Concrete Injury as a Prerequisite for Federal Statutory Claims in Illinois Courts: Standing and FACTA After Fausett v. Walgreen Co.

I. Introduction

The Supreme Court of Illinois’ decision in Fausett v. Walgreen Co., 2025 IL 131444 (Nov. 20, 2025), is a significant statement on the doctrine of standing in Illinois courts, especially where plaintiffs seek to enforce federal statutes that provide statutory damages without requiring proof of actual loss.

The case arose from a putative nationwide class action under the Fair and Accurate Credit Transactions Act of 2003 (FACTA), a component of the Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681 et seq. The plaintiff, Calley Fausett, alleged that Walgreens willfully violated FACTA’s “truncation” requirement by printing more than the last five digits of her debit card number on her transaction receipt. She did not allege any actual misuse of her card or identity theft, but instead relied on statutory damages and a theory of heightened risk of identity theft.

Illinois courts had, in prior years, become a preferred forum for “no-injury” privacy and data-related statutory claims (most prominently under the Illinois Biometric Information Privacy Act (BIPA)), particularly after Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186, which allowed suits for mere statutory violations without further harm under that statute. Plaintiffs increasingly attempted to litigate federal statutes like FACTA in state court to avoid the stricter federal Article III standing requirements articulated in Spokeo, Inc. v. Robins, 578 U.S. 330 (2016), and TransUnion LLC v. Ramirez, 594 U.S. 413 (2021).

Fausett squarely addresses whether Illinois courts will entertain such “no-injury” federal statutory actions. The court holds that the plaintiff lacked standing under Illinois law because she failed to allege a concrete, non-speculative injury in fact. As a result, her individual FACTA claim fails, and the class certification order must be reversed, with the case dismissed.

II. Summary of the Opinion

The Supreme Court of Illinois reversed the appellate and circuit courts and held:

• Illinois, not federal, standing doctrine governs whether a plaintiff may bring a federal statutory claim (such as FACTA) in Illinois state court.
• Illinois distinguishes between common-law standing (injury in fact to a legally recognized interest) and statutory standing (where the legislature expressly defines who may sue and under what conditions).
• FCRA’s enforcement provisions (15 U.S.C. §§ 1681n, 1681p), which apply to FACTA violations, do not define who may sue in a way that displaces common-law standing; thus, common-law standing applies.
• Under common-law standing, as clarified in Petta v. Christie Business Holdings Co., P.C., 2025 IL 130337, a plaintiff bringing an action for money damages must allege a concrete injury; a “purely speculative future injury” or mere “increased risk” of harm is insufficient.
• On the facts, the plaintiff alleged no actual identity theft, no misuse of her data, and—after discovery—no concrete harm beyond a claimed “heightened risk” of identity theft and the abstract violation of FACTA rights. This is insufficient for standing.
• Because the named plaintiff lacked standing, she could not maintain the individual claim; therefore, the class action also could not proceed. The court directed the circuit court to dismiss the first amended complaint for lack of standing.

The decision thus creates a clear rule: when a federal statute like FACTA does not specify who may sue, plaintiffs in Illinois courts must satisfy common-law standing and plead a concrete, non-speculative injury. A bare statutory violation plus an alleged increased risk of future harm is not enough for a damages action in Illinois state court.

III. Detailed Analysis

A. Procedural Posture and Case Background

Walgreens operates a national chain of drugstores. Among other services, it sells and reloads prepaid debit cards. In March 2019, the plaintiff visited a Walgreens in Phoenix, Arizona, and used cash to load funds onto her Green Dot prepaid debit card. The transaction generated two electronically printed receipts displaying the first six and last four digits of her 16-digit card number.

FACTA, at 15 U.S.C. § 1681c(g)(1), requires that “no person that accepts credit cards or debit cards for the transaction of business shall print more than the last 5 digits of the card number or the expiration date” on electronically printed receipts. Fausett claimed this printing of the first six plus last four digits violated FACTA and, via FCRA’s liability provision (15 U.S.C. § 1681n(a)), entitled her and a nationwide class to statutory and punitive damages, attorneys’ fees, and costs.

