Class Action Lawsuit Worth $32.5 Billion! iPhone Photo App Sued for Violating Privacy Laws—6.5 Million Illinois Users Could Receive Up to $5,000 Each

The U.S. Seventh Circuit Court of Appeals has recently rejected Apple’s emergency appeal, confirming that a class-action lawsuit against the iPhone’s 'Photos' app for scanning faces in personal albums can proceed. The case has been remanded to an Illinois district court for continued litigation.

If plaintiffs ultimately succeed in proving their claims, they could claim up to $5,000 per person under Illinois’ Biometric Information Privacy Act (BIPA) for intentional violations. With approximately 6.5 million eligible Illinois users, the total potential damages could reach $32.5 billion—potentially making this one of the largest privacy-related class-action lawsuits in U.S. tech history.

The lawsuit originated in March 2020, when around ten Illinois residents sued Apple for scanning photos on-device to generate facial feature vectors and syncing them via iCloud to the cloud—allegedly without clear notice or written consent. This, they argue, violates BIPA’s strict requirement that companies must inform users of the purpose and obtain written consent before collecting biometric data.

Apple countered that the Photos app uses irreversible feature vectors that cannot reconstruct faces or link to identities, and therefore do not constitute legally defined biometric identifiers. However, in June, an Illinois district court certified the case as a class action, and on June 30, the Seventh Circuit upheld that decision, ruling that 'technical abstraction does not exempt legal scrutiny.'

Under BIPA, negligent violations carry a $1,000 penalty per incident, while intentional or reckless violations can result in $5,000 per person. Facebook previously settled a similar facial tagging case for $650 million, and Instagram resolved a related lawsuit for $68.5 million, making BIPA a powerful legal tool in biometric data litigation.

Currently, plaintiffs must still prove in court that Apple indeed collected data without notice and stored it in the cloud. Compensation is not automatic and will depend on trial outcomes. However, having cleared the class-action certification hurdle, Apple now faces not just financial risk, but a fundamental redefinition of global app privacy boundaries. Moving forward, on-device AI features may need to explicitly include 'face scanning for modeling' in user consent forms.