M.A.C. Cosmetics Sued Over Secret Facial Data Collection

Case Overview: The lawsuit claims M.A.C. Cosmetics collected and stored shoppers’ facial scans without consent, violating Illinois’ BIPA law.

Consumers Affected: Illinois residents who used M.A.C.’s virtual try-on tools or in-store scanners.

Court: U.S. Circuit Court of Cook County, Illinois County Department, Chancery Division

Beauty giant M.A.C. Cosmetics illegally captures and stores customers’ facial scans without their consent, violating privacy laws and consumer trust, a new lawsuit argues. 

The lawsuit alleges the company violated Illinois’ strict Biometric Information Privacy Act (BIPA) by using in-store scanners and online tools to collect detailed facial geometry data when customers tried on virtual makeup.

Shopper Claims Face Scans Were Captured Without Consent

Chicago resident Fiza Javid filed the lawsuit after she said she was scanned multiple times at a M.A.C. store in Schaumburg’s Woodfield Mall. When she tried on lipsticks and other products virtually, the company’s devices allegedly mapped her face, capturing precise data points like the distance between her eyes and the contours of her lips.

Javid also used M.A.C.’s website, which prompted her to upload photos or activate her camera for live virtual try-ons. The lawsuit claims those sessions resulted in the same type of data capture and storage. Javid contends she was never told this was happening and never signed off on it, violations at the heart of the BIPA complaint.

 Virtual Try-On Technology Records Facial Geometry

According to the complaint, M.A.C.’s virtual try-on technology does more than just let shoppers preview lipstick shades. Each time a customer uploaded a selfie, streamed live video, or used an in-store scanner, the system allegedly recorded the unique measurements of their facial features. These scans created detailed “face templates” that M.A.C. then stored and used to superimpose makeup digitally.

The problem, the lawsuit says, is that M.A.C. never asked for written consent or disclosed how long it would keep this biometric data. Under BIPA, companies must inform customers in writing about data collection, explain its purpose and retention, and obtain explicit consent. 

By skipping those steps, the suit argues, M.A.C. denied Illinois consumers the ability to make an informed choice about their biometric privacy.

Facial geometry scans are considered especially sensitive because, unlike passwords or even Social Security numbers, they can’t be changed if compromised. Once biometric data is exposed, the risk of identity theft or misuse is permanent. Illinois lawmakers passed BIPA in 2008 precisely to address those risks, requiring companies to obtain informed consent before collecting or using such data.

The lawsuit argues M.A.C.ignored these rules, prioritizing marketing and sales gains over consumer privacy. By storing face templates, the company allegedly sought to boost sales and reduce product returns, but in doing so, it exposed customers to privacy risks they never agreed to.

Other Companies Face Backlash Over Data Practices

M.A.C. isn’t the only company facing heat for how it handles people’s faces. Dating app Tea is being sued for allegedly forcing users to upload selfies and driver’s license photos, which were then analyzed and stored without consent. 

Haircare brand Living Proof is accused of secretly scanning users’ faces through an online “Hair Quiz.” Photo-sharing site Photobucket has been hit with claims it repurposed billions of uploaded photos to train artificial intelligence tools. 

Even household names like Nestlé, Compass Group, and Krispy Kreme have been pulled into court over alleged misuse of biometric or genetic data.

In her lawsuit, Javid hopes to represent two groups: Illinois customers scanned in M.A.C. stores and those whose facial data was captured through the company’s website. She seeks to stop the company from further collecting or storing biometric data without consent, while also pursuing damages. 

Under BIPA, companies can be forced to pay $1,000 per negligent violation and $5,000 per reckless or intentional one, plus legal fees.

Case Details

• Lawsuit: Javid v. M.A.C. Cosmetics Inc.
• Court: U.S. Circuit Court of Cook County, Illinois County Department, Chancery Division

Plaintiffs' Attorney:

• Keith J. Keogh and Theodore H. Kuyper (Keogh Law, LTD.)
• Karl S. Gwaltney (Maginnis Howard)

Have you ever had your face scanned by M.A.C. while shopping for products? If so, let us know what you think about this lawsuit in the comments below!