Virtual Try On Tech: The Biometric Privacy Lawsuits Brands Face

Virtual try on tools have become standard on beauty and eyewear sites. You open the camera, the app finds your eyes, lips and cheekbones, and a lipstick shade or a pair of frames appears on your face in real time. It feels like a harmless shopping gadget. In the United States, and above all in Illinois, it has also become one of the most reliable ways for a fashion or beauty brand to end up in a biometric privacy class action. The reason is simple: to place a product on a moving face, the software has to measure that face, and several laws treat a measurement of face geometry as sensitive data that needs notice and consent before it is captured.

Short answer: Virtual try on tools map the geometry of a shopper’s face, which Illinois’s Biometric Information Privacy Act treats as a biometric identifier. Brands that capture it without written notice, a public retention policy and a signed release face class actions with damages of $1,000 or $5,000 per person. Texas and Washington have their own rules, and in the EU and UK the GDPR applies.

Key takeaways

• Illinois BIPA (740 ILCS 14) lets any person aggrieved sue for $1,000 per negligent violation or $5,000 per intentional or reckless one, and face geometry is expressly covered.
• The 2024 amendment (SB 2979) means repeated scans of the same person by the same method count as one violation, and the Seventh Circuit held in April 2026 that this applies to pending cases.
• Courts have split on eyewear: Dior won dismissal in 2023 under the health care exemption, but in July 2026 the Seventh Circuit called Gunnar’s try-on tool “aesthetic, not medical” and revived the claim against it.
• Under the EU and UK GDPR, face data used only to place a product, not to identify someone, is not automatically special category data, but skin analysis that infers health can be.

How does virtual try on use your face?

Most try-on tools work in the same basic way. The camera feed is analysed frame by frame, the software locates landmarks such as the corners of the eyes, the bridge of the nose and the outline of the lips, and it builds a map of their positions so that a virtual product can be anchored to them as the head moves. Shade finders and “skin analysis” features go further and assess tone, texture or visible concerns.

That is why plaintiffs describe these features as face scans. In the Gunnar Optiks appeal, the Seventh Circuit described a tool that used the device camera to scan the user’s face and sent data to the company so it could show how the glasses would look. Whether the data is stored, for how long and whether it leaves the phone are the facts that decide most of these cases. For the wider picture of biometrics in shops, see FLJ’s guide to biometric data technology in fashion retail.

FLJ Insider Pro is open: live fashion law jobs and internships, five career guides and two roadmaps. Early bird USD 12/month. See what's inside

Why is Illinois BIPA the law brands fear most?

The Biometric Information Privacy Act, 740 ILCS 14, covers a “scan of hand or face geometry” as a biometric identifier, and it gives private individuals the right to sue. Section 15 sets five core duties for any private entity. It must publish a written retention and destruction policy and delete the data when the purpose is satisfied or within three years of the person’s last interaction, whichever comes first. Before collecting, it must tell the person in writing that biometric data is being collected, explain the specific purpose and how long it will be kept, and obtain a written release. It may not sell, lease, trade or otherwise profit from the data, may not disclose it except in narrow cases, and must protect it with reasonable care.

The damages are what make BIPA dangerous. Section 20 allows liquidated damages of $1,000 for each negligent violation and $5,000 for each intentional or reckless violation, or actual damages if higher, plus attorneys’ fees and costs. Multiply that by every Illinois shopper who opened a try-on feature and the exposure can dwarf the revenue the tool ever generated. FLJ’s analysis of biometric surveillance and data protection in fashion retail explains why Illinois became the centre of this litigation.

What did the 2024 BIPA amendment change?

In 2023 the Illinois Supreme Court held in Cothron v. White Castle that a BIPA claim accrues with each scan or transmission, not once per person, and invited the legislature to look again at damages. The legislature responded with SB 2979, which Governor JB Pritzker signed on 2 August 2024 and which took effect immediately. It provides that a private entity that collects the same biometric identifier from the same person using the same method of collection has committed a single violation, and the person is entitled to, at most, one recovery. It also added electronic signatures to the definition of a written release, so a properly designed click-through consent now counts.

For a while it was unclear whether the change helped defendants in cases already filed. In April 2026, in Clay v. Union Pacific Railroad, the Seventh Circuit held that the amendment applies retroactively because it changed the remedy rather than the underlying duty. For try-on tools that is a significant shift: a shopper who used the feature 40 times is now one claim, not 40. A large Illinois user base still means large exposure.

Which virtual try on lawsuits have brands faced?

The cases below, drawn from court opinions, settlement notices and law firm reports of the rulings, show the range of outcomes.

The Amazon case is the clearest warning for large retailers. According to a Duane Morris summary of the ruling, the class covers people who used the feature on Amazon’s mobile site or app while in Illinois on or after 7 September 2016, and the Seventh Circuit rejected Amazon’s argument that proving each user’s location would swamp the common questions. The Charlotte Tilbury settlement covers Illinois users of tools such as “Charlotte’s Virtual Try On” and “Foundation Shade Finder” between 1 December 2019 and 31 August 2023.

Does the health care exemption protect eyewear brands?

BIPA excludes information collected, used or stored for health care treatment, payment or operations under HIPAA. Eyewear sellers have argued that glasses, and even sunglasses, are medical devices, so a tool that helps people choose them falls within the exclusion. That argument won for Dior in 2023. It has since lost ground.

