That "Virtual Try-On" for Glasses? A Court Just Ruled It's Scanning Your Face — Not Your Health

Picture this: you're shopping for glasses online, you click "try on virtually," your camera flips on, and your face gets mapped in seconds. It feels fun, a little futuristic. You pick your frames, check out, and move on. You almost certainly did not think: wait, what just happened to a scan of my face?

A federal court just weighed in on exactly that question — and the answer has real consequences for anyone who's ever tried on glasses, contacts, or eyewear through an app or website. The 7th Circuit Court of Appeals (one step below the Supreme Court, covering Illinois, Indiana, and Wisconsin) revived a class-action lawsuit against an eyewear company, ruling that its virtual try-on feature is "aesthetic, not medical." The company had argued it should be exempt from Illinois' strict biometric privacy law because, hey, glasses are kind of healthcare-adjacent, right? The court's response, more or less: nice try.

First, What Is This Law, and Why Should You Care?

Illinois has a law called BIPA — the Biometric Information Privacy Act. Think of it as a bill of rights for your body data. Biometric data just means the physical stuff that's uniquely you: your face geometry, your iris pattern, your fingerprints, the way you walk. This is different from a password. You can change a password. You cannot change your face.

BIPA says that if a company wants to collect that data from Illinois residents, it has to tell you first, get your written agreement, and follow strict rules about how long it keeps that data and who it shares it with. No sneaking. No vague terms buried on page 12 of a privacy policy that nobody reads.

The law has teeth. Since roughly 2018, more than 2,000 lawsuits have been filed under BIPA — not just against tech giants, but against employers, retailers, and yes, eyewear companies. The cases are accelerating, not slowing down.

There is, however, a carve-out — an exemption — for healthcare. The logic makes sense on its face: if you're at a doctor's office and they're scanning your eye to check for glaucoma, that's a medical situation governed by a whole other set of federal privacy rules (called HIPAA — basically the law that keeps your doctor from posting your medical records on the internet). BIPA essentially says: if HIPAA already covers you, you don't have to comply with us too. This article is part of a series — start with Your Face Was Scanned Saturday Nobody Asked If That Was Lega.

Some companies looked at that exemption and saw a golden ticket.

The "We're Basically Healthcare" Strategy — And Why It Just Failed

The company at the center of this ruling — Gunnar Optiks, known for blue-light-blocking glasses — offered a virtual try-on feature. Customers could use their camera to see how different frames would look on their face. The company argued this was healthcare-related enough to qualify for BIPA's exemption.

The 7th Circuit disagreed, bluntly.

"Better-appearing glasses are not medical treatment." — 7th Circuit Court of Appeals, as reported by Law.com

That one sentence does a lot of work. It draws a clean line between actual medical eye care — where a licensed professional examines your eyes, makes a clinical judgment, and documents it in your medical record — and a shopping tool that lets you preview frames. One is medicine. One is retail with a cool camera trick.

The court also noted something that matters even more for the future: to legitimately claim the healthcare exemption, a company would need to actually comply with HIPAA — the federal healthcare privacy law. You can't just wave your hand and say "we're healthcare" to dodge BIPA. You'd have to walk the walk: formal privacy notices, protected health records, real accountability to the Department of Health and Human Services. Most retail tech companies haven't done any of that. They just liked the sound of "exempt."

This Isn't Just About Glasses

Here's where it gets interesting — and a little uncomfortable. Virtual try-on tools aren't limited to eyewear anymore. Makeup brands, hair color apps, hat retailers, plastic surgery preview tools, hearing aid fitters — dozens of consumer categories now use your face as a fitting room. The same legal question applies to all of them: does the word "health" in the product description automatically protect the company from biometric privacy rules? Based on this ruling, no. Previously in this series: Your Bosss Ai Can Reject You Until 2027 And Nobody Has To Pr.

Legal analysts at Freeman Mathis & Gary noted that even at the Illinois state court level, a prior decision had already drawn this same boundary: the healthcare exclusion under BIPA applies only where "trained and licensed professionals collect biometric identifiers from individuals seeking out medical care." Not an app. Not a website checkout flow. An actual clinical setting with actual licensed professionals.

The trend is clear. Courts are getting more specific, not less. The exemption is narrowing. And any company that planned to rely on being "health-adjacent" to avoid consent requirements is now on notice.

What You Can Actually Do Right Now

Look, nobody expects you to read a 14-page privacy policy before trying on virtual glasses at midnight. But there are three questions worth asking — out loud, or in a quick search — any time an app or website wants access to your face or eyes for something that isn't a doctor's appointment:

Is this data being stored, or is it only processed in the moment? Some tools genuinely process your face locally and never send it anywhere. Others save it to a server. The difference is enormous. If a company can't tell you clearly, that's your answer.

Can this data be shared or sold? Biometric data — your face map, your iris geometry — is valuable. It can train AI systems. It can be licensed. It can end up in places you never imagined when you clicked "try it on." A company serious about privacy will tell you explicitly that your biometric data is never sold or shared with third parties.

Does "healthcare" actually mean anything here? If a company is implying its use of your face data is medical or clinically meaningful, ask who the licensed professionals are and whether the service is covered by federal healthcare privacy law. If the answer is vague, the "healthcare" framing is probably marketing, not legal protection. Up next: Monroe County Biometric Disclosure Retail Facial Recognition.

If you've ever wondered whether a face scan is actually what it claims to be — just a fitting tool, or something more — that's the exact question this kind of law exists to force companies to answer out loud. National Law Review's analysis of BIPA litigation trends makes clear that courts are now expecting those answers to be specific, documented, and given in advance — not buried in terms of service after the scan already happened.

The counterargument is worth acknowledging, briefly: some legal commentators worry that making the healthcare exemption too narrow will scare legitimate eyecare innovators away from useful tools — virtual fitting that reduces returns, improves prescription accuracy, helps people with limited mobility shop from home. Those are real benefits. Nobody's saying face-scanning technology is inherently bad. The question is just: if you want my face data, tell me the truth about what you're doing with it. That should not be a hard ask.

The WilmerHale review of 2024 BIPA litigation describes a clear pattern: courts are moving toward narrower exemptions, higher consent standards, and more scrutiny of companies that claim special status without actually meeting the requirements for it. That trend didn't slow down in 2025. This ruling suggests it's not slowing down in 2026 either.

So the next time a glasses website asks to see your face — and promises it's totally fine because they're in the eyecare business — remember that a federal court just told a glasses company, in writing, that wanting you to look good in frames is not the same thing as medicine. Your face data doesn't stop being yours just because someone is selling you something you put near your eyes.