Coinbase Faces New Biometric Privacy Lawsuit in Illinois Over KYC Facial Data Collection
Cryptocurrency giant Coinbase is once again under legal scrutiny in Illinois, where a new class-action lawsuit alleges the company violated the state’s strict biometric privacy laws during its customer verification process.
Filed on May 13 in the U.S. District Court for the Northern District of Illinois, the complaint centers on Coinbase’s Know Your Customer (KYC) checks—specifically, the collection and storage of users’ facial data. Plaintiffs argue that Coinbase failed to obtain proper consent or provide adequate disclosure before gathering biometric identifiers such as faceprints.
According to the lawsuit, users were asked to upload a government-issued ID and a selfie, which were then processed using third-party facial recognition software. The suit claims this process captured sensitive biometric information without users being informed of how the data would be used, stored, shared, or destroyed—requirements outlined in the Illinois Biometric Information Privacy Act (BIPA).
“At no point during the verification process are users informed that their facial data will be collected by third-party vendors,” the complaint states, naming companies like Jumio, Onfido, Au10tix, and Solaris as recipients of the biometric data.
Beyond the alleged privacy violations, the filing also accuses Coinbase of mishandling thousands of individual arbitration claims related to the issue. According to the plaintiffs, more than 10,000 users filed arbitration claims, but many were dismissed after Coinbase allegedly failed to pay required arbitration fees.
The plaintiffs are seeking damages of up to $5,000 per violation if proven reckless, or $1,000 for negligent breaches, along with legal costs and court-ordered measures to prevent future violations.
As of now, Coinbase has not issued a public response to the lawsuit.
This isn’t Coinbase’s first encounter with BIPA-related litigation. In 2023, a separate biometric privacy lawsuit was filed in Illinois over similar concerns. That case was eventually dropped after a judge allowed the dispute to move to arbitration, where it was later dismissed without prejudice.
Adding to Coinbase’s growing legal challenges, the company is also facing a series of lawsuits tied to a recent data breach involving allegedly bribed customer support agents leaking user data. At least six lawsuits have been filed in connection with that incident.
Meanwhile, a separate legal battle over Coinbase’s staking program in Illinois has quietly concluded. The state dropped its case, mirroring similar decisions by Kentucky, Vermont, and South Carolina, after the U.S. Securities and Exchange Commission opted not to pursue enforcement.