Predominance, Location, and Statutory Damages in BIPA Class Actions: The Seventh Circuit’s Framework in Svoboda v. Amazon

I. Introduction

The Seventh Circuit’s decision in Tanya N. Svoboda & Antonella M. Ortiz Colosi v. Amazon.com Inc. & Amazon.com Services, LLC, No. 25-1361 (7th Cir. Dec. 17, 2025), is an important precedential opinion at the intersection of biometric privacy and federal class action procedure.

The case concerns Amazon’s “Virtual Try-On” (VTO) feature, which allows users of Amazon’s mobile website and app to test how facial products such as lipstick and eyewear would look on their own faces. Plaintiffs allege that this feature collected and used their facial geometry in violation of the Illinois Biometric Information Privacy Act (BIPA), 740 ILCS 14/1 et seq., without the statutorily required notice, consent, and data-retention policies.

The litigation posture is procedural but highly consequential: Amazon brought an interlocutory appeal under Federal Rule of Civil Procedure 23(f), challenging the district court’s order certifying a Rule 23(b)(3) damages class of all individuals who used a VTO feature on Amazon’s mobile site or app while in Illinois since 2016. Amazon argued that individual issues—especially proving that each class member actually used VTO while physically in Illinois, as required by BIPA’s non-extraterritorial reach—and potential “annihilating” statutory damages made class treatment improper.

The Seventh Circuit, in an opinion by Judge Scudder, affirmed certification. The court articulated and applied a robust framework for:

• How individualized proof of location fits into Rule 23(b)(3)’s predominance and manageability analysis in BIPA cases.
• How common liability questions can predominate even if an element (such as “use in Illinois”) requires individual proof.
• Why high potential aggregate statutory damages under BIPA do not, without more, defeat the “superiority” of class treatment.
• How affirmative defenses (consent, mitigation, waiver, estoppel) are treated at the certification stage in this context.

The decision meaningfully clarifies how courts in the Seventh Circuit should approach certification of BIPA classes involving remote technologies, where the central common conduct is uniform but proof of in-state use and individual damages may vary.

II. Factual and Procedural Background

A. Amazon’s Virtual Try-On (VTO) Technology

Amazon’s VTO feature operates on its mobile website and app to let customers virtually “try on” products such as makeup and eyewear. During the relevant period, Amazon used two VTO programs:

• An in-house VTO system developed by Amazon; and
• A system developed by ModiFace, a third-party provider.

The operation is as follows:

• A customer browsing a product page can click a “try on” button.
• On first use, the app or mobile site prompts the user to grant device camera access.
• Users can choose between:
  • Using their own live video or photo; or
  • Using a “model mode,” which displays the product on a generic model’s face.
• If the user opts to use their own image, the VTO feature:
  • Activates the device camera;
  • Captures the user’s face from video or photo;
  • Analyzes facial geometry to determine where to place the virtual product (e.g., lips, eyes); and
  • Overlays the product image appropriately on the user’s face image.

The plaintiffs allege that this operation entails capturing and analyzing “facial geometry” that qualifies as “biometric identifiers” or “biometric information” under BIPA, and that Amazon stores, uses, and benefits from this biometric data without satisfying the statutory safeguards.

B. BIPA and the Plaintiffs’ Claims

BIPA was enacted to regulate the collection and use of immutable biometric identifiers—such as fingerprints and facial geometry—because compromising such data poses serious and irreversible privacy risks. The statute regulates the “collection, use, safeguarding, handling, storage, retention, and destruction of biometric identifiers and information.” 740 ILCS 14/5(g).

Two specific BIPA provisions are at issue:

• Section 15(a) requires private entities “in possession of” biometric data to:
  • Develop a written policy,
  • Make it publicly available, and
  • Include a retention schedule and guidelines for permanent destruction of biometric data.
• Section 15(b) prohibits any private entity from collecting, capturing, purchasing, receiving through trade, or otherwise obtaining a person’s biometric identifier or information unless the entity first:
  • Provides written notice that biometric data is being collected or stored;
  • Discloses the specific purpose and the length of time for which the data will be collected, stored, and used; and
  • Obtains a written release signed by the person.

