• 2 min read
Apple faces $32.5 billion Photos privacy lawsuit
Apple faces a certified Illinois class action over Photos face recognition, with potential damages of up to $32.5 billion under BIPA.
Image: 9to5Mac
Apple is facing a certified class-action lawsuit that could seek up to $32.5 billion over facial-recognition features in the Photos app. The case alleges that Apple’s People feature violated Illinois' Biometric Information Privacy Act (BIPA) by creating and using biometric data without the required notice or consent.
BIPA gives Illinois residents control over their biometric information, including the ability to refuse its collection. The law allows $1,000 per negligent violation and $5,000 per intentional or reckless violation.
Who is included in the Apple Photos lawsuit
The case began in March 2020, when roughly 10 Apple users filed a proposed class action. After four amended complaints, years of discovery, and multiple attempts by Apple to dismiss the claims, a court granted class certification in June. Apple’s request for an immediate appeal of that decision was denied.
The plaintiffs are seeking to represent approximately 6.5 million Illinois residents across three groups:
- Local Device Class: Illinois residents whose Apple device placed their photograph in a People album from September 13, 2016, to the present.
- iCloud Subclass: Illinois residents whose People album included their name or another identifier and who had iCloud photo storage enabled during the same period.
- iCloud Faceprint Subclass: Illinois residents using iOS 17.6, macOS Sonoma 14.6, or iPadOS 17.6 or later who had iCloud Photos enabled with at least 10GB of storage, at least 5,000 photos or videos, and a photograph placed in a People album between March 25, 2025, and the present.
The claims cover both processing performed on Apple devices and, for some users, data associated with iCloud photo libraries. The certification document was reported by The Times and spotted via AppleInsider, according to 9to5Mac.
Recommended reading
Apple files second UK challenge over iCloud encryption
Apple has not been found liable
Certification allows the lawsuit to proceed, but it does not establish that Apple violated BIPA. The plaintiffs must still prove their claims in district court before any damages can be awarded.
The potential figure is comparable to the scale of other Illinois biometric-privacy cases cited in the report: Meta agreed to a $650 million settlement over Facebook’s facial-recognition system, while Instagram-related allegations resulted in a separate $68.5 million settlement. Apple’s possible exposure is far larger on the numbers presented here, but the court has not yet ruled on liability or damages.
Security Editor
Sophia unpacks the invisible wars happening on our networks. Covering cybersecurity, privacy legislation, and cryptography, she exposes how our data is weaponized and defended. Before joining for(geeks), she spent years as a penetration tester. She's the reason the rest of the team uses physical security keys.
via 9to5Mac
