Chief Judge Nancy J. Rosenstengel largely denied summary judgment in Doe v. Apple Inc., No. 3:20-cv-00421-NJR (S.D. Ill.), the long-running Illinois Biometric Information Privacy Act (BIPA) class action concerning Apple’s Photos app and its facial recognition capabilities. The ruling allows the core claims concerning Apple’s creation and handling of facial data to proceed, while holding that face crops—smaller images extracted from photographs—are not themselves biometric identifiers or biometric information under BIPA. The decision is noteworthy for its detailed analysis of BIPA’s disputed terms and as one of the first to apply the U.S. Court of Appeals for the Seventh Circuit’s recent decision in G.T. v. Samsung Electronics America, Inc., 186 F.4th 470 (7th Cir. 2026), which the court concluded was not a “silver bullet” for Apple.
Case background
Formerly captioned Hazlitt v. Apple Inc., Doe challenges the facial-recognition technology built into Apple’s Photos app. The app analyzes photos in a user’s library and identifies faces through a multistep process. First, an algorithm detects each face and creates a smaller image of it, called a “face crop.” A second algorithm processes the crop into a 128-number vector called a “faceprint.” The app then groups photos with sufficiently similar faceprints in its “People” album, where users can label faces with names. The plaintiffs allege that the face crops and faceprints are biometric data protected by BIPA and that Apple violated the statute by collecting the data without providing the required notice and obtaining written consent, and by failing to publish a retention and destruction policy.
The litigation has been pending for more than six years. In July 2024, Apple released a software update (the Sync Update) that began syncing faceprints to iCloud for certain users, adding a cloud-based dimension to the dispute. In June 2026, the court certified three classes: a Local Device Class, an iCloud Subclass, and an iCloud Faceprint Subclass.
The parties’ summary judgment motions presented two central questions:
- Whether the face crops and faceprints qualify as biometric identifiers or information under BIPA
- Whether Apple possessed or collected that data within the meaning of the statute
Judge Rosenstengel’s summary judgment order
The order addresses several key questions about BIPA’s reach and Apple’s control over the data its Photos app generates.
Face crops are not covered by BIPA
The court first granted summary judgment for Apple on the plaintiffs’ theory that face crops are biometric data under BIPA. According to the court, data is covered only if it (1) includes a “scan of . . . face geometry” and (2) is capable of identifying a person. Face crops satisfy neither requirement. They are simply smaller images extracted from photographs, not scans that map the geometry of a face. The plaintiffs offered no evidence that the crops themselves could identify a person.
As a result, the court decertified the iCloud Subclass, which “claims only that face crops . . . [were] synced to iCloud.” The practical effect of this holding is minor, however, because iCloud Subclass members remain in the Local Device Class.
Plaintiffs’ faceprint theory can proceed
The plaintiffs fared better on their Faceprint theory. The court found factual disputes over whether faceprints constitute scans of face geometry and whether they are capable of identifying a person.
On the first question, the court rejected Apple’s argument that a scan of face geometry must capture three-dimensional facial structure or explicitly measure distances and angles between facial features. Relying on In re Facebook Biometric Information Privacy Litigation and dictionary definitions, the court interpreted the term “geometry” broadly such that it can simply mean a “configuration.” The plaintiffs’ expert testified that Apple’s algorithms can capture facial contours and the shapes of features such as the mouth and eyes. That evidence, along with other evidence in the record, could allow a jury to find that faceprints scan face geometry. Apple’s competing expert evidence, however, left the issue for trial.
The court likewise found a factual dispute over whether faceprints are capable of identifying a person. Like most courts to consider the question, Judge Rosenstengel held that BIPA requires only that the data be capable of identifying a person, not that the defendant actually uses it to do so. She also found that the test is more easily satisfied where, as here, the defendant “collects other information about an individual,” such as a name or address.
The plaintiffs pointed to Apple employees’ testimony, internal documents, and patent applications describing faceprints as uniquely identifying faces. They also presented evidence that users can associate names with faces in the People album and that, for the iCloud Faceprint Subclass, faceprints are linked to iCloud accounts. The court concluded that this evidence could support a finding that faceprints are capable of identifying people, although Apple presented competing evidence, so the issue must be tried before a jury.
Factual disputes remain as to whether Apple ‘controls’ Faceprint data
BIPA applies only if Apple “possessed” or “collected” biometric data, and Judge Rosenstengel agreed with other courts that those terms essentially ask whether the defendant “controls” the data. Apple’s primary argument on this issue was twofold: (1) It did not control faceprints stored solely on users’ devices, which it contended was dispositive under G.T.; and (2) even after the Sync Update moved faceprints to iCloud, Apple still did not control them because they were encrypted at all times.
Judge Rosenstengel rejected both arguments. She first held that G.T. was not “a silver bullet” for Apple, distinguishing it on several grounds. Unlike the defendant in G.T., for example, Apple began syncing faceprints from users’ devices to its own cloud servers in July 2024, which shows that Apple retains power over the data even when it remains on-device. Testimony from a former Apple software engineer bolstered this conclusion, confirming that Apple decides whether faceprints are created, where they are stored, whether they are encrypted, and how long they are kept.
Apple’s encryption of faceprints on iCloud was not a silver bullet either. According to Judge Rosenstengel, BIPA has no exception for encrypted data, and a company does not need to be able to read data to control it. The court compared Apple to a collector who owns Egyptian hieroglyphs that he cannot read but can still alter, publish, or destroy. Apple also acknowledged that it could decide to stop using end-to-end encryption. The court therefore declined to grant Apple summary judgment on the ground that it lacked control over the data.
No proof of access is required to be ‘aggrieved’
Finally, the court rejected Apple’s argument that the plaintiffs were not “aggrieved” under BIPA because Apple never accessed their faceprints. Under Rosenbach v. Six Flags Entertainment Corp. and Seventh Circuit precedent, a violation of BIPA’s requirements is itself sufficient; plaintiffs need not show that Apple actually viewed or used their biometric data or that they suffered additional harm.
Looking forward
The decision has several implications for companies that build facial recognition or other machine-learning features. The court’s interpretation of “scan of face geometry” extends beyond systems that expressly measure facial distances or angles: A jury could find that a mathematical representation derived from facial images qualifies as a scan of face geometry.
The court’s control analysis is also significant insofar as it suggests that even when data is stored locally, G.T. may offer limited protection to companies that write their own software, decide how biometric data is stored and kept, or sync any derived data to their own servers, even in encrypted form.
The decision also highlights the potential significance of a company’s own descriptions of its technology. Apple’s internal documents, patents, and employee testimony helped create factual disputes over whether faceprints could identify individuals and whether Apple controlled them.
Relatedly, the decision illustrates that once a BIPA case reaches discovery on complex technology, competing expert opinions and internal documents can readily create a genuine dispute of material fact about what that technology does and what it is capable of. As a result, the most reliable way to avoid BIPA exposure is to provide the required notice and obtain written consent before collection, as well as maintain a publicly available written retention and destruction policy.