BIPA is not extraterritorial: it applies only when the statutory violation occurs in Illinois, consistent with Illinois’ general rule that statutes lack extraterritorial effect absent clear contrary intent. The opinion relies on Avery v. State Farm Mutual Automobile Insurance Co., 835 N.E.2d 801 (Ill. 2005), and Dur-Ite Co. v. Industrial Commission, 68 N.E.2d 717 (Ill. 1946), for that principle.

The plaintiffs, Illinois users Tanya Svoboda and Antonella Ortiz Colosi, allege that:

• They used Amazon’s VTO in Illinois between 2019 and 2022 to test facial makeup products.
• Amazon collected, captured, stored, and used their facial geometry along with associated personal information.
• Amazon did the same for “thousands if not millions” of other Illinois users.
• Amazon failed to:
  • Provide proper BIPA-compliant written notice;
  • Disclose the purpose and retention period for the biometric data;
  • Obtain written releases; and
  • Maintain a publicly available retention and destruction policy for that biometric data.

They seek:

• Statutory damages under 740 ILCS 14/20:
• $1,000 per negligent violation;
• $5,000 per reckless or intentional violation;
• Injunctive relief; and
• Attorneys’ fees and costs.

At the time of suit, the governing rule from Cothron v. White Castle Systems, Inc., 216 N.E.3d 918 (Ill. 2023), was that a new BIPA claim accrues with “every scan” of biometric data. The Illinois legislature then amended BIPA in 2024 (Public Act 103‑0769) to cap statutory damages in some circumstances: under new Section 20(b), a covered entity that collects the same biometric data from the same person using the same method in violation of § 15(b) commits only a single violation. The Seventh Circuit notes this amendment but expressly declines to decide its impact, as damages were not at issue in this certification appeal.

C. Class Certification in the District Court

Plaintiffs moved to certify a Rule 23(b)(3) damages class defined as:

All individuals who used a [VTO] feature on Amazon’s mobile website or app while in Illinois on or after September 7, 2016.

The district court found Rule 23(a)’s requirements—numerosity, commonality, typicality, and adequacy—satisfied. Commonality was based on Amazon’s uniform alleged course of conduct: deploying the VTO feature without complying with BIPA.

Under Rule 23(b)(3), the court held:

• Predominance: Common issues about how the VTO operates and whether its use violates BIPA §§ 15(a) and 15(b) predominate over individual issues, though individual proof of whether each person used VTO “in Illinois” might be required.
• Superiority: A class action is superior because:
  • Individual suits would be unlikely given cost and complexity;
  • Common issues are central; and
  • The court can reduce damages if they would be unconstitutionally excessive.

Amazon pursued a discretionary interlocutory appeal under 28 U.S.C. § 1292(e) and Rule 23(f), challenging the predominance and superiority findings.

III. Summary of the Seventh Circuit’s Opinion

The Seventh Circuit affirms the class certification order, holding that:

1. Common liability questions predominate despite the need for individualized proof of location (i.e., whether each class member used VTO while in Illinois). Location-based proof can be handled through billing addresses, IP/geolocation data, and sworn affidavits without overwhelming the common issues.
2. Location is an individual question but not a fatal one. For purposes of this appeal, the court assumes location is an element of a BIPA claim, yet emphasizes that Rule 23(b)(3) does not require every element of a claim to be susceptible to classwide proof.
3. Amazon’s affirmative defenses (consent, failure to mitigate, waiver, and estoppel) do not defeat predominance because:
   • Consent, to the extent it exists, arises from a uniform practice (clicking “try on”); and
   • The other defenses and individualized damages issues can be handled in separate phases without eclipsing the central, common liability questions.
4. Class action treatment is superior to individual suits:
   • Even if aggregate statutory damages could reach tens of millions of dollars, that alone does not make a class action inferior.
   • The Illinois legislature chose to authorize statutory damages as a deterrent and remedial tool.
   • Costly, complex technical discovery concerning VTO operations, plus the absence of individual suits, support the conclusion that a class action is the most practical and efficient method of adjudication.

