Your Face, Their Loophole: Court Just Killed the "It's Healthcare" Excuse

The exact same face scan can be perfectly legal in one room and against the law in the room next door. Not because the technology changed. Because of where you were standing when it happened.

If you've ever tried on glasses using one of those

If you've ever tried on glasses using one of those virtual try-on tools online — you point your camera at your face, and the app shows you how the frames look — this story is about you. A company called Gunnar Optiks used a tool like that. When customers sued under Illinois biometric privacy law, the company had a defense ready. They said, our product is health-related. It's eyewear. So we're exempt. The Seventh Circuit court just said no. And the reason why teaches you something surprising about how privacy law actually works.

Let's start with the law itself. Illinois has something called BIPA — the Biometric Information Privacy Act. According to the A.C.L.U. of Illinois, it's the only law in the country that lets you personally sue a company for scanning your face or fingerprints without your permission. That's a big deal. Since 2008, that law has produced billions of dollars in settlements. Google alone paid a hundred million dollars to settle one Illinois face-scanning case.

Now, the law has an exception for healthcare. And that's the door Gunnar tried to walk through. The exception has two parts. Part one covers data captured from a patient in a healthcare setting. Part two covers data used for medical treatment or billing under federal health privacy rules. The company argued its eyewear scanning fit inside that exception.

The court asked two simple questions

The court asked two simple questions. Is a shopping app a healthcare setting? And is a customer browsing sunglasses actually a patient? An earlier Illinois court had already answered the first one. An online store is not a clinic. And in a separate case against a skincare company, a court ruled that shoppers weren't patients at all — because a patient is someone waiting for or receiving care from a medical professional. A person clicking through frames online is neither.

Here's the food analogy that makes this click. A restaurant can't dodge food safety rules just by calling its meals healthy. A pharmacy filling prescriptions follows one set of rules. A grocery store selling packaged snacks follows another. Same food, different rules — depending on who's handling it and why. Face scanning works the same way. Same measurement. Completely different law depending on the setting.

So why does everyone get this wrong? Because the word "health" feels like a magic shield. It seems obvious that a health-related product would fall under a healthcare exception. Most of us assume these exemptions are broad and based on purpose. But the court demanded proof on three separate fronts. Was this an actual healthcare setting? Was this person a legal patient? And was the data used for real medical treatment? A sunglasses app fails all three. For a company handling your face data, that means saying "it's healthy" isn't a defense — it's a claim they have to prove. For you, it means the health label on an app doesn't strip away your privacy rights.