Amazon Photos BIPA Class Action: Face Scans [2026]

Update — November 14, 2026: In Europe, Italy's Garante fined Meta €805 million over photo gallery access without specific consent: read the details.

A federal judge has certified an Illinois class in Hogan v. Amazon.com, Inc., a long-running fight over whether Amazon Photos built facial biometric data through its image recognition feature without BIPA consent. Biometric Update reported the certification on November 12, 2026. Amazon identified 339,847 Illinois-linked accounts that had image recognition enabled between October 18, 2016 and January 31, 2023, though not every account may ultimately qualify.

The case sits in the same legal lane as voiceprint suits and doorbell face scans. Our Walmart voiceprint BIPA post explains statutory damages, and the Ring Familiar Faces lawsuit covers home-camera biometrics. Amazon Photos is different: it is the album you already use, quietly grouping faces while you scroll vacations and school plays.

How Long Has Hogan v. Amazon Been Fighting in Court?

Biometric Update notes the litigation has run more than five years, which means certification in November 2026 reflects sustained plaintiff persistence, not a snap reaction to a single policy tweak. Long timelines are typical in BIPA class actions because defendants challenge both whether biometrics were collected and whether each scan counts as a discrete violation.

For account holders, the duration matters in a practical way. If you used Amazon Photos with recognition enabled during the October 18, 2016 through January 31, 2023 window, your account falls in the years the court is examining. Policies and toggles may have changed since 2023, but damages theories often look backward. Keep your own records of when you enabled or disabled face features if you think you might be affected.

Attorneys with Wexler Boley & Elgersma LLP lead the certified class, according to Biometric Update. Lead counsel changes do not change the core allegation: automatic face analysis in a consumer cloud product without the written release Illinois demands.

What Does the Complaint Say Amazon Photos Did?

According to Biometric Update's summary of Hogan v. Amazon, Amazon Photos obtains face biometric data through its image recognition feature, but plaintiffs allege Amazon did not obtain written consent, did not explain that biometric data was collected, and did not state purpose and retention clearly enough for Illinois law.

Amazon pointed to its Terms of Service. The certification ruling, as described by Biometric Update, found those terms did not include words such as biometric identifier, biometric information, or facial recognition. Users could also switch on recognition without viewing the notices plaintiffs say BIPA requires.

That factual pattern matters beyond Amazon. Any service that clusters faces, names people in thumbnails, or builds templates for search is doing biometric processing in BIPA's world, whether or not marketing calls it "organization."

What counts as collecting a biometric identifier?

BIPA defines biometrics broadly. Courts have applied it to fingerprint time clocks, voiceprints in call centers, and geometry extracted for face matching. Image recognition that converts a face into a template for later search fits the same theory even when the user experience feels like convenience. The plaintiff story in Hogan is that Amazon turned albums into a searchable biometric index without meeting notice-and-release steps.

Nothing in Biometric Update's certification story says Amazon admitted that characterization. The judge's order described enough common evidence to let the class try the theory together. Merits hearings will argue over engineering details plaintiffs may not fully control from outside.

Who Is In the Class and Who Is Out?

Biometric Update reports the certified class includes Illinois residents whose faces were processed in photographs uploaded to their own Amazon Photos accounts during the class period, with image recognition enabled. The court declined to certify a separate class for non-users whose faces appeared only in pictures someone else uploaded.

That split is huge for families and event photographers. If you attended a wedding in Chicago and the bride synced her camera roll to Amazon, you are not in this certified class as a non-user, but your face might still have been processed as part of her library. BIPA's private right of action has other theories, yet this ruling narrows the certified battle to account holders.

If you publish video professionally, the lesson is to blur guests before the couple uploads. You cannot control their cloud settings after delivery.

What Is BIPA and Why Do Face Tags Trigger It?

The Biometric Information Privacy Act is Illinois's strict biometric statute. Cornell's overview of 740 ILCS 14 summarizes the familiar quartet: written notice, stated purpose and retention, written release, and restrictions on sale and storage. Face geometry extracted for recognition fits comfortably in BIPA's scope, which is why photo apps keep losing summary judgment arguments when disclosures look generic.

Illinois is not the only state with biometric rules, but BIPA's private right of action made it the litigation capital. Texas and Washington restrict biometrics without identical damages models. California's CPRA treats certain biometrics as sensitive personal information. Comprehensive state privacy laws in Virginia, Colorado, and elsewhere add consent layers. Yet Hogan is Illinois-specific because that is where the statute bites hardest on consumer albums.

For international readers, the EU and UK treat face templates as special-category or high-risk data in many contexts. Our GDPR video compliance guide walks through lawful bases and redaction. BIPA is narrower geographically but sharper on written release, which is why U.S. platforms sometimes ship Illinois-only toggles years after launch.

Statutory damages are what make certification explosive. $1,000 per negligent violation and $5,000 per intentional or reckless violation, multiplied across hundreds of thousands of accounts, is why Biometric Update discusses hundreds of millions of dollars of potential exposure. Potential is not an award. Certification only means the case can move as a group.

Amazon is also defending other BIPA cases, including Just Walk Out retail biometrics and Alexa voiceprints, Biometric Update notes, while a separate AWS-related suit saw most claims defeated. Hogan is the consumer album story.

Did the Judge Decide Amazon Broke the Law?

No. Class certification is not a verdict. It answers whether plaintiffs can litigate together with a defined group. Amazon can still argue disclosures were adequate, that no biometrics were collected, or that Illinois law does not apply to specific flows. The company had not been found liable at the time of Biometric Update's reporting.