The court also reiterates the standard of review—abuse of discretion—and emphasizes that while the district court’s analysis of location was technically incomplete, the record and reasoning as a whole show no reversible error and no need for remand.

IV. Precedents Cited and Their Role in the Decision

A. BIPA and Illinois Law Precedents

• Fox v. Dakkota Integrated Systems, LLC, 980 F.3d 1146 (7th Cir. 2020) — Cited for BIPA’s history and legislative purposes, underscoring the legislature’s concern with the special sensitivity of biometric data and the need for strict regulation.
• Avery v. State Farm Mutual Automobile Ins. Co., 835 N.E.2d 801 (Ill. 2005), and Dur‑Ite Co. v. Industrial Commission, 68 N.E.2d 717 (Ill. 1946) — Provide the general Illinois principle that statutes are presumed not to apply extraterritorially unless the legislature clearly expresses such intent. This undergirds the shared assumption that BIPA violations must occur in Illinois, making “location” central.
• Cothron v. White Castle Systems, Inc., 216 N.E.3d 918 (Ill. 2023) — Holds that a BIPA claim accrues with “every scan” of biometric data, supporting the notion that repeated VTO uses can produce multiple violations (subject to the later statutory cap in the 2024 amendment).

B. Class Certification and Predominance Precedents

The court draws heavily on U.S. Supreme Court and Seventh Circuit class action precedents.

• Amchem Products, Inc. v. Windsor, 521 U.S. 591 (1997) — Establishes that Rule 23(b)(3)’s predominance requirement is “far more demanding” than Rule 23(a)’s commonality and provides factors for assessing predominance and superiority.
• Comcast Corp. v. Behrend, 569 U.S. 27 (2013) — Emphasizes that class certification requires “rigorous analysis,” especially regarding Rule 23(b)(3)’s predominance requirement.
• Tyson Foods, Inc. v. Bouaphakeo, 577 U.S. 442 (2016) — Clarifies that an “individual question” is one requiring member-by-member evidence, but that class certification remains proper where common issues predominate and individual issues (e.g., damages, affirmative defenses) can be addressed in separate phases.
• Amgen Inc. v. Connecticut Retirement Plans & Trust Funds, 568 U.S. 455 (2013) — Holds that Rule 23(b)(3) does not require every element of a plaintiff’s claim to be susceptible to classwide proof; some elements may be proved individually without defeating predominance.
• Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338 (2011) — Discusses the need for “common answers apt to drive the resolution of the litigation” and informs the Seventh Circuit’s focus on whether the VTO-related questions will cause the class to “prevail or fail in unison.”

The Seventh Circuit also leans on its own class action precedent:

