A group of Coinbase users from Illinois have filed a class-action lawsuit against the crypto exchange, alleging that its identity checks violate the state’s Biometric Information Privacy Act (BIPA).

Plaintiffs Scott Bernstein, Gina Greeder and James Lonergan claimed in the May 13 lawsuit filed in a federal court that Coinbase’s “wholesale collection” of faceprints for its Know Your Customer requirements violates BIPA, as they weren’t notified.

The group claimed Coinbase failed to notify users in writing of the collection, storage, or sharing of their biometric data and the purpose and retention schedule for their data.

“Coinbase does not publicly provide a retention schedule or guidelines for permanently destroying Plaintiffs’ biometric identifiers as specified by BIPA,” they alleged. 

The complaint said Coinbase requires users to verify their identity by uploading a government-issued photo ID and a selfie, which is then sent to a third-party facial recognition software to scan and extract facial geometry. 

This process captures biometric identifiers without users’ informed written consent, which the suit claimed violates BIPA.

Coinbase ID verification procedures. Source: CourtListener 

Additionally, the group claimed Coinbase violated the law by sharing biometric data without users’ consent to third-party verification vendors such as Jumio, Onfido, Au10tix and Solaris.

“Coinbase ‘obtains’ biometric data in violation of [BIPA] because it explicitly directed the Third Party Verification Providers to use its software to verify and authenticate users, including Plaintiffs, and its software does so by collecting biometric data,” the complaint read.

The group claimed that more than 10,000 individuals have filed demands for arbitration over these issues with the American Arbitration Association, which Coinbase has allegedly refused to pay the required arbitration fees, causing them to be dismissed.

Related: Alabama drops staking lawsuit against Coinbase

The suit brings three claims of violating state biometric privacy laws and one for consumer fraud under the Illinois Consumer Fraud and Deceptive Business Practices Act.

The group is seeking relief of $5,000 per willful or reckless violation found, $1,000 per negligent violation found, along with injunctive relief and litigation costs. 

Coinbase has also recently been hit with at least six lawsuits over its May 15 disclosure that some of its customer support agents were bribed to leak users’ data.

Past BIPA violation suit sent to arbitration

In May 2023, a group of Coinbase users sued the exchange under similar accusations of BIPA violations.

A judge later allowed that lawsuit to pause pending arbitration and dismissed the lawsuit without prejudice on Feb. 3 after Coinbase and the group of users agreed to drop the action.

Magazine: Arthur Hayes $1M Bitcoin tip, altcoins ‘powerful rally’ looms: Hodler’s Digest