US restaurant chain Steak 'n Shake is being sued in Illinois for allegedly violating the state's Biometric Information Privacy Act (BIPA) through its use of facial recognition.

Initiated by plaintiff Michael Massel, the lawsuit claims that the fast-food chain unlawfully collected and stored customers' facial biometric data through self-service kiosks without obtaining proper consent or providing adequate notice, as mandated by BIPA.

The kiosks, which were introduced in 2024, use facial recognition to facilitate customer orders and manage loyalty rewards. Massel's suit highlights the permanence of biometric data, such as facial geometry, which poses significant risks if compromised, as it cannot be changed like a password.

The lawsuit seeks damages of up to USD 5,000 per violation and aims to represent all Illinois customers whose biometric information was collected by Steak 'n Shake over the past five years. This could potentially lead to a settlement amounting to several million dollars.

Recent amendments to BIPA may also impact the case. These changes stipulate that multiple collections of the same biometric identifier from one individual, without proper notice and consent, will be treated as a single violation, which could reduce the financial liability for businesses involved in similar lawsuits.