• Eddlemon v. Bradley University, 65 F.4th 335 (7th Cir. 2023), and Santiago v. City of Chicago, 19 F.4th 1010 (7th Cir. 2021) — Emphasize that a district court must identify the elements of the claims, the necessary proof, and how those map onto common and individual questions. The panel finds the district court’s treatment of location somewhat thin but ultimately sufficient.
• Suchanek v. Sturm Foods, Inc., 764 F.3d 750 (7th Cir. 2014) — Rejects the idea that individual causation issues automatically defeat predominance in a consumer case and endorses a “final phase” for individualized proof of harm. This model is explicitly used to justify handling location and damages in a later phase here.
• Beaton v. SpeedyPC Software, 907 F.3d 1018 (7th Cir. 2018) — Clarifies that liability need not be resolved “in a single stroke” for all class members and that affidavits and auditing procedures can manage individualized issues without compromising predominance or due process.
• Scott v. Dart, 99 F.4th 1076 (7th Cir. 2024) — Upholds certification where common questions regarding inadequate dental care predominated despite individual questions about causation and damages. This analogy supports the idea that Amazon’s uniform conduct (VTO deployment) can anchor predominance even though not every class member’s circumstances are identical.
• Bell v. PNC Bank, N.A., 800 F.3d 360 (7th Cir. 2015), and Pella Corp. v. Saltzman, 606 F.3d 391 (7th Cir. 2010) — Support the view that individual damages and causation inquiries can be separated from common liability issues without undermining class certification.
• Mullins v. Direct Digital, LLC, 795 F.3d 654 (7th Cir. 2015) — Addresses due process and manageability of class actions, clarifying that:
  • Defendants do not have a due process right to a “cost-effective” means of challenging every individual claim; and
  • Proof through affidavits and proxy records can be consistent with due process.
• Messner v. Northshore University HealthSystem, 669 F.3d 802 (7th Cir. 2012) — Notes that where numerous common liability issues exist, superiority tends not to pose a serious obstacle.
• Murray v. GMAC Mortgage Corp., 434 F.3d 948 (7th Cir. 2006) — Critical on the damages issue. Murray holds that the mere possibility of very large aggregate statutory damages is not itself a reason to deny class certification. Instead, courts may address any constitutional excessiveness at the remedial stage by reducing an award.
• Mace v. Van Ru Credit Corp., 109 F.3d 338 (7th Cir. 1997) — Explains that many factors besides dollar value affect whether individuals will sue (awareness, willingness, access to counsel), supporting the view that BIPA’s statutory damages do not guarantee robust individual litigation.
• Gorss Motels, Inc. v. Brigadoon Fitness Inc., 29 F.4th 839 (7th Cir. 2022) — Indicates that consent given via uniform mechanisms may be amenable to classwide adjudication. This guides the court’s treatment of Amazon’s consent defense.
• Carnegie v. Household International, Inc., 376 F.3d 656 (7th Cir. 2004) — Emphasizes the flexibility courts have to modify or decertify classes as litigation evolves.

The Seventh Circuit situates Svoboda comfortably within this line of authority, using it as an application and refinement of existing principles rather than a radical departure.

V. The Court’s Legal Reasoning

A. The Rule 23 Framework: Commonality, Predominance, and Superiority

Rule 23(a) requires plaintiffs to demonstrate numerosity, commonality, typicality, and adequacy of representation. Once these are met, a damages class under Rule 23(b)(3) additionally requires:

• Predominance: Common questions of law or fact must “predominate” over individual questions.
• Superiority: The class action device must be superior to other available methods for fair and efficient adjudication.

The court emphasizes that predominance “builds on commonality,” but is “far more demanding” (Amchem, Comcast). It is not a mechanical counting exercise; courts must:

• Identify each claim’s elements;
• Determine what proof is needed for each element;
• Assess which issues can be resolved commonly and which require individualized proof; and
• Evaluate trial manageability and possible procedural tools.

Superiority involves a comparative assessment of a class action against realistically available alternatives, considering Rule 23(b)(3)’s factors (members’ interest in individual control, existing litigation, desirability of concentrating in a particular forum, and likely manageability issues).

B. Predominance: Location as an Individual Question Within a Common Liability Framework

1. Common BIPA Liability Questions

The court identifies several core questions that are common to all class members:

• Does VTO use “biometric” data?
  This is a technical, expert-driven question: whether VTO’s facial geometry analysis qualifies as “biometric identifiers” or “biometric information” under BIPA.
• Did Amazon “collect, capture, obtain, or possess” biometric data?
  This too is common, requiring examination of how the VTO systems (Amazon’s and ModiFace’s) operate and how data is transmitted, processed, stored, and associated with users.
• Section 15(a) questions:
  • Did Amazon have a written policy regarding retention and destruction of biometric data?
  • Was that policy publicly available?
  • Did it satisfy BIPA’s content requirements?
• Section 15(b) questions:
  • Did Amazon provide written notice that biometric data was being collected or stored?
  • Did Amazon disclose the purpose of collection and the length of time the data would be used or retained?
  • Did Amazon obtain written releases from users?

