Amazon Mapped Your Face for a Lipstick Sale. The Courts Just Confirmed You Can Sue.
THE NON-FINANCIAL LEDGER
This is about more than just data. This is about the permanent architecture of your identity. Your face isn’t a password. You cannot reset it if it is stolen unless you fork over a bunch of money for FFS. You cannot get a new one from a credit monitoring service after a breach. It is uniquely and irrevocably yours, the one thing that has marked you as you, from childhood photos to your driverβs license. Amazonβs Virtual Try-On feature, a seemingly harmless tool to see how a new shade of lipstick might look, turned your camera into a corporate scanner and your face into a data point. Without your full, informed, written consent, a system was built to map, process, and store the very geometry of your being.
The violation detailed in this lawsuit is a profound breach of trust. It is the quiet conversion of a personal momentβa private reflection in a cameraβinto a corporate asset. Think about what it means for your biometric blueprint to exist on a server you do not control. This isn’t like losing a credit card number or something. The legal court documents state it clearly: “If compromised, the privacy harm cannot be mitigated by changing them.” This is a permanent liability assigned to your physical self, a digital ghost of your face that can be copied, sold, or stolen, forever.
The harm is the cold, calculated removal of your agency. Amazon allegedly decided that the value of your facial geometry for their sales funnel was greater than your right to control it. The entire business model relies on this imbalance of knowledge and power. You see a “try on” button. They see a data acquisition opportunity. This creates a lasting state of vulnerability. Every future facial recognition system, every security camera, every government database becomes a potential point of unauthorized cross-reference against a map of your face you never agreed to create.
“Biometric identifiers such as facial data and fingerprints are unique to each person and unalterable. If compromised, the privacy harm cannot be mitigated by changing them.”
The legal battle itself reveals the corporationβs contempt for the individual. Amazon fought hard to prevent this from becoming a class-action lawsuit. Their reasoning was procedural, but the effect is clear: they prefer a reality where taking them on is too expensive and too complicated for any one person. The court document notes that plaintiffs spent over $100,000 on expert discovery just to understand the VTO software. This is the financial wall corporations build to protect themselves from accountability. They count on you being too poor or too intimidated to demand justice. The court’s decision to allow the class action to proceed is a crack in that wall.
Consider the psychological weight. Knowing that an unalterable part of you is now a line item in a corporate database, subject to their security protocols, their policies, their potential bankruptcy, or their next data-sharing agreement. This is a theft of peace of mind. It is a quiet, creeping anxiety about who has your face and what they can do with it. The product you tried on is temporary. The lipstick fades. The data they took is permanent. That is the true transaction you were never told you were making.
LEGAL RECEIPTS
The facts of this case are laid bare in the court’s own words. These are not our interpretations. These are direct statements from the legal record in Case No. 25-1361, decided on December 17, 2025.
Tanya Svoboda and Antonella Ortiz Colosi used a Virtual Try-On feature through Amazonβs mobile site and app to virtually test facial products like lipstick and eyewear. They later brought this class action against Amazon alleging that the VTO feature violates the Illinois Biometric Information Privacy Act through its capture and use of their facial data. United States Court of Appeals For the Seventh Circuit, No. 25-1361
If users elect to preview on their own image, the VTO feature activates the camera on their device to capture their facial geometry from the live video or photo and then analyzes it to determine where to overlay the product. United States Court of Appeals For the Seventh Circuit, No. 25-1361
The Illinois General Assembly enacted BIPA to strengthen biometric data security… the enactment regulates the βcollection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information.β 740 ILCS 14/5(g)
Amazon allegedly collected, captured, stored, and used their own facial geometry and associated personal identifying information and that of βthousands if not millionsβ of people who used the VTO feature in Illinois without providing notice and the required information, obtaining informed written consent, or creating written publicly available data retention and destruction guidelines. Allegations from Svoboda and Colosi’s Complaint
A prevailing party may recoverβ $1,000 for each negligent violation and $5,000 for each intentional or reckless violation. A separate statutory violation generally accrues with βevery scanβ of biometric data. 740 ILCS 14/20(a)(1)β(2) and Cothron v. White Castle Sys., Inc.