Critically, Fausett did not allege:

• that her card was fraudulently used,
• that her identity was stolen, or
• that any specific third party actually viewed or misused the information on the receipt.

Her alleged harms were:

• heightened risk of identity theft,
• exposure of private information to others who “may” have handled the receipt, and
• the need to take steps to prevent further disclosure.

After the circuit court denied Walgreens’ combined motion to dismiss (which included a standing challenge) and later granted class certification under 735 ILCS 5/2-801, Walgreens pursued an interlocutory appeal under Supreme Court Rule 306(a)(8). The appellate court focused solely on standing and concluded that the plaintiff satisfied Illinois’s standing requirements. The Supreme Court granted leave to appeal and confined itself, again, to the standing issue as a threshold matter.

B. Federal v. State Standing: Illinois Reaffirms Its Independence

A central theme of the opinion is the distinction between federal Article III standing and Illinois standing doctrine. Walgreens had pressed federal standing concepts (drawing on Spokeo, TransUnion, and federal circuit decisions like Kamal v. J. Crew Group, Inc., 918 F.3d 102 (3d Cir. 2019), and Noble v. Nevada Checker Cab Corp., 726 F. App’x 582 (9th Cir. 2018)), which uniformly reject FACTA suits based solely on disclosure of the first six digits of a card number as insufficiently concrete for Article III purposes.

The Illinois Supreme Court explicitly reiterates—consistent with prior cases—that it is not bound by federal standing jurisprudence:

• Greer v. Illinois Housing Development Authority, 122 Ill. 2d 462 (1988) – The court declined to adopt the federal “zone of interests” component of standing from Association of Data Processing Service Organizations, Inc. v. Camp, 397 U.S. 150 (1970), emphasizing that Illinois is free to craft its own standing rules. (Fausett ¶¶ 35–36.)
• Lebron v. Gottlieb Memorial Hospital, 237 Ill. 2d 217 (2010) – The court reaffirmed that Illinois has expressly rejected federal standing principles. It stressed that, unlike in federal court, lack of standing in Illinois is an affirmative defense, not a jurisdictional bar. (Fausett ¶ 36.)

Fausett continues this line: while federal cases may be persuasive on policy or analysis, they do not dictate Illinois standing standards, even when a plaintiff sues under a federal statute like FACTA. Illinois courts, being courts of general jurisdiction, apply their own standing doctrine, subject only to overarching constitutional limits not directly implicated here.

C. Common-Law Versus Statutory Standing

The opinion then carefully distinguishes two types of standing under Illinois law:

1. Common-law standing – requires “an injury in fact to a legally recognized interest” (citing In re Estate of Burgeson, 125 Ill. 2d 477 (1988)), and is typically evaluated under the three-part test from Greer:
   • (1) a “distinct and palpable” injury,
   • (2) fairly traceable to the defendant’s conduct, and
   • (3) substantially likely to be prevented or redressed by the requested relief.
2. Statutory standing – arises when a statute itself creates a right to sue and defines who may bring actions and under what conditions. In such cases, the legislature “determined ‘who shall sue, and the conditions under which the suit may be brought.’ ” (Fausett ¶ 39, quoting Wilson v. Tromly, 404 Ill. 307, 310 (1949).)

This distinction is crucial, because the plaintiff effectively argued that FACTA and FCRA conferred statutory standing akin to that found in BIPA and the Probate Act. The court rejects that analogy after a close textual reading.

1. Rosenbach and BIPA: An Example of Statutory Standing

In Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186, the court interpreted section 20 of the Biometric Information Privacy Act (BIPA), 740 ILCS 14/20, which provides:

“Any person aggrieved by a violation of this Act shall have a right of action … against an offending party.”

In Rosenbach, the court held that a person is “aggrieved” under BIPA by a statutory violation alone; no further “actual” harm or adverse effect is necessary. That is, BIPA’s text itself created statutory standing for a broad class of plaintiffs based solely on the invasion of statutory rights.

