Shiseido Americas Corporation is facing a proposed class action alleging that the virtual cosmetic try on feature available across several of its brand websites collects, stores, and uses consumers’ facial scans without their knowledge or consent, in violation of the Illinois Biometric Information Privacy Act (BIPA). The suit, filed as Powell v. Shiseido Americas Corporation on November 30, 2021, in the Northern District of Illinois, targets one of the beauty industry’s most widely adopted digital commerce tools.
How the Try On Tool Works and What It Allegedly Collects
The virtual try on feature is available across Shiseido Americas’ portfolio of brand websites, including bareminerals.com, narscosmetics.com, lauramercier.com, and cledepeaubeaute.com. Accessed by clicking a “Try On,” “Try It On,” or “Try Now” button beneath a product image, the tool allows shoppers to see how a cosmetic product would look applied to their face, either via a live web or phone camera or by uploading a saved photo. The resulting image can then be downloaded or emailed. According to the lawsuit, the tool is powered by the YouCam Makeup application, which uses biometric technology to capture the facial geometries of users in order to accurately overlay makeup products onto their images.
What Illinois Law Requires
The Illinois BIPA is one of the most stringent biometric privacy laws in the United States. It requires any company collecting biometric identifiers, including facial geometry scans, fingerprints, and retina scans, from Illinois residents to first provide written notice that biometric data is being collected and state the purpose and length of time for which it will be stored and used. Companies must also obtain written consent before collecting the data and maintain a publicly available written policy establishing a retention schedule and guidelines for the permanent destruction of that data. The lawsuit alleges that Shiseido Americas failed to meet any of these requirements, neither informing customers that their biometric information was being captured nor asking for written consent before doing so.
The Brands Affected
The breadth of the lawsuit is notable. Shiseido Americas Corporation operates as the parent entity behind a wide portfolio of beauty brands, including Shiseido, NARS, Laura Mercier, Buxom, Clé de Peau Beauté, bareMinerals, Drunk Elephant, Issey Miyake, Narciso Rodriguez, and Dolce & Gabbana fragrances. The class action seeks to represent any Illinois resident whose biometric identifiers were captured through the virtual try on tool on any of the defendant’s websites within the past five years, making the potential class a substantial one given the combined traffic of those brand sites.
Lessons for Brands to Avoid
The Shiseido lawsuit is a warning for every beauty and retail brand that has deployed virtual try on technology without fully examining the biometric data implications of doing so. As AI powered beauty tools have become a standard feature of e commerce, the legal compliance infrastructure around them has struggled to keep pace.
- Virtual try on tools collect biometric data, not just photos. The critical legal distinction here is that facial geometry mapping constitutes biometric information under laws like Illinois BIPA, even when the consumer experience feels as simple as previewing a lipstick shade. Brands must treat these tools with the same legal rigour as any other biometric data collection process.
- Consent must be explicit and documented before collection begins. A general terms and conditions page or a privacy policy buried in a website footer does not satisfy BIPA requirements. Written consent specific to biometric data collection must be obtained before the tool activates, not after.
- Third party technology providers do not transfer legal responsibility. The fact that the try on tool was powered by YouCam Makeup does not insulate Shiseido Americas from liability. Brands are legally accountable for the data practices of the tools they deploy on their platforms.
- Multi brand operators face multiplied exposure. For a company like Shiseido Americas, which deploys the same technology across multiple brand websites, a single compliance failure can generate class action exposure across an entire portfolio simultaneously.Title ideas for blog post:
Shiseido is facing a class action alleging its virtual try on tool collected facial scans without consent across multiple beauty brands
Why Shiseido’s virtual makeup try on feature became a biometric privacy lawsuit spanning NARS Laura Mercier and bareMinerals
The Illinois privacy law that is making beauty brands rethink their virtual try on tools
