Johnson & Johnson’s former subsidiary has reached a settlement in a closely watched lawsuit accusing it of secretly storing facial scans from users of its Neutrogena Skin360 app—an alleged violation of Illinois’ stringent biometric privacy law. The deal prompted U.S. District Judge Michael Shipp in New Jersey to order the case closed within 60 days, though terms remain under wraps.

The resolution follows two years of litigation and comes just months after the judge refused to dismiss the case, setting the stage for a dramatic trial that never came.

The Lawsuit and the Biometric Controversy

Filed in May 2022, the class action was spearheaded by named plaintiff Helene Melzer, who accused Johnson & Johnson Consumer Inc. (JJCI) of unlawfully collecting, storing, and linking biometric data—such as facial scans—to personal information including names and birth dates, without informed consent.

The app, launched as Neutrogena Skin360, uses artificial intelligence to analyze facial images, provide personalized skin assessments, and recommend Neutrogena products. Consumers argued this practice violated Illinois’ Biometric Information Privacy Act (BIPA), one of the toughest data privacy laws in the U.S.

Corporate Shifts and Legal Battles

JJCI, later spun off into Kenvue Inc. in 2023, fought back, asserting that Skin360 fell under BIPA’s healthcare exemption. The company cited cases like Delma Warmack-Stillwell v. Christian Dior Inc., where digital “try-on” tools were considered healthcare applications under FDA definitions.

But Judge Shipp rejected that argument, ruling that Skin360 users were not “patients” under BIPA since no medical professionals were involved and the AI-based assessments relied solely on image comparisons.

What’s Next

While the exact settlement terms remain sealed, the deal avoids further courtroom drama and potentially massive damages under BIPA, where violations can trigger fines of $1,000 per negligent infraction and $5,000 per reckless one.

Attorneys for the consumers included teams from Mazie Slater Katz & Freeman LLC, Parasmo Lieberman Law, Schwartz Law PLLC, and Hopkins & Huebner PC. Johnson & Johnson Consumer Inc. was represented by McCarter & English LLP and Sidley Austin LLP.

With the j&j skin360 app settlement finalized, one of the most intriguing digital privacy battles in recent years has closed, underscoring how biometric data remains a legal minefield for tech and consumer health companies alike.