Biometric tech is everywhere. Think facial recognition, voice ID, fingerprints, retina scans (a la Minority Report or a million other sci-fi movies, except real and in the present). It’s probably how you unlock your phone every day, and how social media platforms ask if that photo some friend of a friend tagged is really you. And it’s likely to become even more pervasive in light of COVID-19 as some companies seek to embrace longer-term remote work policies without sacrificing security.

Because of an Illinois statute—the Biometric Information Privacy Act (BIPA)—this could pose a big, costly problem for companies if they don’t get consent, and that problem could play out in the form of a big class action in federal court. Take Vimeo, for example: a federal judge just rejected their attempt to arbitrate a class action brought under BIPA, even though the user had agreed to an arbitration clause. Luckily, though, this was because an exception applied, but the court reiterated the broad privacy rights afforded by BIPA and demonstrated a willingness to disfavor arbitration if the circumstances are right (or wrong, depending on your view).

If you’re reading this, you probably know that BIPA is a sweeping state law that restricts how companies can collect, store, use, and destroy this information. Most notably, it creates a private right of action that has the potential to cost companies millions or even billions—$1,000 per negligent violation or $5,000 per reckless violation (or actual damages if they’re more than that), plus attorneys’ fees, costs, and injunctive relief.

Companies have faced hundreds of BIPA lawsuits since the Illinois Supreme Court opened the floodgates early last year by holding that individuals could sue based on a statutory violation alone, even if the violation didn’t harm them in any way. Two federal courts of appeals—the Ninth and, as we reported last month, the Seventh Circuit—subsequently held the same thing under the federal standard. (Though before all this, the Second Circuit seemed to hold otherwise, albeit in a non-precedential decision, and the deepened split might get the Supreme Court to take up this issue.)

It’s not all bad news. Companies facing BIPA lawsuits have several lines of attack, including on grounds of personal jurisdiction, statute of limitations, constitutionality of the statute itself, preemption by other state/federal laws, as well as various statutory defenses, etc. And, some companies have able to avoid class actions by invoking arbitration clauses. Just last month, for example, an Illinois federal court set aside claims that Southwest Airline violated the BIPA by requiring employees to clock in and out by scanning their fingerprints, holding that employees had to pursue their claims as individuals in arbitration, not as a class in federal court. (See this post for more details on that.)

Earlier this week, though, a judge in the same federal court ruled in Acaley v. Vimeo, Inc., No. 19-cv-7164, 2020 U.S. Dist. LEXIS 95208 (June 1, 2020) that users of a video app could pursue their claims in federal court. This case involves the Magisto video creation and editing app, which Vimeo owns and operates. A guy named Bradley Acaley, a user of the Magisto app, brought a class action alleging that Vimeo violated BIPA by using facial recognition technology to scan pictures and videos uploaded to the app to create unique face templates without consent.

Vimeo asked the court to stay the lawsuit and compel Acaley to arbitrate his claims individually, claiming that Acaley had agreed to arbitrate BIPA claims by accepting Magisto’s terms of service, which contain a mandatory arbitration clause. The court ruled against Vimeo, holding that even though the there was a binding and valid arbitration clause in the terms of service, that clause did not apply under an exception for claims relating to “invasion of privacy.”

The court first addressed whether the agreement to arbitrate was valid. It was, the court held, because Magisto provided “reasonable notice” that use of the app meant a user agreed to the terms of service. Whether a company has provided “reasonable notice” is a fact-specific test under Illinois law. On some of its signup pages, Magisto included a statement that use is subject to terms, along with a hyperlink to those terms. That was enough for the court.

The court agreed with Acaley, though, that the arbitration clause did not cover BIPA claims based on an “invasion of privacy” exception in the terms of service. The exception stated that any claims “related to, or arising from . . . invasion of privacy” were not covered by the arbitration clause. That included BIPA claims, according to the court, since BIPA created “a legal right to privacy.”

Courts generally favor arbitration, and where there is a valid arbitration clause, they usually require parties to arbitrate unless they can say “with positive assurance” that the agreement cannot reasonably be interpreted to over the dispute. Vimeo argued that that the clause could be interpreted to cover only claims brought by Vimeo against users and not the other way around, and that it applied only to claims of common-law invasion of privacy, not a statutory claim involving privacy. The court rejected these more narrow interpretations, and was absolutely sure that “any Claim related to, or arising from, allegations of . . . invasion of privacy” covered BIPA claims.

So, the court let this class action continue in federal court. Enforcement of arbitration clauses can be fact-specific, though, so it seems unlikely that this will become a trend since it was dependent on a specific exception in the terms of service, and this judge arguably seemed less inclined to enforce the arbitration agreement than is typical. For example, as we reported here just last week, a different judge in the same court compelled arbitration in a similar BIPA class action against Shutterfly. The court in that case enforced an arbitration clause, even though it didn’t exist when the plaintiff signed up, since the original terms had a change in terms provision, and the plaintiff continued to use the site after Shutterfly added the clause. That plaintiff will have to bring her claims as an individual in arbitration against Shutterfly.

On the other hand, the Vimeo case will continue as a class action in federal court due to the court’s interpretation of that “invasion of privacy” exception. The different outcomes illustrate just how important it is for companies to carefully craft (and update) their terms of service based on evolving case law. And take an extra careful look at any arbitration exceptions in your contracts.