A new class action lawsuit filed August 25, 2025, in Illinois state court alleges that MAC Cosmetics is illegally collecting, storing, and using Illinois consumers’ biometric data through its virtual makeup try-on technologies, without obtaining the informed and written consent required by state law. The case, Javid v. MAC Cosmetics, Inc. (2025-CH-08774), has ignited conversation about heightened privacy risks tied to the widespread use of facial scanning technology in retail settings.
Lawsuit Details and Technologies Involved
According to the complaint, MAC stores and its website deploy live-video and photo-based try-on tools that analyze each user’s facial geometry, which qualifies as “biometric information” under Illinois law. Shoppers are offered three ways to test virtual makeup:
- Granting real-time camera access for a “digital mirror” overlay,
- Taking a facial photo through MAC’s web interface, or
- Uploading an existing facial image for a virtual product application.
The lawsuit contends that at no point do MAC’s systems or staff inform customers about the data capture, nor do they obtain the express written consent mandated by the Illinois Biometric Information Privacy Act (BIPA).
Understanding BIPA: The Nation’s Strongest Biometric Privacy Law
Enacted in 2008, BIPA is widely considered the strictest biometric privacy mandate in the US. Key requirements for companies using biometric tech—such as facial geometry scans, fingerprints, or retinal imaging—include:
- Providing explicit written notice to individuals about data collection,
- Outlining data use, storage, and destruction policies,
- Obtaining written consent before collection or storage, and
- Giving individuals the right to sue for unauthorized collection or misuse.
Plaintiff Fiza Javid claims that MAC’s retail associates and digital platforms violate every stage of this law—failing to disclose the purpose of data collection, neglecting to issue a policy on storage or destruction, and never asking for permission before scanning shoppers’ faces.
Scope, Penalties, and Consumer Classes
The complaint seeks to represent Illinoisans who had their facial geometry scanned via MAC’s virtual try-on tools either in-store or online. Each violation of BIPA can result in damages of up to $1,000 for negligent breaches or $5,000 for reckless or intentional violations—plus attorneys’ fees and other costs. If the court certifies the class, MAC and parent company Estée Lauder could face significant financial exposure and operational scrutiny.
Industry Implications: Tech, Privacy, and Reputation
This case highlights urgent risks as beauty brands and retailers rush to embrace AI-powered personalization. Biometric technology enables instant, interactive experiences but raises major privacy and data security concerns—especially under evolving state and federal frameworks. Recent months have seen similar lawsuits against other beauty and personal care brands, establishing a pattern of legal tests for companies whose customer engagement strategies deploy facial analytics or recognition.
Expert Legal Take and Ethical Standards
Compliance with biometric laws like Illinois’ BIPA is regarded as critical for any retailer deploying virtual try-on tools or facial recognition technologies. Legal experts, including those representing Illinois plaintiffs, note that since biometric data is considered highly sensitive and strictly regulated, brands must establish clear written privacy policies, make users aware of how their data is collected, and secure explicit user consent for every scan. This case amplifies the urgent need for brands in beauty tech to provide transparent opt-in procedures and robust privacy safeguards to protect consumer trust and avoid legal risks.
The outcome of this class action will have ripple effects across the beauty retail, tech, and privacy law sectors, likely setting future standards for the use of biometric data in digital commerce and in-store experiences.