Fausett underscores that Rosenbach was grounded in this particular statutory language (“any person aggrieved”) and the structure and purpose of BIPA, which explicitly confers a right to sue for violations of biometric privacy rights. This is a model of statutory standing: the legislature directly names who may sue.

2. Schlenker and the Probate Act: Another Statutory Standing Example

Similarly, in In re Estate of Schlenker, 209 Ill. 2d 456 (2004), the court interpreted section 8-1 of the Probate Act, which states:

“Within 6 months after the admission to probate … any interested person may file a petition … to contest the validity of the will.” (Emphasis added.)

“Interested person” is defined by statute to include heirs. The court held that an heir’s status alone was sufficient to confer standing to contest the will. Again, the statute itself clearly sets out who has standing.

3. FCRA/FACTA: Silence on “Who May Sue”

In contrast, the FCRA/FACTA provisions at issue do not expressly define who may bring suit. Two provisions are central:

• 15 U.S.C. § 1681n(a) – creates “civil liability for willful noncompliance” and states that:

  “Any person who willfully fails to comply with any requirement imposed under this subchapter with respect to any consumer is liable to that consumer in an amount equal to the sum of— [actual damages or statutory damages, punitive damages, and attorney’s fees].”

• 15 U.S.C. § 1681p – provides:

  “An action to enforce any liability created under this subchapter may be brought in any appropriate United States district court … or in any other court of competent jurisdiction ….”

The Illinois Supreme Court highlights that, unlike BIPA and the Probate Act, these provisions:

• impose liability “to [the] consumer,”
• describe remedies and fora,
• but do not contain explicit language of the form “any consumer,” “any person aggrieved,” or “any interested person may bring an action.”

Based on this textual silence, the court concludes that FCRA’s liability provisions “fail to include standing language” and “Congress did not expressly define the parties who have the right to sue for the statutory damages established in FCRA.” (Fausett ¶ 40, ¶ 44.) As a result, the court holds:

“[P]laintiff’s FACTA claim does not implicate statutory standing principles, and thus common-law standing applies to plaintiff’s suit.” (Fausett ¶ 44.)

This is a decisive move. The court effectively says: unless the statute clearly indicates that mere violation of the statutory right is enough to sue and specifies who may sue, Illinois courts will default to common-law standing requirements. Congress’s decision to create liability and statutory damages does not automatically eliminate the need for a concrete injury under Illinois law.

D. The Common-Law Standing Test and the “Concrete Injury” Requirement

With common-law standing established as the applicable framework, the court applies the familiar three-part Greer test:

1. The claimed injury must be “distinct and palpable” (not a generalized grievance);
2. It must be fairly traceable to the defendant’s actions; and
3. It must be substantially likely to be prevented or redressed by the requested relief.

Critically, in Petta v. Christie Business Holdings Co., P.C., 2025 IL 130337, decided shortly before Fausett, the court added further gloss to this framework:

“The injury alleged by the plaintiff must be concrete; a plaintiff alleging only a purely speculative future injury or where there is no immediate danger of sustaining a direct injury lacks a sufficient interest to have standing.” (Fausett ¶ 46, quoting Petta ¶ 18.)

In Petta, the plaintiff alleged that a medical provider negligently allowed her personal data (including Social Security number and insurance information) to be “exposed” in a “data incident.” The letter to patients indicated only that data might have been exposed, and that the attacker appeared to be targeting a financial transaction, not patient information. The court held that a mere “increased risk” that personal data may have been accessed by a third party, without more, was insufficient to confer standing for a complaint seeking monetary damages.

Fausett expressly relies on Petta to hold that an “increased risk of identity theft” from a receipt showing partial card digits is likewise a “purely speculative future injury,” not a concrete one.

E. Application to Fausett’s FACTA Claim

1. Plaintiff’s Alleged Injuries

Fausett’s complaint alleged:

• Walgreens willfully violated FACTA by printing more than the last five digits of her debit card number; and
• This caused:
  • a heightened risk of identity theft,
  • exposure of her private information to others who may have handled the receipt, and
  • the need to take action to prevent further disclosure of the information on the receipt.