In Clements v. Gunnar Optiks, Judge Frank Easterbrook, writing for the Seventh Circuit, focused on the words “for” and “treatment”. The court wrote that “the ‘virtual try on’ service that Gunnar offered seems to be aesthetic, not medical”, and gave the example of $5 sunglasses bought at a drug store to ease eye strain, which could not be medical treatment. It also suggested the exemption may only cover entities that actually comply with HIPAA. It held only that the defence could not be resolved on the pleadings. For eyewear brands, the safe reading is that a try-on tool for frames is a styling feature, and it should carry BIPA-grade consent. FLJ has looked at similar questions for smart glasses that capture faces.

What about Texas, Washington and other US states?

Texas’s Capture or Use of Biometric Identifier Act, section 503.001 of the Business and Commerce Code, covers a “record of hand or face geometry”. A person may not capture a biometric identifier for a commercial purpose unless it informs the individual beforehand and receives consent. The identifier must be destroyed within a reasonable time and no later than one year after the purpose expires. There is no private right of action: the attorney general enforces it, with a civil penalty of up to $25,000 for each violation. That figure is not theoretical. On 30 July 2024 the Texas attorney general announced a $1.4 billion settlement with Meta, payable over five years, over facial recognition run on photos without consent.

Washington has two relevant laws. RCW 19.375 bars enrolling a biometric identifier in a database for a commercial purpose without notice and consent or a way to prevent later commercial use. It is narrower than BIPA: the identifier must be used to identify a specific individual, photographs and data generated from them are excluded, and only the attorney general can enforce it. The broader risk is the My Health My Data Act, RCW 19.373. It lists biometric data, including face imagery from which an identifier template can be extracted, as consumer health data, and violations are treated as unfair or deceptive acts under the state Consumer Protection Act, the route through which consumers as well as the attorney general bring claims. Skin analysis sits closer to this law than a lipstick overlay.

How do the EU and UK GDPR treat virtual try on?

Under Article 4(14) of the GDPR, biometric data is personal data from specific technical processing of physical characteristics that allows or confirms the unique identification of a person. Article 9 then prohibits processing biometric data “for the purpose of uniquely identifying a natural person” unless a condition applies, most often explicit consent. The purpose matters. The UK regulator’s biometric guidance says biometric data only becomes special category data if you use it to uniquely identify someone. A try-on tool that maps a face only to place a product, without recognising who the person is, is still processing personal data, but may not fall within Article 9.

The ICO adds a warning: biometric data can still be special category data if it is used to infer sensitive traits such as health or racial or ethnic origin, which matters for skin analysis and shade-matching tools. Brands selling into Europe should run a data protection impact assessment for camera features, process on the device where possible and avoid keeping images. FLJ’s piece on personal data, AI and privacy in digital fashion covers the wider GDPR duties.

How can brands offer virtual try on without being sued?

The technology is rarely the problem; switching on a camera feature without the required paperwork is. A practical plan:

• Map the data flow with your vendor: what is measured, whether it leaves the device and how long it is kept.
• Publish a biometric retention and destruction policy that meets BIPA section 15(a), and follow it.
• Show a clear notice before the camera opens, stating the purpose and retention period, and collect an affirmative electronic consent that you can later prove.
• Geolocate or gate the feature if you cannot obtain BIPA-grade consent from Illinois users.
• Do not sell, share or reuse face data for advertising or model training, and put that ban in the vendor contract with an indemnity.
• Treat skin analysis and shade-finding as higher risk under Washington’s health data law and the GDPR.

A brand that also uses scanned bodies or avatars should read FLJ’s analysis of whether body shape can become a commercial asset, and the lessons from the Dior data breach on what happens when stored customer data leaks.

This article is general information, not legal advice.

Frequently asked questions

Is virtual try on legal?

Yes. The technology is legal, but in Illinois a brand must give written notice, publish a retention policy and get a written or electronic release before capturing face geometry. Texas requires notice and consent before capture, and the GDPR applies to European shoppers.

Does virtual try on collect biometric data?

Usually it measures face geometry to anchor the product to your face. Illinois treats a scan of face geometry as a biometric identifier. Under the GDPR it is special category data only when used to uniquely identify you or to infer sensitive traits such as health.

How much can you get from a BIPA virtual try on lawsuit?

BIPA allows $1,000 per negligent violation or $5,000 per intentional or reckless violation, or actual damages if higher. After the 2024 amendment, repeated scans of the same person by the same method count as one violation. Settlements often pay far less per person.

Did Charlotte Tilbury settle a virtual try on lawsuit?

Yes. In Halim v. Charlotte Tilbury Beauty, a $2,925,000 class settlement covered people who used its try-on and shade tools in Illinois between December 2019 and August 2023. The company denies that it violated BIPA.

Are eyewear try-on tools exempt from BIPA?

Not reliably. Dior won dismissal in 2023 under the health care exemption, but in July 2026 the Seventh Circuit called Gunnar’s tool “aesthetic, not medical” and revived the case. Eyewear brands should obtain BIPA consent rather than rely on the exemption.

Can Texas residents sue over virtual try on?

Not directly under the biometric statute. Texas’s law is enforced only by the attorney general, with penalties of up to $25,000 per violation. Washington’s health data law, by contrast, can be enforced through its Consumer Protection Act.