposure near $40 billion.

This is explanatory context, not legal advice, and nothing has been decided: a jury still has to find that Apple violated the law at all. But the case is already reshaping how courts think about biometric data in the AI era, and its implications stretch far beyond one company's photo app.

What a "faceprint" is, and why the law cares

The case began in March 2020, when about ten Apple users sued in St. Clair County, Illinois, before the dispute moved to federal court in East St. Louis. Their claim is straightforward in outline: the People album's face-grouping feature automatically creates a "faceprint" for every person who appears in a user's photos, and Apple never asked permission or told users it was happening.

A faceprint, as described in the litigation, is a compact numerical template, roughly 128 numbers, derived from the geometry of a face. Apple says the template cannot be reverse-engineered into a recognizable face, and its lawyer Arturo Gonzalez told the court at an August 27 hearing that it is merely "a string of numbers," not a measurement of angles and distances between features. The technology, he argued, only asks whether two pictures look alike. It never asks whether the face belongs to John or Jane.

The Illinois law, passed in 2008, takes a different view of those distinctions. The Biometric Information Privacy Act requires companies to give notice and obtain written consent before collecting biometric identifiers, a category that explicitly includes scans of face geometry. The legislature's reasoning, echoed in the complaint, is that biometrics are categorically different from other identifiers: unlike a credit card number, you cannot cancel your face and get a new one. A compromised template is compromised forever.

Unlike a password or a Social Security number, you cannot change your face. Under Illinois law, that permanence is exactly why a faceprint deserves the strictest privacy protection.

Apple conceded, according to coverage of the ruling, that it never published a biometric data retention policy and never obtained written consent from Illinois users. That concession narrows the fight to two questions: are faceprints "scans of face geometry" under the statute, and does Apple actually "possess" or "control" them in a way the law reaches?

Why encryption did not end the case

Apple's strongest argument was technical. Much of the faceprint data synced to iCloud is encrypted, and Apple told the court it cannot read customers' photo libraries, does not decrypt the album data, and does not know who appears in anyone's albums. If it cannot decipher the data, the argument goes, it does not control it, and a company cannot be liable for biometric data it does not control.

Judge Rosenstengel was unpersuaded, and her reasoning may become the most quoted passage of the case. She compared Apple to a collector of ancient Egyptian artifacts covered in hieroglyphics. The collector may have no idea what the writing says, she wrote, but still controls what happens to the artifacts: he could copy the glyphs, publish them, or smash the tablets. Because Apple writes the software and operates the servers where the data lives, she concluded, it undoubtedly could rewrite, publish, unencrypt, or delete the faceprint data. Encryption, in her view, is a design choice, not an escape hatch.

There is precedent for courts rejecting this kind of technical minimalism. Facebook made a nearly identical argument in the class action over its photo "tag suggestions," insisting its software merely analyzed pixels rather than measuring facial geometry. A federal judge in California rejected it, and Facebook settled the case for $650 million in 2020. Apple did win one concession: the court agreed that "face crops," small cropped images of faces extracted by the software, are not biometric data, which removed one smaller iCloud subclass from the case.

What the trial will decide for everyone else

The April 2027 trial will put two questions before a jury: whether faceprints count as scans of face geometry, and whether they are capable of identifying a person. Apple has brought in reinforcements, with four partners from the firm Gibson Dunn filing notices of appearance last week to supplement the Morrison and Foerster team that has handled the case so far.

The outcome matters well beyond Apple. Amazon's Ring, Google, and other companies face proposed class actions over biometric collection, part of a growing wave of litigation forcing courts to reinterpret a 2008 statute for an era of ubiquitous AI vision. And the case law is not moving in only one direction: the Seventh Circuit recently upheld the dismissal of a similar biometric privacy suit against Samsung, finding the plaintiffs failed to state a claim, a reminder that the statute's reach is being tested case by case.

One quiet but crucial change already limits the blast radius. A 2024 amendment to the biometric law capped recovery at one violation per person rather than one per scan, and the Seventh Circuit ruled in April 2026 that the change applies retroactively to pending cases. Without it, Apple's exposure would have been measured in scans, not people, and the numbers would have been far larger.

For users, the practical lesson is simpler than the legal doctrine. Features that feel like conveniences, automatic face grouping, Memories slideshows, pet recognition, are quietly building biometric profiles of everyone in your camera roll. Illinois law says that profile belongs to the person in the photograph, not the company that made the camera. Next spring, a jury in East St. Louis gets to say whether one of the most valuable companies in the world agreed.