All of these hinge on Amazon’s uniform system design and company-wide policies and practices, making them prime candidates for classwide adjudication. The class will “prevail or fail in unison” on these questions.

2. Location as an Individualized Element

Because BIPA does not apply extraterritorially, a plaintiff must show that the relevant statutory violation occurred in Illinois. For purposes of this appeal, the Seventh Circuit assumes (without definitively deciding) that “location”—where the user was physically located during VTO use—is an element of a BIPA claim rather than merely a jurisdictional or class-definition matter.

This element raises an individualized factual question: for each class member, where were they located when they used VTO?

The plaintiffs propose using three categories of evidence to prove location:

• Billing addresses associated with Amazon accounts at the time of VTO use;
• IP addresses and geolocation data recorded by Amazon and a third-party vendor associated with VTO activity; and
• Affidavits or declarations by class members attesting that they used VTO while physically in Illinois.

Amazon’s own cybersecurity expert explained that:

• IP addresses can be mapped to approximate physical locations;
• Amazon contracts with a vendor that provides geolocation estimates, including the likely state of the device user; and
• Even the vendor’s most conservative accuracy estimate correctly identifies a city location within a 100‑kilometer radius more than half the time.

The record reflects some uncertainty concerning the completeness of IP address capture for all VTO uses, but Amazon’s deponent testified that for at least some uses Amazon maintains full IP address data associated with VTO records, enabling reasonable inferences about location.

The court candidly recognizes that:

• Some class members will be identified through robust billing/IP/geolocation data;
• For others, billing and geolocation data may conflict or be incomplete, necessitating sworn statements and additional proof; and
• In short, location is a genuine individualized factual issue.

3. Why Individual Location Issues Do Not Defeat Predominance

The key legal move is to place location in the category of permissible individualized issues that do not overwhelm the common liability questions.

Drawing on Amgen, Tyson Foods, Beaton, Suchanek, Bell, and Scott, the court stresses:

• Rule 23(b)(3) does not require every element be proved with common evidence.
  It is enough if common issues “predominate”—i.e., they are more central and more numerous than individual ones, and resolving them in one stroke produces significant efficiency gains.
• “Final phase” individualized adjudication is common and acceptable.
  Many class actions handle damages and individual causation in a later phase. Here, proof that each class member used VTO while physically in Illinois can be handled in such a phase, after common liability issues are resolved.
• The common issues are central and complex.
  The questions about VTO’s technical operation, whether it constitutes a BIPA‑regulated biometric capture, and whether Amazon complied with BIPA’s notice, policy, and consent regime are:
  • Uniform across class members;
  • Factually and legally complex;
  • Likely to require expert testimony and detailed technical discovery; and
  • Not sensibly repeated in thousands of individual trials.

Against that backdrop, individual proof of where a person was located when they clicked “try on” is treated as a manageable, secondary issue appropriate for individualized treatment without defeating predominance.

4. Manageability and Due Process

The court’s manageability analysis and its due process discussion for Amazon’s ability to challenge claims are interrelated.

On manageability (Rule 23(b)(3)(D)), the court:

• Accepts that none of the proxies (billing address, IP geolocation, affidavits) is perfect in isolation.
• Holds that, in combination, they can satisfy a preponderance-of-the-evidence standard for many claimants.
• Relies on Beaton and Mullins to endorse the use of affidavits supported by records and auditing procedures to manage individual issues.

On due process, Amazon argued that these imperfect proxies, coupled with the sheer size of the class, would deprive it of a fair opportunity to contest whether each claimant actually used VTO in Illinois.

