A federal judge in Illinois has ruled that a string of 128 numbers can count as a scan of someone’s face, and that encrypting those numbers does not put them out of the company’s hands.

On 30 September, Judge Nancy J. Rosenstengel of the US District Court for the Southern District of Illinois ruled on summary judgment in Doe v. Apple, case 3:20-cv-421-NJR. The case concerns the People album in the Photos app, which groups pictures of the same person. Apple won one narrow point and lost the rest. The order was unsealed in early October. No trial date has been set.

The ruling is about a photo-sorting feature. Its reasoning applies to anyone who creates or keeps a face template.

What the court decided

A cropped photo of a face is just a photo. Photos cuts a crop around each face it detects. The court agreed with Apple that the crop itself carries no facial geometry, granted summary judgment on that point, and decertified the iCloud subclass whose claim rested on crops alone.

The 128-number faceprint may be biometric data. Photos turns each crop into a 128-number vector that its own engineers call a faceprint. Apple argued the numbers measure nothing on a face. The court held that the Illinois Biometric Information Privacy Act does not limit “scan of face geometry” to measured distances, and that a jury could find the vector qualifies.

What a template could do matters more than what it is used for. Apple said Photos only groups similar faces and never identifies anyone. The court said the question is whether the faceprint is capable of identifying a person, not whether the company uses it that way.

Encryption is not a defense to control. Apple argued it cannot read faceprints synced to iCloud. The court said control means the power to rewrite, publish, decrypt or delete data, and that Apple has that power over its own servers and software whether or not it can read the bytes.

Notice and consent were never in dispute. According to the order, it is undisputed that Apple did not publish a retention and destruction policy for the feature or obtain written consent from Illinois users. That is why the fight is over what counts as biometric data and who holds it.

The class was certified on 5 June and could include as many as 6.5 million Illinois residents. BIPA allows $1,000 per negligent violation and $5,000 per intentional or reckless one.

Four lessons for anyone holding face data

1. Do not create a template you do not need. The one point Apple won was the image with no template behind it. A system that never builds a faceprint for an ordinary person has far less to defend.

2. If you keep one, publish the schedule and get the consent first. BIPA requires a public retention and destruction policy and written consent before collection. Those are not paperwork after the fact; they are the conditions for holding the data at all.

3. Encryption is a security control, not an exemption. The statute separately requires reasonable care in protecting biometric data. Encrypting it meets that duty. It does not answer whether you were allowed to collect it.

4. “It stays on the device” is not the end of the analysis. A Seventh Circuit decision this year suggested data parked on a user’s phone falls outside BIPA. This order narrows that: where the vendor writes the software, sets retention and can push an update that changes or deletes the data, a jury may find the vendor controls it.

How we approached the same problem

Safience was designed so that the question of who controls a face template for an ordinary passerby does not come up.

• A captured image that does not match a relevant record is deleted immediately. No template is kept on anyone.
• Nothing is stored on the sensor, and there is no video.
• Operator lists in X-LST hold photographs, not biometric templates.
• Every comparison runs against records created by law enforcement, never social media, scraped photos or consumer data.
• A trained analyst reviews every potential match before an alert goes out.

Rules differ by state, and Illinois is not the only one with its own statute. Our state privacy policy pages explain how Safience operates in each.

Questions to ask any vendor

1. Does your system create a template for people who are not on a list, and how long does it exist?
2. Where is it stored, and who can push an update that changes or deletes it?
3. Where is your published retention and destruction schedule?
4. What consent do you collect, from whom, and before what step?

This post summarizes public reporting on a court order. It is not legal advice.

Sources

• PPC Land, “Apple loses bid to end Illinois suit over faceprints in iPhone Photos,” 10 Oct 2026. https://ppc.land/apple-loses-bid-to-end-illinois-suit-over-faceprints-in-iphone-photos/
• AppleInsider, “Apple Photos faceprint privacy lawsuit pared down a bit, will continue,” 19 Oct 2026. https://appleinsider.com/articles/26/10/19/apple-photos-faceprint-privacy-lawsuit-pared-down-a-bit-will-continue
• Law360, “Apple Faces Trimmed Down BIPA Trial Over Faceprint Claims,” 9 Oct 2026. https://www.law360.com/articles/2536320/apple-faces-trimmed-down-bipa-trial-over-faceprint-claims
• BetaNews, “Apple’s $32.5 billion Photos lawsuit clears federal appeals court,” 4 Aug 2026. https://betanews.com/article/apple-32-5-billion-bipa-lawsuit/
• 9to5Mac, “Judge greenlights multi-billion-dollar class action over Apple Photos’ face recognition,” 3 Aug 2026. https://9to5mac.com/2026/08/03/judge-greenlights-multi-billion-dollar-class-action-over-apple-photos-face-recognition/

Featured photo by Jon Tyson on Unsplash. Inline photo by Tucker Good on Unsplash.