Coinbase Faces Legal Challenge Over Alleged Biometric Data Misuse

A class-action lawsuit has been filed against cryptocurrency exchange Coinbase in the U.S. District Court for the Northern District of California. The suit alleges that the company violated the Illinois Biometric Information Privacy Act by collecting and storing users’ biometric data without proper consent or disclosure. The plaintiff, Michael Massel, claims that Coinbase’s Know Your Customer procedures involved the collection of facial and fingerprint data without informing users of the specific purposes, storage durations, or data destruction policies, as mandated by BIPA.

The lawsuit contends that Coinbase required users to upload selfies and government-issued identification during the account creation process, which were then used to create detailed facial geometry templates. Additionally, the company allegedly collected fingerprint data through its mobile application for user authentication. The plaintiff asserts that Coinbase failed to provide written notice or obtain explicit consent for the collection and storage of this biometric information, and did not establish publicly available policies regarding data retention and destruction.

The complaint alleges that Coinbase shared users’ biometric data with third-party vendors, including Jumio, Onfido, Au10tix, Solaris AG, and Liquid Co., Ltd., without obtaining proper consent. The plaintiff argues that this dissemination of sensitive information exposes users to significant privacy risks, particularly in the event of a data breach. The lawsuit seeks statutory damages of $5,000 for each intentional violation of BIPA, or $1,000 for each negligent violation, along with attorney fees and other legal costs.