Your Face Got Scanned 2,600 Times. A Court Just Said That's One Violation.
Your Face Got Scanned 2,600 Times. A Court Just Said That's One Violation.
This episode is based on our article:
Read the full article →Your Face Got Scanned 2,600 Times. A Court Just Said That's One Violation.
Full Episode Transcript
Picture this. You clock in at work every morning by scanning your fingerprint. You do it twice a day for five years. That's about twenty-six hundred scans of your body. And a federal court just decided that all of those scans count as one single violation of your privacy.
If your job has ever asked you to press your finger
If your job has ever asked you to press your finger to a reader — or look into a camera to unlock a door — this story is about you. Illinois has the toughest biometric privacy law in the country. It's called BIPA. For years, the big question was simple. If a company scans your face or fingerprint without asking, how much do they owe you? Every single scan? Or just once? The answer used to threaten to bankrupt entire companies. Now the math has completely changed.
Back in 2023, Illinois courts held that a violation happened with every single scan. Every finger press. Every face capture. Under that reading, one employee scanned twice a day for five years could claim damages topping two and a half million dollars. Now stretch that across a thousand workers. You're looking at more than two billion dollars a year — for one company. Judges even had a name for it. They called it "annihilative liability." Liability so large it could wipe a business off the map. That number scared lawmakers. So in 2024, Illinois changed the law. The legislature said repeated scans of the same person, using the same method, count as a single violation. One recovery. Not thousands. Then came the case that locked it in. It's called Clay versus Union Pacific. The subject in front of the Seventh Circuit was whether that new rule applied backward — to cases already filed. The court said yes. Fully retroactive. So for the everyday worker, this means the paycheck-sized payout for a privacy slip just shrank dramatically. For the company, it means one mistake no longer ends the business. And you can see it in the numbers. According to legal trackers, these class action filings dropped from over four hundred in 2024 to around a hundred and fifty in 2025. Settlement totals fell too — from more than two hundred million dollars down to about a hundred and thirty-six million. The flood slowed to a trickle almost overnight.
The Bottom Line
But here's what didn't change. The rules still say a company must ask before scanning you. They still must tell you. They still must delete the data properly. The court shrank the punishment. It didn't remove the protection. Companies can no longer face financial extinction for one mistake — but they can't skip your consent either.
So the short version. A federal court decided that scanning your body thousands of times counts as one violation, not thousands. That saved companies from billions in payouts. But your right to say yes before they scan you is still standing. Your fingerprint at the gym. Your face at the office door. That data is becoming as normal as a password. This ruling just made the consequences for misusing it far more predictable — for them, and for you. The full breakdown's in the show notes if you want the deep dive.
Ready for forensic-grade facial comparison?
Full forensic reports with detailed similarity scoring. Results in seconds.
Run My First SearchMore Episodes
That "Prove You're 18" Pop-Up Is About to Be Everywhere — And Fakes Are Coming for Your Kid's ID
A major identity verification company left its login credentials sitting exposed online for over a year. In that time, anyone who found them could reach names, birthdates, national ID numbers — and photos of people's actu
PodcastThat Annoying "Verify Again" Text? It's Catching Fraudsters Using Real ID Numbers
Researchers at deepidv looked at four million fake identities. Nearly a quarter of them used a real government I.D. number — a legitimate number, pulled from a real record — paired with completely invented personal details. <break time="0.5s"
PodcastYour Face Is Forever. A Judge Just Ruled Companies Can't Hide What They Did With It.
A judge just ordered a company to hand over its deletion logs. Not its marketing. Not its emails. The quiet, boring records that show exactly when it erased people's faces from its systems. And that o