The court rejects that argument, emphasizing:

• Amazon will still have a full opportunity to:
  • Challenge the reliability of the IP/geolocation and billing address data;
  • Attack the credibility or sufficiency of sworn affidavits;
  • Contend that certain subgroups lack sufficient evidence of Illinois use; and
  • Contest particular claims at the remedial stage.
• Due process does not entitle a defendant to a “cost-effective procedure for challenging every individual claim” (Mullins), only to a fair opportunity to challenge claims that matter for liability or damages.

Because location affects whether each class member personally suffered a statutory violation (and thus has an individual entitlement to damages), it is properly addressed later; but its individualized nature does not undermine the fairness or cohesiveness of resolving the central liability questions on a classwide basis.

C. Affirmative Defenses and Damages

1. Amazon’s Common-Law Defenses

Amazon raised several defenses that—if accepted—could reduce or bar recovery for certain users:

• Consent (arguing that users consented by choosing to use VTO and allowing camera access);
• Failure to mitigate (arguing that users who understood the technology but proceeded anyway should not recover full damages);
• Estoppel; and
• Waiver.

The parties dispute whether such common-law defenses are even available against BIPA statutory claims, but the Seventh Circuit assumes they may be and analyzes them in the certification context.

The court concludes:

• Consent is a common issue here.
  Because all users engage VTO in the same way—by clicking the “try on” button and granting camera access—any “consent” defense arising from that conduct can be adjudicated on a classwide basis. That is, the existence and scope of consent, if any, will turn on uniform disclosures, interfaces, and flows, not individualized conversations.
• The other defenses and damages issues do not predominate.
  Even if waiver, estoppel, or mitigation depend on some individualized facts, they are ancillary to the central liability questions and can be handled in a later remedial phase, consistent with Tyson Foods, Arandell, and Riffey.

The court also underscores the flexibility of Rule 23(c)(1): if, as litigation progresses, damages or defenses prove too individualized, the district court can modify or decertify the class or create subclasses. This forward-looking caution is a reminder that certification is conditionally revisitable.

2. Damages and Predominance

The opinion reaffirms the longstanding rule that the presence of individualized damages does not, by itself, defeat predominance. Damages questions are “ancillary” when the core liability issues are overwhelmingly common.

In this BIPA context:

• Damages will depend on:
  • Whether violations are negligent or reckless/intentional;
  • The number of qualifying VTO uses per class member (subject to the 2024 cap for § 15(b) violations); and
  • Whether any affirmative defenses limit particular class members’ recovery.
• Those issues can be resolved via:
  • Aggregate techniques (e.g., applying uniform assumptions about use frequency based on logs);
  • Individual claim submissions; or
  • Subclasses and tailored remedial structures, if needed.

Following Tyson Foods, the court treats such individual variations as compatible with predominance where the central liability questions unify the class.

D. Superiority and the Role of High Statutory Damages

On superiority, the court addresses two key themes:

1. Whether the potential size of aggregate and per-person statutory damages under BIPA undermines the rationale for class treatment; and
2. Whether, as a practical matter, individual litigation is a realistic alternative to a class action.

1. High Damages Do Not Automatically Defeat Superiority

Amazon warned that statutory damages of $1,000 or $5,000 per violation, multiplied across hundreds of thousands of VTO uses, could yield tens of millions (or more) in exposure. The Seventh Circuit’s response is firmly rooted in Murray:

• Large aggregate damages are the foreseeable consequence of legislative choices to:
  • Create per-violation statutory damages; and
  • Allow those rights to be enforced on a class basis.
• Rule 23 is not a substantive policy lever for reducing a legislature’s chosen deterrent and remedial scheme.
• Concerns that the final dollar figure might be unconstitutionally punitive can and should be addressed at the remedies stage through:
  • Remittitur;
  • Proportionality analysis; or
  • Other mechanisms to reduce an excessive award.

The court also notes that high individual damages do not, as a matter of law, bar class certification; Rule 23(b)(3) makes no such distinction (Amchem). The real question is whether, in practice, people have sufficient incentive and ability to sue individually.

