FOLLOW US

By SAMUEL LOPEZ | USA HERALD — August 24, 2025

Chicago — The Home Depot is staring down a new class action that says the retailer quietly turned its self-checkout cameras into biometric capture devices, logging shoppers’ facial geometry without the written notices and consent Illinois law requires.

Filed Friday, Aug. 1, the complaint by Illinois shopper Benjamin Jankowski alleges the hardware chain deployed “computer vision”—a form of artificial intelligence—to mitigate theft by analyzing faces. In one image attached to the filing, a rectangular box appears around Jankowski’s head on a self-checkout screen, which his lawyers say is evidence that scans of facial geometry were “collected, captured, used, and/or stored” during his visit. The lawsuit asserts that no written notice, policy, or consent was provided before the scan occurred.

“Because Home Depot utilizes facial recognition technology, BIPA requires that it: (1) make publicly available written policies containing retention schedules or guidelines for permanently destroying these facial-geometry scans and (2) obtain its customers’ informed, written consent before collecting and disclosing the facial scans. Home Depot does neither,” the complaint alleges.

Illinois’ Biometric Information Privacy Act (BIPA) is one of the strictest privacy laws in the country. In plain English, if a business in Illinois wants to capture biometrics—like a scan of facial geometry—it must do a few things before it happens:

• Tell you, in writing, what they’re collecting and why.
• Say how long they’ll keep it and when they’ll destroy it.
• Get your written consent first.

BIPA also creates a private right of action—meaning everyday people can sue. Statutory damages can reach $1,000 per negligent violation and $5,000 per reckless or intentional one, plus attorneys’ fees. Multiply that across thousands of shoppers and the numbers escalate quickly. For retailers, the combination of self-checkout cameras and AI-assisted analysis is a legal tripwire if notice and consent are not airtight.

Expect a fight over what the cameras were actually doing. A bounding box on a screen suggests face detection(software noticing “a face-shaped thing” to center an image), which retailers may argue does not equal a “scan of facial geometry” under BIPA. Plaintiffs will counter that the system measured and stored unique facial data points to identify or track individuals—squarely within BIPA’s scope.

That hairline distinction—detection vs. recognition vs. analysis—often decides whether a case survives the first round of motions.

What happens next

Procedurally, here’s the likely path:

1. Initial response:Home Depot may move to dismiss, arguing (for example) that the tech didn’t create biometric identifiers, that any vendor—not the retailer—controlled data, or that signage and store policies satisfied BIPA.
2. Discovery:Emails, vendor contracts, kiosk specs, configuration files, retention settings, and internal policies become crucial. Who stored the data? For how long? Was it ever shared?
3. Class certification:The court will decide whether common questions for all Illinois shoppers predominate over individual issues, a make-or-break moment in BIPA litigation.
4. Merits or settlement pressure:If the case survives, statutory damages math and litigation costs can drive negotiations.

As a legal analyst, these are the elicitation-style specifics I’d push for—answers here usually separate allegation from liability:

• Exact functionality:Was the system configured for facial recognition (identity) or face analytics (patterns), and were templates stored?
• Data trail:What logs, hashes, or templates exist per shopper? Where are they stored, and for how long?
• Written artifacts:Where is the public retention/destruction policy and the written consent workflow? If consent was embedded in signage, what did it say and where was it posted?
• Vendor role:Which third-party platforms were involved? Who trained the models, who controlled retention, and what did the service contracts promise about deletion and sharing?
• Scope & timeframe:Which Illinois stores, which kiosks, and since when? Precision here affects class size and exposure.

For Illinois shoppers:

If you used self-checkout at a Home Depot in Illinois, BIPA gives you concrete rights. In practice, that means:

• You should be able tofind a posted policy explaining retention and destruction of any biometric data.
• You must beasked for written consent before any scan of facial geometry is collected.
• If scans were taken without those steps, BIPA lets individualsseek statutory damages in court.

This lawsuit claims none of those requirements were met. Home Depot, for its part, will likely contend that the technology didn’t capture biometric identifiers at all—or that appropriate disclosures existed. Those competing narratives are exactly what Illinois courts scrutinize under BIPA.

For now, millions of Illinois shoppers may want to think twice before assuming that self-checkout selfie is just between them and their phone.