Anthropic: BIPA Class Action Over Facial Scan for AI Chatbot

A Chicago resident cites violations of an Illinois privacy law requiring written disclosure of how biometric data will be used and stored. Pages from the Anthropic website and the company's logos are displayed on a computer screen in New York on Thursday, Feb. 26, 2026. (AP Photo/Patrick Sison) SAN FRANCISCO (CN) — An artificial intelligence user filed a class action against one of the world’s largest AI companies Wednesday, saying the company’s policy of retaining a biometric scan of the user’s face violates privacy laws. Jose Enrique Ortiz Colon, a Chicago resident, filed the class action in San Francisco County Superior Court on behalf of himself and others against San Francisco-based Anthropic. Colon says Anthropic’s requirements for continued use of its chatbot, Claude, include submitting a copy of government-issued ID and a “live image” of the user’s face for identity verification, violating an Illinois privacy law. “Anthropic used that process to have his face geometry scanned and matched against his license,” Colon says in his 15-page complaint . “Upon information and belief, Anthropic never told him in writing, before the scan, how long his biometric data would be kept. And while Anthropic held that data, it had no public policy stating when the data would be permanently destroyed.” Colon says Anthropic violated the Illinois Biometric Information Privacy Act because it didn’t disclose in writing how it would use, store and retain the data before collection, and it didn’t provide a written release of consent to use it. The Illinois Biometric Information Privacy Act also requires Anthropic or its verification vendor, Persona Identities Inc., to publicly disclose a data retention schedule and permanent destruction guidelines. “Anthropic made every decision that mattered,” Colon says. “It required plaintiff to verify. It chose Persona as the vendor. It set the purposes for which the resulting data would be used and how long they would be kept. What it did not do was give plaintiff the written disclosures [the law] requires before a scan.” The proposed class would include Illinois residents who submitted a facial scan and government-issued ID for the Claude verification process up to five years before the class action filing date and until the class is certified. Colon says the potential class members are “sufficiently numerous.” Colon seeks relief from two counts of violations of the Illinois Biometric Information Privacy Act, including $1,000 or more for negligent violations, or $5,000 or more for intentional or reckless violations for himself and each class member, along with attorney fees and costs, and for Anthropic to publicly disclose information regarding collection, retention, storage and destruction of users’ biometric data in writing. “We take the privacy of our users seriously,” an Anthropic spokesperson said in a statement to Courthouse News. “We’re aware of the complaint and are reviewing it.” Attorneys representing the plaintiff did not immediately respond to a request for comment. Our weekly newsletter Closing Arguments offers the latest about ongoing trials, major litigation and rulings in courthouses around the U.S. and the world, while the monthly Under the Lights dishes the legal dirt from Hollywood, sports, Big Tech and the arts.

This class action highlights significant compliance risks under the Illinois Biometric Information Privacy Act (BIPA) for AI companies and any entity using biometric verification. Lawyers and compliance officers should review their client's or organization's procedures for collecting, storing, and destroying biometric data, ensuring explicit written disclosures and consent are obtained *before* collection, and that clear data retention policies are publicly available, especially if operating in Illinois or using third-party verification vendors.

Source: Original reporting via Courthouse News Service