Still, the court's description of missing words in Terms of Service and skippable notices is a warning to anyone building face clustering. Generic cloud terms rarely mention biometrics even when computer vision is on by default.

How Does This Compare to Other Face Biometric Suits?

Illinois litigation is a template other states copy in spirit if not text. Walmart faces voiceprint allegations in our Walmart BIPA coverage. Ring's Familiar Faces feature triggered a separate biometric privacy conversation for doorbells. In Europe, noyb's complaints against Outlier and Scale AI target repeated face-video checks on gig workers under GDPR.

Amazon Photos is quieter than a doorbell or a checkout camera, but it is persistent. Albums sit for years. Face labels make search trivial. That is exactly what regulators call a retention risk, echoing themes in our GDPR video compliance guide, even when the controller is a consumer account rather than a broadcaster.

What Should Illinois Users Do While the Case Moves?

Nothing in this post is legal advice. Practical privacy steps still help.

1. Check whether face grouping is on in Amazon Photos and similar libraries. If you do not need search-by-face, disable it and read the current privacy notice.
2. Download and delete sensitive albums if you no longer want cloud face analysis. Deletion rights depend on terms and law; Illinois residents should read Amazon's biometric disclosures if updated after litigation pressure.
3. Watch for notices if you are in the certified class period. Class actions eventually mail or email claim forms when, and if, there is a settlement or judgment.
4. Blur before backup for new material, especially children's faces, protest photos, or client deliverables.

Could Non-Illinois Guests Still Be Harmed by Amazon Face Grouping?

Yes, even if they are not class members. When an Illinois host uploads a reunion video with recognition on, the engine may still template every face in frame. The November 2026 order simply declined to certify a non-user class in this case. Individual suits, regulatory complaints, or settlements could still reference those facts later.

That is why blur-before-sync is a cross-border habit. A couple in Illinois is the legal focus today; the photographed aunt from Wisconsin still has a privacy interest in not being biometrically indexed without knowledge. Ethically, blur strangers whether or not a court gives them a damages hook.

Journalists filming public events should apply the same rule before pushing B-roll to backup drives tied to face search. Our unauthorized filming and face blurring guide covers consent norms that sit beside BIPA.

What Should Creators and Families Publish Differently?

Creators outside Illinois still inherit the norm BIPA forced: treat faces like biometrics. Wedding videographers, school bloggers, and neighborhood vloggers should assume any cloud backup with recognition enabled may template every visible guest.

Workflow:

1. Finish the edit in your usual tool.
2. Upload the export to BGBlur and run AI face blur with motion tracking on video, or batch stills for events.
3. Export de-identified copies for client delivery or social posts.
4. Upload only the blurred version to Amazon, Google, or Apple libraries if you must use cloud sync.

BGBlur runs in the browser, deletes uploads within 24 hours, and does not replace a lawyer's reading of BIPA. It does reduce the odds you spread high-resolution identifiable faces when statutes expect informed consent.

For deeper anonymization choices, compare blur versus synthetic face replacement. For redaction failures elsewhere, see how to censor video online.

How Does Amazon Photos Face Recognition Compare to Phone Gallery Features?

Apple, Google, and Samsung ship on-device people albums that feel similar. Vendor policies differ on whether templates leave the device, whether cloud sync replicates biometrics, and which states get extra disclosures. Hogan is about Amazon's implementation during a defined period, not every gallery app on the market.

The comparison still shapes consumer expectations. If your phone already groups faces locally, you may forget that a separate Amazon sync duplicates those templates in another legal jurisdiction. Disabling sync for event media, or blurring before upload, keeps one controlled copy instead of several cloud interpretations of the same smile.

Ring and Alexa biometric fights show Amazon has defended multiple BIPA theories. Photos is the everyday sibling: less sensational than a doorbell identifying a neighbor, more widespread because nearly everyone backs up pictures.

What Are Amazon's Options After Certification?

Biometric Update does not quote a post-certification Amazon statement in the article we reviewed. Expect merits litigation on whether image recognition extracts BIPA-covered identifiers, whether in-app toggles count as releases, and how damages should be counted per user, per photo, or per scan.

Settlement is common in BIPA class actions after certification, but terms vary. Some settlements fund notice programs; others pay per class member. Until then, competitors will market privacy-first albums, and regulators outside Illinois will cite Hogan in comment letters.

What Should You Do Today? A Numbered Checklist

1. Inventory where face clustering runs — phone gallery, spouse's shared album, work Slack backups, Ring snapshots.
2. Turn off recognition you do not need or migrate to storage without biometric search.
3. Blur faces in outbound video and photos before they hit any sync folder.
4. Document consent when you intentionally photograph identifiable people for commercial use; BIPA is about collection, but contracts still matter.
5. Follow Hogan if you are an Illinois account holder; certification makes outcomes relevant to you directly.

Conclusion: Cloud Convenience Still Has a Biometric Bill

The November 12, 2026 certification order did not say Amazon broke the law, but it did say enough Illinois users might have the same BIPA story to try the case together. Terms without the word biometric, toggles users never see, and face templates built while you organize holiday cards — that is the modern face-recognition fight, and it is quieter than a squad car camera.

If you publish images or video, assume someone else's algorithm will scan every unobstructed face you upload. Blur first, sync second, and read the notices before you click enable. BGBlur is built for that second step: fast face blur in the browser, no install, and files gone within a day. The Hogan class will spend years in court; your next upload can take minutes to fix.