Coinbase Faces $5,000 Fines Per Violation In Illinois Biometric Privacy Lawsuit

Coinbase Global Inc. is facing a lawsuit in Illinois for allegedly violating the state’s Biometric Information Privacy Act (BIPA). The complaint, filed on May 13, 2025, accuses the cryptocurrency exchange of collecting facial scans from users without proper consent during the Know Your Customer (KYC) process. The plaintiffs, Scott Bernstein, Gina Greeder, and James Lonergan, argue that Coinbase’s actions violate Illinois’ strict biometric privacy laws, which could result in significant fines for the company.

The lawsuit specifically targets Coinbase’s identity verification process, which involves facial biometric scans. According to the court documents, Coinbase did not obtain the required written consent from users before collecting, storing, sharing, and retaining their biometric data. The plaintiffs contend that the lack of transparency in handling this data poses a significant risk to user privacy and contravenes Illinois’ biometric privacy laws.

The legal action outlines three instances where Coinbase allegedly violated BIPA rules by failing to inform users or obtain their permission before collecting biometric information. The plaintiffs also claim that Coinbase’s behavior constitutes misleading practices under the Illinois Consumer Fraud and Deceptive Business Practices Act. If the plaintiffs succeed in their claims, Coinbase could face fines of $5,000 for each intentional violation and $1,000 for each negligent violation, potentially amounting to millions of dollars.

Court documents reveal that Coinbase shares biometric information with third-party companies such as Jumio, Onfido, and Au10tix for customer identity verification. The plaintiffs argue that this sharing of information without proper notice further violates BIPA’s strict regulations. The lawsuit emphasizes that Illinois law mandates companies to have specific policies regarding the use of biometric data, which Coinbase allegedly failed to provide.

This case highlights the increasing scrutiny on biometric data usage in the tech and crypto industries. Illinois’ BIPA is considered one of the strongest privacy laws in the country, requiring companies to obtain permission before recording fingerprints or facial scans. Previous high-profile cases against companies like Facebook and Google have resulted in substantial settlements, setting a precedent for the potential consequences Coinbase may face.

Coinbase is already dealing with other legal issues, including a data breach incident in India where customer support agents leaked users’ information. This incident led to six additional lawsuits, further questioning Coinbase’s data protection measures and cybersecurity efforts. The biometric privacy case adds to the legal challenges Coinbase is facing, raising concerns about how the company handles customer information.

The lawsuit also underscores broader privacy issues in the cryptocurrency world. As regulations tighten, more exchanges like Coinbase are implementing KYC processes and requesting sensitive information, including biometrics. The plaintiffs argue that these practices must comply with stringent state privacy laws, such as those in Illinois. Although Coinbase has not publicly commented on the biometric privacy complaint, the United States Securities and Exchange Commission (SEC) agreed to dismiss an enforcement proceeding against the company in February 2025, subject to Coinbase’s approval. That case, which alleged that Coinbase operated an unregulated securities trading platform, was seen as a significant victory for the crypto industry. However, the biometric privacy lawsuit presents a unique challenge, as BIPA fines could be financially burdensome and damage Coinbase’s reputation among privacy-conscious users.

The outcome of this lawsuit could set a precedent for other cryptocurrency platforms that handle biometric data. With thousands of arbitration cases potentially influencing the decision, the stakes are high for Coinbase and the broader crypto sector. As more details about the case emerge, the discussion around the regulation and privacy of digital assets is likely to intensify.