Skip to content Skip to navigation

Home Depot Takes Images of Customer Faces BIPA Class Action

Home Depot Store Exterior

Illinois has a fairly simple Biometric Information Privacy Act (BIPA), considering the risks involved in collecting and storing biometrics. Even so, the complaint for this class action alleges that the Home Depot, Inc. did not follow the requirements of BIPA in collecting and storing biometric information—no, not the information of its employees but of its customers. 

Home Depot is a very large retailer, with over 2,200 stores nationwide, seventy-six of them located in Illinois and subject to BIPA. 

The complaint alleges, “Home Depot has augmented its in-store security cameras with software that track[s] individuals’ movements throughout the store using a unique scan of face geometry. Put simply, [Home Depot] surreptitiously attempt[s] to collect the faceprint of every person who appears in front of one of their facial-recognition cameras.”

Home Depot is not open about what it’s doing, the complaint charges, because when reporters ask, it refuses to comment, and because it makes no mention of faceprint collection in the Privacy and Security Statement on its website.

Under BIPA, no private entity is permitted to “collect, capture, purchase, receive through trade, or otherwise obtain” biometric information unless it first does certain things: 

  • It must inform the subject that the identifier or information is being collected or stored; 
  • It must inform the subject in writing of the purpose of collection and the length of time for which the information will be stored or used; and
  • It must receive a written release from the subject to collect and store the information.

BIPA also has rules pertaining to disclosure of the stored biometric information and forbids its sale or lease. 

Also, under BIPA, any private entity that has biometric data must have a written policy “establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within 3 years of the individual’s last interaction with the entity, whichever occurs first.”

The complaint alleges that Home Depot does not comply with these provisions, showing a “wanton disregard for customer privacy[.]”

A class and a subclass have been defined for this action.

The Home Depot Class is all individual whose faceprints were collected or obtained while they were visiting a Home Depot in Illinois.

The Purchaser Subclass is all Home Depot Class members who made a purchase at the Home Depot store after Home Depot had begun its facial-recognition program.

Article Type: 

Free Case Evaluation

Fill out the information for a FREE and prompt case evaluation.

About you

Additional Information

Latest Tweets

Join Us on Facebook