However, after discovery, the factual record was much narrower:

• In her deposition, Fausett admitted that since March 2019 she had not been a victim of identity theft.
• In discovery responses, she conceded she was not “presently aware of any harm to her credit or identity.”
• She identified no third party, beyond the cashier, herself, and her attorneys, who actually saw the receipts.
• She testified that she took the receipt home, placed it in a ziplock bag, and stored it in a filing cabinet.
• Walgreens presented expert evidence that the first six digits of the card number are merely the bank identification number (BIN), which does not reveal any personal information about the cardholder and cannot by itself be used to steal identity.

Notably, in responding to interrogatories about “actual damages,” Fausett objected to the term’s vagueness but effectively reiterated only:

• heightened risk of identity theft,
• breach of confidence, and
• deprivation of her FACTA rights.

She did not concretely explain what specific “actions” she took to prevent further disclosure, nor did she attribute any measurable consequence to her alleged breach of confidence.

2. The Court’s Evaluation of Injury

The court accepts, for purposes of common-law standing analysis, that:

• Fausett is a “no-injury plaintiff” (the circuit court had noted this, and the Supreme Court agreed); and
• At best, she showed an increased risk of future identity theft.

Applying Petta, the court finds:

“After discovery at the class certification stage, plaintiff, at best, has shown an increased risk of identity theft. As noted, we recently held that an increased risk of harm is a purely speculative future injury, which is insufficient to confer standing with a complaint for money damages.” (Fausett ¶ 50.)

Thus, Walgreens, which bore the burden of proving lack of standing as an affirmative defense, successfully demonstrated that:

• Fausett did not suffer a concrete injury; and
• Her alleged injuries remained in the realm of speculation and abstract statutory harm.

As a result, she did not satisfy the “distinct and palpable” injury element of the Greer test and lacked standing under Illinois common-law principles.

F. Interaction with Prior Illinois and Federal Decisions

1. The Appellate Court’s Reliance on Rosenbach

The appellate court had analogized FACTA to BIPA and concluded that just as BIPA allows lawsuits for bare statutory violations (per Rosenbach), FACTA likewise should be enforceable without proof of actual harm. It further reasoned that requiring an additional compensable injury would undermine FACTA’s preventative and deterrent purposes.

The Supreme Court of Illinois disagreed on a fundamental premise: that FACTA/FCRA contains statutory language comparable to BIPA’s “any person aggrieved” clause. The crucial move in Fausett is to limit Rosenbach to statutes where the legislature explicitly signals its intent to allow suits based solely on statutory violations. Without such text, Illinois reverts to common-law standing’s injury requirement.

2. Maglio and Data-Breach Risk Cases

Walgreens analogized this case to Maglio v. Advocate Health & Hospitals Corp., 2015 IL App (2d) 140782, where plaintiffs alleged risk of harm from a data breach. The appellate court there found the alleged risk of future misuse of data insufficient to establish a “distinct and palpable” injury.

The Supreme Court in Fausett does not rely heavily on Maglio by name, but its analysis through Petta (also a data-incident case) confirms the same policy: Illinois courts are skeptical of suits grounded solely in risk-based harms without current, concrete injury, at least where the relief sought is monetary.

3. TransUnion and Federal Article III Standing

Walgreens argued that under TransUnion LLC v. Ramirez, 594 U.S. 413 (2021), “no-injury” plaintiffs cannot rely on statutory damages under FCRA in any venue, including state courts, and that allowing such suits would violate Article II by intruding into the executive’s enforcement prerogative.

The Illinois Supreme Court does not ground its holding in Article II or Article III. Instead, it:

• Reaffirms that Illinois standing doctrine is not constrained by Article III (standing is not jurisdictional in Illinois);
• Notes that federal standing decisions are therefore not controlling, although they may be informative; and
• Resolves the case purely on Illinois common-law standing grounds.

Practically, though, the outcome is convergent with TransUnion and related federal appellate cases: plaintiffs alleging only statutory violations and risk of harm under FACTA cannot obtain statutory damages in Illinois courts any more than in federal court.

