Cothron v. White Castle System, Inc.

4 to 3

Illinois Supreme Court, 17 February 2023

2023 IL 128004

USD 17B

White Castle's estimate of its exposure under per-scan accrual

Court opinion, citing the defendant

USD 9.4M

Settlement approved 1 August 2024

N.D. Ill. final approval

What happened?

Latrina Cothron worked as a manager at a White Castle restaurant in Illinois from 2004. From 2007 the company required employees to scan a fingerprint to access pay stubs and computers; the scans were sent to a third-party vendor for verification. White Castle did not obtain the written consent that BIPA requires until 2018. Cothron sued in December 2018 for the class of Illinois employees, alleging that every scan since the Act took effect in 2008 collected and disclosed her biometric data without consent.

White Castle argued that any claim accrued once, at the first scan in 2008, and was therefore time-barred. The federal district court disagreed and allowed an interlocutory appeal; the Seventh Circuit, finding Illinois law unsettled, certified the question to the Illinois Supreme Court.

1. 2018-12

   Suit filed

   Cook County class action, removed to the Northern District of Illinois.

2. 2021-12

   Seventh Circuit certifies the question

   Does a section 15(b) or 15(d) claim accrue once, or each time data is collected or transmitted?

3. 2023-02-17

   Illinois Supreme Court

   Four to three: a claim accrues on every scan and every transmission.

4. 2023-07-18

   Rehearing denied

   The court declines to revisit; dissenters repeat the warning about annihilative liability.

5. 2024-04

   Preliminary settlement approval

   Northern District of Illinois reviews a USD 9.4 million deal for about 9,000 class members.

6. 2024-08-01

   Final approval

   Settlement approved; roughly USD 968 per class member.

7. 2024-08-02

   Public Act 103-769 in force

   Illinois amends BIPA so damages accrue once per person per method of collection.

What did the court decide?

Justice Overstreet, for the majority, read section 15(b) ("collect, capture, purchase, receive through trade, or otherwise obtain") and section 15(d) ("disclose, redisclose, or otherwise disseminate") according to their plain words: a fingerprint is collected each time it is scanned and disclosed each time it is sent to the vendor, so each event is a violation and each violation is a claim. The majority acknowledged that the result could produce enormous awards but said that was a policy question for the legislature; damages under section 20 are discretionary, not mandatory, so trial courts could moderate them. The three dissenters argued that the statute addressed the initial collection and that the majority's reading invited liability wildly out of proportion to any harm.

Why does it matter for face search?

Face search engines do not scan employees, but they do what Cothron made expensive: they compute a biometric template from an image, store it, and compare it on every search. Under the per-scan reading, each indexing of a new photo of an Illinois resident and each comparison against their template was arguably a fresh violation, each worth USD 1,000 to 5,000. That exposure is part of why Clearview AI settled with the ACLU on terms that keep it out of the consumer market, and why consumer engines treat Illinois as a jurisdiction to avoid. The 2024 amendment removed the per-scan multiplier for cases going forward; the Seventh Circuit held in April 2026 that it applies to pending cases too.

What happened next?

The Illinois General Assembly responded within 18 months. Public Act 103-769, effective 2 August 2024, provides that a private entity that collects the same identifier from the same person by the same method commits a single violation, whatever the number of scans. White Castle settled in 2024 rather than test the amendment, for about USD 9.39 million covering more than 9,000 current and former employees. Rosenbach v. Six Flags remains the rule on who may sue; Cothron and the amendment now set how much.