Illinois Court Lets MAC Biometric Privacy Suit Move Forward
Illinois federal court denied MAC Cosmetics' motion to dismiss a BIPA class action lawsuit.
Why it matters: Legal and compliance teams must ensure biometric data collection meets Illinois law requirements to avoid costly litigation. This decision signals heightened judicial enforcement of biometric privacy protections affecting retailers using tech like virtual try-ons.
- June 5, 2026: Illinois federal court denied dismissal of class action against MAC Cosmetics.
- The suit alleges MAC’s virtual try-on tech scanned facial biometrics without required BIPA disclosures or written consent.
- Plaintiff seeks to represent all Illinois consumers who used MAC's virtual try-on features in-store or online.
- BIPA requires informed, written consent before biometric data collection and permits statutory damages up to $5,000 per violation.
On June 5, 2026, the U.S. District Court for the Northern District of Illinois rejected MAC Cosmetics' motion to dismiss a proposed class action accusing the company of violating the Illinois Biometric Information Privacy Act (BIPA). The plaintiff, Fiza Javid, asserts that MAC’s virtual makeup try-on technology, deployed both in physical stores and online, captured consumers’ facial geometry without providing the disclosures or obtaining the written consent mandated by BIPA.
Enacted in 2008, BIPA is one of the nation's most comprehensive biometric privacy laws. It requires entities to inform individuals in writing about biometric data collection practices, secure their written consent before collecting or storing biometric identifiers or information, and establish retention and deletion policies. Violations can lead to statutory damages ranging from $1,000 for negligent violations to $5,000 for willful or reckless breaches (text of BIPA statute).
The lawsuit aims to represent a class of all Illinois residents who used MAC's virtual try-on features, alleging systemic noncompliance with BIPA requirements. The court found the plaintiff’s allegations sufficient to proceed, emphasizing judicial willingness to enforce biometric privacy protections and scrutinize the use of facial recognition and related technologies in retail settings (N.D. Ill. court records).
Legal analysis highlights the significance of this ruling following the first BIPA jury verdict in October 2022, where the Illinois Supreme Court upheld statutory damages provisions, affirming BIPA’s enforceability (Law360 coverage). This ruling underscores the heightened regulatory and litigation risks for companies relying on biometric technologies without robust consent frameworks.
Compliance teams and outside counsel should reassess biometric data collection and consent procedures to mitigate exposure. The case illustrates that virtual try-on tools, often viewed as low-risk, are subject to stringent BIPA requirements under Illinois law.
By the numbers:
- June 5, 2026 — Court ruling on MAC Cosmetics' BIPA class action motion
- $1,000–$5,000 — Statutory damages per BIPA violation
- 2008 — Year Illinois passed the Biometric Information Privacy Act
Yes, but: While this ruling allows the case to proceed, the ultimate legal determination on whether MAC violated BIPA remains pending, and companies with robust consent practices may avoid liability.
What's next: The case will proceed to discovery and potentially class certification. Other retailers using biometric tech in Illinois may face increased litigation risk in the near term.