2. Practical Barriers to Individual BIPA Suits

Looking at the record and experience with this litigation, the court agrees with the district judge that:

• The plaintiffs spent more than $100,000 on expert discovery concerning VTO’s operation.
• Highly technical issues (e.g., how Amazon and ModiFace process and store facial geometry) require substantial discovery and expert analysis.
• No meaningful individual BIPA litigation concerning Amazon’s VTO had emerged, despite the potential damages per person, suggesting:
  • Lack of awareness of the claim;
  • Reluctance to undertake complex, expensive litigation without a guaranteed payoff; and
  • Difficulty in securing counsel for individual claims.

Citing Mace and Suchanek, the court treats these real-world factors as strongly favoring a class action:

• Class treatment:
  • Spreads the cost of complex expert work across the class;
  • Enables the judicial system to resolve common technical issues once; and
  • Provides a realistic enforcement mechanism for statutory rights that might otherwise be underenforced.

Even if some individuals eventually pursue separate actions, those suits are likely to be sparse and inefficient compared to a single, well-managed class action that provides uniform resolutions to shared questions.

3. Other Superiority Considerations

The other Rule 23(b)(3) factors further support superiority:

• Interests in individual control: While some may prefer individual control if their potential damages are high, the record suggests this interest is weak in practice given the complexity and cost of litigation.
• Existing litigation: There is no significant parallel litigation by other Amazon VTO users.
• Concentration in a single forum: Centralizing claims in the Northern District of Illinois is desirable because Illinois law governs and the core issue—VTO’s BIPA compliance—arises from uniform conduct.
• Manageability: As already discussed, while location and damages present logistical challenges, they can be managed through structured procedures and do not outweigh the efficiency gains from resolving liability questions collectively.

The court concludes that class litigation is superior, while underscoring that certification remains subject to ongoing judicial oversight and potential recalibration as the case progresses.

VI. Key Legal Concepts Simplified

1. Biometric Identifiers and Biometric Information

Under BIPA:

• Biometric identifiers are specific physical traits used to identify individuals, such as:
  • Fingerprints;
  • Retina or iris scans;
  • Voiceprints; and
  • Scans of hand or face geometry.
• Biometric information is data derived from these identifiers that is used to identify an individual. For example, a mathematical model created from a face scan that allows a system to recognize that person later.

In this case, the alleged use of facial geometry by VTO to place virtual products on specific parts of a user’s face is what brings Amazon’s conduct within BIPA’s scope, assuming the data qualifies as a biometric identifier or information.

2. Non-Extraterritoriality

Illinois statutes generally apply only to conduct occurring within Illinois unless the statute expressly says otherwise. For BIPA, this means:

• A user in another state using VTO would not have a BIPA claim simply because Amazon is headquartered elsewhere or stores data in Illinois; and
• Plaintiffs must show that the collection or capture of biometric data occurred while they were in Illinois.

That is why “location” matters in this case.

3. Rule 23(b)(3) Predominance and Superiority

Predominance asks: Are the shared issues big and central enough that it makes sense to decide them once for everyone, rather than in thousands of separate suits? If yes, even if some details must be worked out individually later, predominance can be satisfied.

Superiority asks: Is a class action the best available way to fairly and efficiently resolve this dispute, compared to individual lawsuits, government enforcement, or other mechanisms?

4. IP Addresses and Geolocation as Evidence

An IP address is a numerical label assigned to an internet-connected device. Databases maintained by private companies can map IP addresses to approximate physical locations. This process is called “geolocation.” While not perfectly precise, it can often reliably indicate the state or metropolitan area of a user.

In this case, Amazon and its vendor’s geolocation data, combined with billing addresses and sworn statements, are used as evidence to show where users were located when they used VTO.

