Rosenbach v. Six Flags Entertainment Corp.

7 to 0

Illinois Supreme Court, 25 January 2019

2019 IL 123186

USD 36M

Settlement fund approved in 2021

Settlement notice, Lake County

USD 200

Maximum payment per early-period class member

Settlement notice

What happened?

In 2014 Alexander Rosenbach, then 14, went on a school trip to Six Flags Great America in Gurnee, Illinois. His mother had bought him a season pass online. At the park he was asked to scan his thumb into the park's biometric entry system to pick up the pass. Nobody told him or his mother what the data was for, how long it would be kept, or asked for written consent, all of which Illinois BIPA requires. Stacy Rosenbach sued in 2016 on his behalf, seeking statutory damages.

Six Flags argued that the Rosenbachs had suffered no actual harm: no data breach, no misuse, nothing beyond a technical failure to follow the statute's procedure. The Appellate Court agreed in 2017 that a bare violation did not make a person "aggrieved" under section 20 of the Act. The Illinois Supreme Court took the case to settle the question.

1. 2014

   Thumbprint scanned

   A 14-year-old's fingerprint is captured at Six Flags Great America to activate a season pass, without notice or written consent.

2. 2016

   Suit filed

   Stacy Rosenbach files a class action in Lake County under BIPA section 20.

3. 2017-12-21

   Appellate Court

   Second District holds that a person must allege actual harm beyond the statutory violation to be aggrieved.

4. 2019-01-25

   Illinois Supreme Court

   Unanimous reversal: the violation itself is the injury; no further harm required.

5. 2021-06

   Settlement announced

   Six Flags agrees to pay up to USD 36 million without admitting liability.

6. 2021-10-29

   Final approval hearing

   Fairness hearing in Lake County; payments of up to USD 200 or USD 60 depending on the scan date.

What did the court decide?

Chief Justice Karmeier, writing for a unanimous court, held that the word "aggrieved" in BIPA carries its ordinary legal meaning: a person whose legal right has been violated. The legislature chose to give individuals control over their biometric identifiers precisely because such data cannot be changed once compromised, and it made compliance with the notice and consent procedure the mechanism of that control. A failure to comply is therefore not a technicality; it is the very injury the statute was written to prevent. Requiring plaintiffs to wait for a breach or misuse before suing would defeat the preventive purpose of the Act.

Why does it matter for face search?

Rosenbach is the reason BIPA is enforced at all. With no regulator and no agency fines, the statute depends on private lawsuits, and after January 2019 any Illinois resident whose face geometry was scanned without written consent could sue for USD 1,000 or USD 5,000 per violation without proving harm. That standard underlies the Facebook and Google Photos settlements and the ACLU suit against Clearview AI, which was filed in Illinois state court four months after Rosenbach. A consumer face search engine that computes templates from photos of Illinois residents is exposed on the same theory, which is why several engines avoid the state. Cothron v. White Castle later set how often such a claim accrues; the 2024 amendment then limited it to once per person per method.

What happened next?

The case returned to Lake County and settled in 2021 for a fund of up to USD 36 million covering everyone whose finger was scanned at the park between October 2013 and December 2018, with larger payments for the earlier period. Six Flags admitted no liability. The decision has been followed by Illinois courts since, and the Seventh Circuit applied the same reading of "aggrieved" to federal standing analysis in later BIPA cases.