“Facial geometry scans are unique, permanent biometric identifiers associated with each user that cannot be changed or replaced if stolen or compromised.”

💡 This establishes why biometric violations are fundamentally different from other data breaches and why BIPA protections are so critical.

“For example, social security numbers, when compromised, can be changed. Biometrics, however, are biologically unique to the individual; therefore, once compromised, the individual has no recourse, is at heightened risk for identity theft, and is likely to withdraw from biometric-facilitated transactions.”

💡 The Illinois legislature explicitly recognized that biometric data breaches cause permanent, irreversible harm unlike any other type of privacy violation.

“Getaround made no mention of biometric information, collection of biometric information, or storage of biometric information.”

💡 Users had absolutely no way to know their facial geometry was being captured and stored, making informed consent impossible.

“Getaround’s collection and retention of biometric information as described herein is not unique to Plaintiff and is instead part of Getaround’s policy and procedures which Getaround applies to all of its users, including the Class Members.”

💡 This was not an isolated mistake but an intentional business practice applied to potentially thousands of users.

“At all relevant times, Getaround had no written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric information when the initial purpose for collecting or obtaining such biometric information has been satisfied or within 3 years of the individual’s last interaction with Getaround, whichever occurs first.”

💡 Without a destruction policy, users’ facial scans remain in Getaround’s systems indefinitely, accumulating risk over time.

“Getaround disclosed, redisclosed or otherwise disseminated Plaintiff’s biometric information to its service providers, contractors, business partners, and collection agencies.”

💡 The company shared irreplaceable biometric data with multiple third parties without user authorization, multiplying the exposure risk.

“Courts analogize an individual’s privacy interest in their unique biometric data to their interest in protecting their private domain from invasion, such as from trespass.”

💡 Legal precedent recognizes that unauthorized biometric collection is as serious as physical invasion of private property.

“The City of Chicago, which has been selected by major national corporations as a pilot testing site for new applications of biometric-facilitated financial transactions, including finger-scan technologies at grocery stores, gas stations, and school cafeterias.”

💡 Illinois residents are particularly vulnerable to biometric data collection experiments, making BIPA protections especially important.

“You shall submit in addition to other Personal Data you may have already provided to us, the following information taken via our App on your smartphone (the ‘Vetting Data’): Photo (front and back) of your driving license; Photo of your I.D. card (only if you have a paper driving license or a non E.U. driving license); a video of you reading three numbers and turning your head.”

💡 This shows exactly how Getaround collected facial geometry through the video requirement without explaining it was capturing biometric data.

“Getaround’s marketing efforts directed towards Illinois were a factor in Plaintiff’s decision to open an account.”

💡 The company actively recruited Illinois users while allegedly ignoring the state’s biometric privacy protections.

“All Illinois residents who had their biometric information collected by Defendant at any point in the five (5) years preceding the filing of this Complaint.”

💡 The proposed class encompasses five years of alleged violations, potentially affecting thousands of Illinois residents.

“Getaround, Inc. is a ‘private entity’ as that term is broadly defined by BIPA and is subject to all requirements of BIPA.”

💡 The company cannot claim exemption from BIPA’s requirements and was legally obligated to comply with all provisions.

“Statutory damages of $5,000.00 for the intentional and reckless violation of BIPA pursuant to 740 ILCS § 14/20(2), or alternatively, statutory damages of $1,000.00 pursuant to 740 ILCS § 14/20(1) in the event the court finds that Defendant’s violations of BIPA were negligent.”

💡 The financial stakes are enormous, with potential damages ranging from $1,000 to $5,000 per violation multiplied across potentially thousands of class members.

“Getaround collected, stored, and used Plaintiff’s biometric information without ever receiving a written release executed by Plaintiff which would consent to or authorize Getaround to do the same.”

💡 The company never obtained the fundamental written consent that BIPA requires before collecting any biometric data.

“Getaround’s unlawful collection, obtainment, storage, and use of its user’s biometric data exposes them to serious and irreversible privacy risks.”

💡 The alleged violations create permanent vulnerabilities that affected users will carry for the rest of their lives.