G. Effect on Class Certification

Illinois law is clear that if the putative class representative does not have an actionable individual claim, the class action cannot proceed. The court cites:

• Barbara’s Sales, Inc. v. Intel Corp., 227 Ill. 2d 45 (2007) – The court reversed class certification where the alleged uniform misrepresentation was not actionable under the Consumer Fraud Act, treating the lack of an underlying viable claim as a threshold bar to class proceedings.
• Griffith v. Wilmette Harbor Ass’n, 378 Ill. App. 3d 173 (2007) – If the purported representative plaintiff lacks standing, “then the class action claim cannot be maintained.”

In Fausett, because the plaintiff lacked standing to pursue her individual FACTA claim, the circuit court’s grant of class certification was necessarily an abuse of discretion and had to be reversed. The Supreme Court therefore did not need to engage with the other Rule 2-801 requirements (numerosity, commonality, adequacy, appropriateness).

Importantly, the court goes further and directs dismissal of the complaint itself on remand, not merely reversal of class certification. By analogy to Petta, where the complaint was dismissed under 735 ILCS 5/2-619(a)(9) for lack of standing, the court notes that discovery here has occurred and the plaintiff still has not alleged any concrete harm. There is therefore no reason to allow further proceedings.

IV. Complex Concepts Simplified

A. What Is Standing?

“Standing” is a legal requirement that asks: does this particular plaintiff have a sufficient stake in this particular dispute to justify asking the court to resolve it? In Illinois:

• Standing is not part of subject-matter jurisdiction.
• It is treated as an affirmative defense—the defendant bears the burden of raising and proving lack of standing.
• Courts ask whether the plaintiff has suffered or is in immediate danger of suffering a real, not hypothetical, injury caused by the defendant, and whether the court can do something meaningful about it.

B. Common-Law Versus Statutory Standing in Plain Terms

• Common-law standing is the default. You must show a real-world injury (or immediate danger of such injury) to a legally protected interest. Example: if someone trespasses on your land, you are injured even if nothing is physically damaged.
• Statutory standing applies when a statute says, in effect, “If X happens, Y group of people may sue.” The statute can sometimes create a right to sue even where common-law injury would be doubtful—particularly when the legislature says “any person aggrieved,” “any person whose rights are violated,” or “any interested person” may sue.

In Fausett, the court finds that FACTA/FCRA does not explicitly say who may sue in this way, so the default common-law standing rules apply.

C. “Concrete Injury” and “Increased Risk”

A concrete injury is one that is real and present—not abstract, hypothetical, or speculative. It does not need to be economic (e.g., financial loss); emotional or privacy harms can be concrete if sufficiently specific and present. But:

• Saying “I might be harmed in the future” is generally not enough.
• An “increased risk” of some bad outcome (like identity theft) is too uncertain unless it is immediate and almost certain or tied to some other present impact.

In both Petta and Fausett, the plaintiffs’ claims of “increased risk” of identity-related harm, without any actual misuse or immediate, particularized threat, failed to meet this threshold.

D. FACTA’s Truncation Rule

FACTA was enacted to reduce opportunities for identity theft. Its truncation provision says that businesses that accept credit or debit cards cannot print more than the last five digits of the card number or the expiration date on receipts. The idea is to prevent receipts from containing enough information for criminals to reconstruct full card numbers.

In Fausett, Walgreens printed the first six digits (the bank identification number, which reveals the card issuer and product type but not the individual account) and the last four digits. Federal appellate courts have generally held that such partial display does not by itself create a meaningful risk of identity theft sufficient for standing in federal court. Illinois now reaches a similar conclusion under its own standing framework.

V. Impact and Future Implications

A. No-Injury FACTA and FCRA Class Actions in Illinois

The most immediate impact of Fausett is on FACTA and other FCRA-based class actions filed in Illinois state courts where plaintiffs allege only:

• a statutory violation (such as improper receipt formatting), and
• an increased risk of identity theft or other future harm,

without alleging actual misuse of information or other concrete harm.