5. Statutory Damages and Constitutional Limits

Some statutes (like BIPA) provide fixed monetary awards for each statutory violation—statutory damages. These can be awarded without proof of actual financial harm, reflecting legislative judgments about privacy or consumer protection.

However, if the total statutory damages award is so large compared to the underlying conduct that it appears punitive and grossly disproportionate, it may raise constitutional due process concerns. Courts handle this not by denying class certification up front, but by:

• Evaluating proportionality after liability is established; and
• Reducing or adjusting the award if it is unconstitutionally excessive.

VII. Impact and Broader Significance

A. For BIPA Litigation Involving Remote and Online Technologies

Most early BIPA litigation focused on in-person systems such as fingerprint time clocks and physical access controls. Svoboda applies BIPA’s framework to a remote, consumer-facing technology—VTO—operated via mobile devices.

The decision signals that:

• Online and mobile platforms that use facial analysis or similar technologies for consumer convenience features (e.g., filters, virtual try-on, face-based personalization) can face BIPA exposure if they process data from Illinois users.
• Class certification is achievable even where proof of Illinois-based use depends on mixed electronic records and user testimony.

This will likely encourage:

• More BIPA class actions against remote services using face analytics or other biometric tools; and
• Greater scrutiny of how such services obtain consent and design disclosures, including whether they implement BIPA‑compliant retention and destruction policies.

B. Evidentiary Framework for Location in Non-Extraterritorial Statutes

The opinion offers a practical evidentiary roadmap for any statute limited to in-state conduct (not just BIPA):

• Courts may accept:
  • Account-level billing addresses;
  • IP address logs and geolocation data; and
  • User affidavits;
  as a combined, workable method to show that users were in the relevant state.
• Perfect precision is not required; what matters is whether the evidence can demonstrate, by a preponderance of the evidence, that a particular user was likely in-state.

Defendants will still be free to challenge the reliability of such data and the credibility of affidavits. But they will not be able to defeat predominance simply by pointing out that geographic location requires some individualized proof.

C. Limiting the Use of Damages Concerns at the Certification Stage

The decision reinforces a longstanding Seventh Circuit stance: concerns about large aggregate statutory damages should not be handled by denying or constricting class actions at the certification stage. Instead:

• Courts must respect legislatively chosen statutory damages for privacy violations.
• Any constitutional “excessiveness” question is reserved for the remedy stage, when actual conduct and violation counts are known.

This strengthens plaintiffs’ ability to pursue class actions under BIPA and similar statutes despite defendants’ arguments about “annihilating” damages.

D. Defenses and the Organization of Classwide Adjudication

By treating consent and certain other defenses as potentially common (or at least non‑predominant) issues, the opinion:

• Discourages overreliance on speculative individualized defenses at the certification stage; and
• Encourages district courts to:
  • Separate common liability issues from individualized remedial questions;
  • Use phasing, subclasses, and other tools; and
  • Revisit certification if later developments warrant it.

This structured approach supports efficient, fair adjudication of complex statutory privacy claims where the core conduct is uniform but users’ experiences and harms may differ at the margins.

VIII. Conclusion

Svoboda v. Amazon is a significant decision in both biometric privacy and class action jurisprudence. The Seventh Circuit:

• Affirms certification of a BIPA class challenging Amazon’s Virtual Try-On feature;
• Clarifies that individualized proof of Illinois-based use—via billing addresses, IP/geolocation data, and affidavits—does not defeat predominance where central liability questions are common;
• Holds that affirmative defenses and individualized damages issues may be addressed in later phases without undermining certification; and
• Reiterates that high potential statutory damages, even on a massive scale, are not a reason to deny class treatment, with constitutional concerns to be handled at the remedial stage.

The opinion provides a detailed framework for handling BIPA class actions involving remote technologies and will likely shape litigation strategies for both plaintiffs and defendants. More broadly, it reinforces a pro-certification approach to statutory privacy claims where common conduct and legal questions predominate, even if some elements and damages must ultimately be proved person by person.