A group of users has filed a class action lawsuit against Coinbase, claiming that its identity verification checks violate the state’s biometric privacy law.
According to plaintiffs Scott Bernstein, Gina Greeder, and James Lonergan in the lawsuit filed on May 13 in a federal court, Coinbase’s “indiscriminate collection” of facial biometric data for Know Your Customer (KYC) requirements breaches Illinois’ Biometric Information Privacy Act (BIPA).
The group argued that the exchange failed to notify users in writing about the collection, storage, or sharing of their biometric data, as well as the purpose and retention schedule for such data. “Coinbase does not publicly provide a retention schedule or guidelines for permanently destroying Plaintiffs’ biometric identifiers as specified by BIPA,” they alleged.
The complaint claims that Coinbase requires users to verify their identity by uploading a government-issued ID and a selfie, which is then sent to third-party facial recognition software to scan and extract facial geometry. This process captures biometric identifiers without the users’ informed written consent, thus violating BIPA, according to the lawsuit.
Additionally, the group alleged that Coinbase unlawfully shared biometric data with third-party verification providers such as Jumio, Onfido, Au10tix, and Solaris without users’ consent. “Coinbase ‘obtains’ biometric data in violation of [BIPA] because it explicitly directed the Third Party Verification Providers to use its software to verify and authenticate users, including Plaintiffs, and its software does so by collecting biometric data,” the complaint read.
The group also stated that over 10,000 individuals have filed arbitration demands on these issues with the American Arbitration Association, but Coinbase allegedly refused to pay the required arbitration fees, causing the claims to be dismissed.
Legal demands
The lawsuit brings three counts of biometric privacy law violations and one count of consumer fraud under the Illinois Consumer Fraud and Deceptive Business Practices Act. The group seeks $5,000 for each intentional or reckless violation, $1,000 for each negligent violation, along with injunctive relief and litigation costs.
Coinbase was also recently hit by at least six lawsuits following the May 15 disclosure that some of its customer support agents were allegedly bribed to leak user data.
