"Better-Appearing Glasses Are Not Medical Treatment": The 4 Words That Just Changed Your Face-Scan Rights

Try on a pair of glasses online, the kind where you point your camera at your face and watch the frames appear? A federal court just ruled that a company doing exactly that can be sued for scanning your face without permission. And the reason why comes down to four words a judge wrote: "better-appearing glasses are not medical treatment."

Why should that matter to you

Now, why should that matter to you? Because millions of us assume that anything touching health, vision, glasses, a doctor's office, comes with automatic privacy protection. If you've ever used a virtual try-on tool, or shopped for frames online, this ruling is about your face and who's allowed to keep a map of it. The company argued it was basically a healthcare business, so the strictest biometric privacy law in the country shouldn't apply. The court disagreed, and the logic behind that "no" is worth understanding. So how does a law decide when your face is protected and when it isn't?

Let's start with the law itself. Illinois has something called BIPA, the Biometric Information Privacy Act. In plain terms, it says a company can't scan your face, your fingerprint, or your iris without telling you first and getting your written okay. But the law has an exception carved out for healthcare. And that's where people get confused.

The company in this case was Gunnar Optiks, an eyewear maker with a virtual try-on feature. Their argument sounds reasonable: glasses help you see, seeing is health, so we're covered by the healthcare exemption. It's an easy assumption to make, because we all lump eyewear in with vision care.

But Judge Frank Easterbrook drew a sharp line. The virtual try-on wasn't treating anyone's eyes. It was helping people see how they'd look in the frames. That's aesthetic, about appearance, not medical. As he put it, better-appearing glasses aren't medical treatment.

Here's the correction that reframes everything

So here's the correction that reframes everything. The exemption isn't about what industry you're in. It's about the purpose behind the scan. People conflate the setting, an eyewear store, a health-adjacent product, with the actual reason the data's being collected. The court looked past the setting and asked one question: what is this face scan actually being used for?

Think of it like airport security. Walking into the terminal doesn't get you waved through the checkpoint. You still have to be an actual traveler following the rules. Wandering in to browse the shops doesn't count. Same with the healthcare exemption, being near healthcare isn't enough.

And there's a second requirement with real teeth. The court said to qualify, the company must actually comply with HIPAA, the federal health privacy law with strict rules on handling your data. You don't get the exemption just by being health-adjacent. You have to meet the tough standard that comes with it. For a regular shopper, that means a company can't hide behind a vague health label to avoid asking your permission.

And this isn't just an Illinois problem anymore. As of 2026, roughly twenty states have privacy laws touching biometric data, with Indiana, Kentucky, and Rhode Island among the newest. So wherever you live, this question of purpose versus setting is spreading.