"It's Healthcare" Won't Save Your Face Scan Anymore

When you use one of those virtual try-on tools to see how a pair of glasses looks on your face — the app is scanning the exact geometry of your face. And a company just tried to argue that because those glasses can be prescription, they didn't need your permission to do it. A federal appeals court just said — no, that's not how this works.

If you've ever clicked "try it on" while shopping

If you've ever clicked "try it on" while shopping online, this is about you. That little preview isn't just a photo filter. It can measure the shape of your face and store it. And a lot of people assume that if a product is health-related, the company gets a free pass on privacy rules. This ruling blows a hole right through that assumption. So why did calling something a "health product" stop being enough?

Let's start with the law at the center of this. Illinois has the strongest biometric privacy law in the country. It's called BIPA. In plain terms, it says a company can't collect your face scan or fingerprint without telling you first and getting your written okay. But the law has a carve-out for healthcare. And that carve-out is exactly what the eyewear company leaned on.

Here's where they got it wrong. That healthcare exception isn't one broad shield — it's two very narrow doors. Door number one is about location. The data has to be taken from someone who's actually waiting for or receiving medical care. Someone in a clinic. In a real medical moment. Someone shopping for glasses on a website at midnight? They're not receiving medical care. They're shopping. Door number two is about purpose — the data has to be used for defined medical reasons like treatment or billing. Not for showing you how frames look on your nose.

Why do so many people believe "healthcare equals

Now, why do so many people believe "healthcare equals exempt"? It's not a silly assumption. The healthcare industry lobbied for these exceptions for good reasons — hospitals shouldn't need a signed form every time they scan a patient's fingerprint for their medical record. So the public naturally started treating "health" as a magic word. The court made a point of saying it is not. This ruling doesn't exempt the whole healthcare industry. It just refuses to let a label do the work that facts are supposed to do.

And that's the real shift here. The court said you can't just claim the exemption at the start of a lawsuit and walk away. You have to prove it — with evidence about what you actually did with the data. For a company, that means the difference between "for prescription glasses" and "for fun sunglasses" now matters in court. For the rest of us, it means a company can't hide behind the word "health" to skip asking your permission.

Why does any of this carry such weight? Because in Illinois, damages are counted per violation. These cases have settled for hundreds of millions of dollars — hitting both tech giants and small employers. One misjudgment about an exemption can cost more than an entire legal department.