Such actions are now effectively barred in Illinois for damages claims. Plaintiffs must plead and be prepared to prove a concrete injury—e.g., fraudulent charges, identity theft, out-of-pocket mitigation costs, or similarly tangible consequences—if they are to survive standing challenges.

B. Forum Strategy and the Federal–State Divide

After Spokeo and TransUnion, many plaintiffs attempted to file in state courts to avoid strict Article III standing barriers. Fausett substantially diminishes Illinois’s attractiveness as a forum for “no-injury” federal statutory suits:

• Illinois will independently assess whether the plaintiff has suffered a concrete injury;
• It will not treat statutory damages provisions as automatically conferring standing; and
• It demands more than the mere violation of a federal procedural requirement plus a speculative risk of harm.

Although state courts are not limited by Article III, Fausett shows that, as a matter of state law, Illinois is converging with federal courts in resisting purely abstract federal statutory enforcement suits by private plaintiffs.

C. Clarifying the Reach of Rosenbach and BIPA

Fausett also has an important clarifying effect on Rosenbach’s scope:

• Rosenbach remains intact for BIPA: a plaintiff can be “aggrieved” by a BIPA violation without additional actual harm; the statutory violation itself is sufficient.
• But Fausett makes clear that Rosenbach is not a general rule for all privacy or statutory damages cases. It is tightly tethered to BIPA’s particular statutory language and structure.
• Other statutes—state or federal—must be examined individually. Unless they clearly confer a right to sue for bare statutory violations and define “who may sue,” Illinois courts will require common-law standing with a concrete injury.

Thus, plaintiffs cannot freely import Rosenbach’s logic to FACTA, FCRA, or other statutes simply because those statutes are also preventative or deterrent in nature.

D. Beyond FACTA: Other Federal and State Statutes

Although the decision is formally confined to FACTA/FCRA, its reasoning likely extends to many federal and state statutes that:

• authorise statutory damages,
• create liability for regulatory or technical violations, but
• do not explicitly say “any person aggrieved” or otherwise specify that mere statutory violation confers standing.

Examples may include some claims under:

• other provisions of the FCRA,
• statutes regulating consumer disclosures or recordkeeping, and
• data privacy or cybersecurity laws that lack explicit “any person aggrieved” language.

Litigants will likely test the boundaries with other statutes, and courts will need to perform careful textual analysis—similar to Fausett’s comparison of BIPA, the Probate Act, and FCRA—to decide whether those statutes create statutory standing or require common-law standing.

E. Class Action Practice

From a class-action perspective, Fausett underscores:

• Standing is a threshold issue that may—and often should—be decided before delving into the Rule 2-801 class certification factors;
• If the named plaintiff cannot maintain an individual claim (e.g., for lack of standing), the class cannot be certified; and
• Defendants in Illinois can and should aggressively use standing challenges, including motions under 735 ILCS 5/2-619(a)(9), to terminate “no-injury” statutory claims early, even when the statute provides for statutory damages.

VI. Conclusion

Fausett v. Walgreen Co. establishes an important principle in Illinois law:

For federal statutory claims like FACTA brought in Illinois courts, where the statute’s enforcement provisions do not expressly define “who may sue” or otherwise create statutory standing, plaintiffs must satisfy Illinois common-law standing, including the requirement of a concrete, non-speculative injury in fact. A bare statutory violation and a heightened risk of future harm are insufficient for a damages action.

The decision reinforces Illinois’s independence from federal Article III constraints while simultaneously aligning, in practical effect, with federal skepticism toward “no-injury” statutory damages suits. It limits the reach of Rosenbach to statutes with explicit language conferring statutory standing, such as BIPA, and clarifies that such reasoning does not automatically apply to other statutory regimes, particularly federal ones like FCRA.

In doing so, Fausett reshapes the litigation landscape for consumer and privacy-related class actions in Illinois, signaling that statutory rights—even important preventative ones—must still be anchored in concrete injury to support a damages claim unless the legislature unmistakably directs otherwise.