Coinbase Sued for Privacy Violations Over Customer Biometrics

Robert Burnson, Bloomberg News

The Coinbase logo on a smartphone arranged in Hastings-on-Hudson, New York, U.S., on Monday, Jan. 4, 2021. Coinbase Inc. knew cryptocurrency XRP was a security rather than a commodity and "illegally" sold Ripple Labs Inc.'s tokens anyway, a customer argues in a proposed class-action lawsuit over the commissions the crypto exchange collected. Photographer: Tiffany Hagler-Geard/Bloomberg , Bloomberg

(Bloomberg) -- Coinbase Inc. illegally collects face templates and fingerprints of its customers in violation of Illinois’ biometric privacy law, according to a proposed class-action lawsuit.

The cryptocurrency exchange harvests facial data from copies of government-issued IDs and selfies that users are required to upload when they sign up for an account, according to the suit filed Monday in federal court in San Francisco.

Subsequently, Coinbase harvests fingerprint data when customers log into their accounts using the required fingerprint scanning technology, accord to the suit.

Why Illinois BIPA Cases Will Spur Big-Damage Lawsuits: Analysis

The landmark Illinois Biometric Information Privacy Act has fueled dozens of lawsuits against companies across numerous industries over recent years. The law requires companies to obtain consent before collection biometric data and to let users know how long the data will be kept.

“Coinbase has created, collected, and stored thousands of ‘face templates’ – highly detailed geometric maps of the face – and fingerprints from countless Illinois residents,” according to the complaint.

The company’s collection and storage of this data exposes users to “serious and irreversible privacy risks,” such as identity theft, in the event of a data breach, the suit says.

A Coinbase spokesperson declined to comment.

The case is Massel v. Coinbase, Inc., 3:23-cv-02123, US District Court, Northern District of California (San Francisco).