The witness stated that Amazon captures and maintains VTO usage records with full IP address information. This leads us to believe that, at least in some circumstances, reasonable findings about location information will follow. Deposition testimony of an Amazon witness, as cited by the Court
The district court did not abuse its discretion in finding that Amazon VTO users lack sufficient incentive to bring individual suits. The plaintiffs reported having spent over $100,000 on expert discovery related to the VTO software. United States Court of Appeals For the Seventh Circuit, No. 25-1361
SOCIETAL IMPACT MAPPING
Environmental Degradation
This legal document, focused narrowly on biometric privacy violations, contains no information regarding the environmental impact of Amazon’s VTO feature or its associated data infrastructure. The court’s analysis is confined to the specific harms outlined in the Illinois Biometric Information Privacy Act. The energy consumption of the servers required to process, analyze, and store millions of facial scans isn’t a factor in this legal proceeding.
This is a common blind spot in corporate accountability litigation, where the immediate human harm overshadows the broader ecological context. The massive, power-hungry data centers that enable this kind of surveillance capitalism operate out of sight, their carbon footprint rarely entering the legal calculus. While this case rightly centers on the violation of personal sovereignty, the material cost of that violationβthe electricity, the water for cooling, the electronic wasteβremains an unwritten chapter in the ledger of corporate responsibility.
Public Health
The collection of unalterable biometric data represents a significant threat to public psychological health. The court itself acknowledges the core of the problem: once this data is compromised, the harm is permanent. This creates a new and pervasive form of anxiety. For the potentially 100,000+ members of this class, and millions more who have used similar technologies, there is now a low-grade, constant stressor: the knowledge that the unique map of their face exists outside their control.
This isn’t a hypothetical fear. It’s the logical consequence of a system where personal identity becomes a corporate commodity. This stress can manifest in tangible ways, contributing to a generalized feeling of powerlessness and paranoia in the digital age. It undermines the fundamental sense of security that comes from owning your own identity. The public health crisis here is the erosion of trust and the creation of a society where individuals feel perpetually watched, cataloged, and vulnerable to exploitation or identity-based harms that they are powerless to prevent.
Economic Inequality
This case is a textbook example of how the legal system is tilted in favor of corporations and against ordinary people. The court document reveals that the plaintiffs had to spend over $100,000 just on expert analysis to understand Amazon’s software. This is a financial barrier that makes individual justice impossible for the vast majority of the population. Amazon knows this. Its attempt to block the class-action certification was a strategic move to ensure that it would only ever have to fight battles it could win through financial exhaustion.
A class action is one of the few tools available to level this playing field. It allows thousands of small, individual claimsβeach too expensive to pursue aloneβto be bundled into a single, powerful case. The courtβs validation of the class action is a direct blow to the corporate strategy of using economic inequality as a shield against legal accountability. Without this mechanism, the BIPA law would be toothless, a right without a remedy for anyone who isn’t wealthy. This case reinforces that collective action is often the only viable path to justice when confronting a trillion-dollar entity.
WHAT NOW?
This court victory is a step, not a destination. The fight for accountability continues against the corporate officers who approved and deployed this technology.
- CORPORATE ROLES TO WATCH:Chief Executive Officer, Amazon.com Inc.
- CORPORATE ROLES TO WATCH:General Counsel, Amazon.com Inc.
- CORPORATE ROLES TO WATCH:Head of AWS and Cloud Services
- CORPORATE ROLES TO WATCH:Vice President of Retail Technology
- CORPORATE ROLES TO WATCH:Chief Privacy Officer
Regulatory bodies have the power to investigate and enforce privacy laws beyond individual lawsuits. Keep pressure on them.
- REGULATORY WATCHLIST:Illinois Attorney General
- REGULATORY WATCHLIST:Federal Trade Commission (FTC)
- REGULATORY WATCHLIST:Consumer Financial Protection Bureau (CFPB)
Waiting for the legal system is not enough. The most powerful defense against corporate overreach is collective power. Support local privacy-focused organizations. Organize tenant and worker unions that demand clear, strict policies against biometric surveillance. Build networks of mutual aid that share knowledge and resources on how to protect ourselves in the digital world. Corporate power relies on our isolation. Our resistance depends on our solidarity.
The source document for this investigation is attached below.
Explore by category
Product Safety Violations
When companies sell dangerous goods, consumers pay the price.
View Cases →Financial Fraud & Corruption
Lies, scams, and executive impunity that distort markets.
View Cases →


