Crypto exchange Coinbase is facing a proposed class-action lawsuit alleging that it violated Illinois’ Biometric Information Privacy Act (BIPA) by collecting and storing customers’ fingerprints and facial templates without proper permission.
The lawsuit contends that Coinbase’s mandate for customers to provide valid IDs and self-portraits for conducting Know Your Customer (KYC) protocols violate BIPA provisions. It also asserts that the exchange neglected appraising users of the data’s purpose, storage length, and disposal methods.
Allegations against Coinbase’s KYC protocols
The legal complaint, filed by a Coinbase user in a California District Court on May 1, claims that the exchange uses the photos to create a biometric model of a user’s face, amassing “highly detailed geometric maps of the face” and fingerprints of thousands of Illinois inhabitants, which were unlawfully hoarded and stashed by the company.
The lawsuit also alleges that Coinbase’s mobile app requires biometric verification, such as fingerprint or facial recognition, to authenticate the user’s account access.
Grave privacy risks for Coinbase users, lawsuit warns
The case maintains that Coinbase’s “collection, acquisition, storage, and use” of such information is “illegal” and exposes users to “grave and irrevocable privacy risks.”
“If Coinbase’s database containing facial geometry scans or other sensitive, proprietary biometric data is hacked, breached, or otherwise exposed, Coinbase users have no means to prevent identity theft.”
Under BIPA, firms must obtain user approval when collecting their biometrics and furnish details on the data’s purpose, storage duration, and disposal methods.
The lawsuit alleges that Coinbase failed to produce a written policy outlining a retention schedule and criteria for permanently disposing of biometric data.
The lawsuit seeks $5,000 in damages for each intentional BIPA violation, or $1,000 if the alleged violations were not deliberate, as well as the payment of legal fees and court costs for the class action.
Coinbase’s shares are trading at just over $50 per share, having risen almost 50% this year. The exchange has yet to comment on the legal action. However, the case highlights the ongoing concerns around biometric data privacy and the need for companies to comply with relevant laws and regulations.
