Coinbase is facing a class-action lawsuit from a group of Illinois users who allege the crypto exchange violated the state’s biometric privacy laws by failing to inform them about the collection, storage, sharing, and retention of their biometric data.
Plaintiffs Scott Bernstein, Gina Greeder, and James Lonergan filed the lawsuit on May 13 in federal court, accusing Coinbase of violating Illinois’ Biometric Information Privacy Act (BIPA). They claim that the exchange’s “wholesale collection” of facial recognition data as part of its Know Your Customer (KYC) protocols was conducted without proper user notification.
The lawsuit asserts that Coinbase did not provide written notice regarding the collection, use, or retention of users’ biometric data, nor did it specify the data’s purpose or its scheduled retention and destruction. Coinbase does not publicly provide a retention schedule or guidelines for permanently destroying Plaintiffs’ biometric identifiers as specified by BIPA, the plaintiffs stated.
According to the complaint, Coinbase requires users to verify their identities by uploading a government-issued photo ID and a selfie. This biometric data is processed by third-party facial recognition software to extract and analyze facial geometry—allegedly without the users’ informed written consent.
The suit further alleges that Coinbase unlawfully shared this data with third-party verification providers, including Jumio, Onfido, Au10tix, and Solaris, again without user consent.
“Coinbase ‘obtains’ biometric data in violation of [BIPA] because it explicitly directed the Third Party Verification Providers to use its software to verify and authenticate users, including Plaintiffs, and its software does so by collecting biometric data,” the complaint stated.
The plaintiffs also allege that over 10,000 individuals filed arbitration demands related to these privacy concerns with the American Arbitration Association. Coinbase allegedly refused to pay the arbitration fees, leading to the dismissal of those claims.
The lawsuit brings forward three counts of BIPA violations and one count of consumer fraud under the Illinois Consumer Fraud and Deceptive Business Practices Act. The plaintiffs are seeking:
- $5,000 for each willful or reckless violation
- $1,000 for each negligent violation
- Injunctive relief and coverage of legal costs
Coinbase is also reportedly facing at least six additional lawsuits tied to a May 15 disclosure involving bribed customer support agents who leaked user data.
This isn’t the first time Coinbase has faced legal scrutiny under BIPA. In May 2023, a similar suit was filed. However, that case was paused and ultimately dismissed without prejudice on February 3, 2024, after both parties agreed to resolve the matter through arbitration.
