Coinbase is under legal scrutiny as a group of Illinois users filed a class-action lawsuit on May 13, alleging the cryptocurrency exchange violated the state’s Biometric Information Privacy Act (BIPA). The plaintiffs—Scott Bernstein, Gina Greeder, and James Lonergan—claim that Coinbase collected and shared users’ facial biometric data without obtaining informed written consent, as mandated by BIPA.
The lawsuit centers on Coinbase’s Know Your Customer (KYC) procedures, which require users to upload a government-issued photo ID and a selfie. These images are processed by third-party facial recognition software to extract facial geometry. The plaintiffs allege that Coinbase failed to inform users about the collection, storage, sharing, and retention schedule of their biometric data.
Furthermore, the complaint asserts that Coinbase shared this biometric data with third-party verification vendors, including Jumio, Onfido, Au10tix, and Solaris, without users’ consent. The plaintiffs argue that Coinbase directed these vendors to use facial recognition software for user verification, thereby collecting biometric data in violation of BIPA.
The plaintiffs also highlight that Coinbase does not publicly provide a retention schedule or guidelines for permanently destroying biometric identifiers, as specified by BIPA.
In addition to the BIPA violations, the lawsuit includes a claim under the Illinois Consumer Fraud and Deceptive Business Practices Act. The plaintiffs are seeking statutory damages of $5,000 per willful or reckless violation and $1,000 per negligent violation, along with injunctive relief and litigation costs.
This legal action follows a previous attempt by the plaintiffs to resolve the matter through arbitration. According to the complaint, over 10,000 individuals filed demands for arbitration with the American Arbitration Association (AAA), which were dismissed after Coinbase allegedly refused to pay the required arbitration fees.
Coinbase has yet to respond publicly to the allegations. The case underscores the growing legal challenges faced by companies handling biometric data, particularly under stringent state laws like Illinois’ BIPA.