Two cryptocurrency exchanges, imToken Pte. Ltd. and Marella LLC (operating as Changelly), have been hit with proposed class-action lawsuits in Illinois federal court. The lawsuits, filed by Christine Mouser and Candice Wilhelm, allege that the exchanges unlawfully collected, stored, and disclosed users’ facial geometry scans in violation of Illinois’ Biometric Information Privacy Act (BIPA).
Allegations of Unauthorized Biometric Data Collection
The lawsuits center on the “know your customer” (KYC) verification process, a standard procedure for new users on cryptocurrency exchanges. This process requires users to submit personal information, including their name, address, a government-issued ID, and a facial scan, to verify their identity. According to the complaints, these facial scans constitute unique biometric identifiers, which are protected under Illinois law.
Mouser and Wilhelm allege that imToken and Marella failed to obtain informed consent from users before collecting and storing their biometric data, as required by BIPA. The lawsuits claim that the exchanges did not provide clear information about the purpose of the data collection, the duration for which the data would be stored, or guidelines for its eventual destruction.
Crypto Exchanges Facial Scans Lawsuit : Risks of Biometric Data Breaches Highlighted
The complaints emphasize the risks associated with the unauthorized collection and storage of biometric data. Unlike passwords or other security measures, biometric identifiers such as facial geometry scans are permanent and cannot be changed if compromised. The lawsuits warn that if the exchanges’ biometric databases were to be breached, users could face severe consequences, including identity theft and unauthorized tracking.
