Fans Sue Chicago Cubs Over Alleged Facial Recognition Data Collection

Case Overview: Class action claims the Chicago Cubs violated Illinois’ BIPA by using facial recognition systems at Wrigley Field without fan consent.

Consumers Affected: Individuals who attended Chicago Cubs games where facial recognition systems allegedly scanned or stored their biometric data.

Court: U.S. District Court for the Northern District of Illinois, Eastern Division

When fans walk through the gates at Wrigley Field, few imagine their faces might be recorded, analyzed, and stored. A new class action lawsuit claims that is exactly what happened during Chicago Cubs home games.

Plaintiff Gabriel Berta says the Cubs and two security contractors used facial recognition systems at the stadium to identify spectators without their knowledge or consent. The complaint, filed in Illinois federal court, accuses the team of violating the state’s Biometric Information Privacy Act, known as BIPA.

According to the filing, the Cubs hired Blue Star Security and Protos Security to operate surveillance systems that relied on facial scanning software. The technology allegedly converted fans’ facial features into digital templates that could be used for identification or tracking purposes.

Berta claims that by doing so, the team collected biometric identifiers from thousands of fans who never agreed to the practice.

“Once biometric data is compromised, there is no way to change it,” the complaint states. “Individuals are left exposed to identity theft and loss of privacy.”

No Written Notice or Consent, Lawsuit Says

Illinois law requires companies to obtain written permission before collecting biometric data and to explain how that data will be stored, used, and destroyed. Berta’s lawsuit argues that the Cubs failed on all counts.

The complaint says no signs, disclosures, or consent forms were presented to fans at Wrigley Field, even though facial recognition systems were allegedly operating near entrances and security checkpoints. It also claims the team never published a policy explaining how long the biometric data would be retained or when it would be deleted.

According to Berta, this lack of notice violated both the letter and spirit of Illinois’ privacy law. He says the team’s data collection was conducted “covertly and without any transparency,” leaving fans unaware their images were being converted into stored biometric profiles.

Illinois’ Biometric Law Requires Written Consent Before Data Collection

Illinois enacted the Biometric Information Privacy Act (BIPA) in 2008 to protect residents from the unauthorized collection and sharing of biometric identifiers such as fingerprints, retina scans, and facial geometry. The law is one of the few in the country that allows individuals to sue for violations directly.

Companies that violate BIPA can face penalties of up to $1,000 per negligent violation and $5,000 for each reckless or intentional violation. Illinois courts have approved substantial settlements in past cases involving workers and consumers whose biometric data was collected without their consent.

Berta’s lawsuit against the Chicago Cubs builds on this framework. It argues that sports franchises should be held to the same standards as private companies when handling sensitive data from fans.

Across the country, stadiums have adopted new technologies to improve safety and manage large crowds. Ticket scanners, surveillance systems, and facial recognition tools are now common at major venues. 

Supporters say these systems can identify banned individuals and prevent ticket fraud, while critics warn that they often operate without transparency and expose attendees to privacy risks they may not fully understand.

Sports Venues Face Growing Scrutiny Over Digital Privacy Practices

Concerns about data privacy in sports extend beyond the Cubs. Major League Baseball’s digital arm, MLB Advanced Media, was recently sued over alleged data breaches tied to its Ballpark app. The lawsuit claims fans lost access to digital tickets and may have had personal information exposed due to weak cybersecurity safeguards.

Both the MLB and Chicago Cubs cases highlight growing scrutiny over how sports organizations collect, store, and use digital data. Fans increasingly rely on mobile apps, facial recognition, and online accounts to enter stadiums, making privacy and consent central issues for modern sports venues.

In her complaint, Berta seeks to represent all individuals whose facial data was allegedly collected or used by the Cubs, Blue Star Security, or Protos Security without written consent. 

She is asking for monetary damages under BIPA, restitution, attorneys’ fees, and a court order requiring the deletion of any remaining facial recognition data.

Case Details

• Lawsuit: Berta v. Blue Star Security LLC, et al.
• Case Number: 1:25-cv-11138
• Court: U.S. District Court for the Northern District of Illinois, Eastern Division

Plaintiffs' Attorney:

• Blake Hunter Yagman (Spiro Harrison & Nelson LLC)

Have you attended a Cubs game at Wrigley Field recently? Would you consent to facial recognition screening at sports venues? Share your thoughts in the comments below.