In the
United States Court of Appeals
For the Seventh Circuit
____________________
No. 20-1443
CHRISTINE BRYANT,
Plaintiff-Appellee,
v.
COMPASS GROUP USA, INC.,
Defendant-Appellant.
____________________
Appeal from the United States District Court for the
Northern District of Illinois, Eastern Division.
No. 19 C 6622 — Virginia M. Kendall, Judge.
____________________
ARGUED APRIL 24, 2020 — DECIDED MAY 5, 2020
____________________
Before WOOD, Chief Judge, and RIPPLE and ROVNER, Circuit
Judges.
WOOD, Chief Judge. Section 15(b) of Illinois’s Biometric In-
formation Privacy Act (BIPA), 740 ILCS 14 (2008), regulates
the collection, use, and retention of a person’s biometric iden-
tifiers or information. It requires collectors of this material to
obtain the written informed consent of any person whose data
is acquired. This regime is designed to protect consumers
against the threat of irreparable privacy harms, identity theft,
2 No. 20-1443
and other economic injuries arising from the increasing use of
biometric identifiers and information by private entities. As a
matter of state law, anyone “aggrieved” by a violation of the
disclosure and informed consent obligations is entitled to
bring a private action against the alleged offender. The ques-
tion now before us is whether, for federal-court purposes,
such a person has suffered the kind of injury-in-fact that sup-
ports Article III standing. We conclude that a failure to follow
section 15(b) of the law leads to an invasion of personal rights
that is both concrete and particularized. See Spokeo, Inc. v. Rob-
ins, 136 S. Ct. 1540 (2016). We therefore reverse the district
court’s order remanding this case to state court and remand
for further proceedings.
I
The underlying facts of the case are straightforward.
Christine Bryant worked for a call center in Illinois. As a con-
venience for its employees, the center had a workplace cafe-
teria, in which it had installed Smart Market vending ma-
chines owned and operated by Compass Group USA, Inc. The
machines did not accept cash; instead, a user had to establish
an account using her fingerprint. Accordingly, during her ori-
entation Bryant and her coworkers were instructed by their
employer to scan their fingerprints into the Smart Market sys-
tem and establish a payment link to create user accounts.
Once their accounts were active, employees could purchase
items and add money to their balance using just their finger-
prints. Their fingerprints are “biometric identifiers” within
the meaning of the Act. 740 ILCS 14/10.
In violation of section 15(a) of BIPA, id. § 15(a), Compass
never made publicly available a retention schedule and
No. 20-1443 3
guidelines for permanently destroying the biometric identifi-
ers and information it was collecting and storing. In addition,
in violation of section 15(b), Compass never: (1) informed Bry-
ant in writing that her biometric identifier (fingerprint) was
being collected or stored, (2) informed Bryant in writing of the
specific purpose and length of term for which her fingerprint
was being collected, stored, and used, or (3) obtained Bryant’s
written release to collect, store, and use her fingerprint. Id.
§ 15(b).
Bryant does not assert that she did not know that her fin-
gerprint was being collected and stored, nor why this was
happening. She voluntarily created a user account for the
Smart Market vending machines and regularly made use of
the fingerprint scanner to purchase items from the machines.
She contends simply that Compass’s failure to make the req-
uisite disclosures denied her the ability to give informed writ-
ten consent as required by section 15(b). Compass’s failure to
comply with the Act resulted, both for her and others simi-
larly situated, in the loss of the right to control their biometric
identifiers and information.
Seeking redress for that invasion of her personal data, on
August 13, 2019, Bryant brought a putative class action
against Compass in the Circuit Court of Cook County, pursu-
ant to BIPA’s provision providing a private right of action in
state court to persons “aggrieved” by a violation of the stat-
ute. See 740 ILCS 14/20; Rosenbach v. Six Flags Entm’t Corp., 432
Ill. Dec. 654 (Ill. 2019). Bryant seeks to represent a class of Illi-
nois citizens who used Compass’s Smart Market biometric-
enabled vending machines after August 2014. She alleges that
Compass violated her and class members’ statutory rights un-
der BIPA when it collected users’ fingerprints without first
4 No. 20-1443
making the required written disclosures about use and reten-
tion and without written authorization. See 740 ILCS
14/15(a)–(b). For purposes of the standing issue before us, we
accept Bryant’s allegations as true.
Compass removed the action to federal court under the
Class Action Fairness Act (CAFA), 28 U.S.C. § 1332(d), on the
basis of diversity of citizenship and an amount in controversy
exceeding $5 million. Compass is incorporated in Delaware
and has its principal place of business in North Carolina; Bry-
ant is a citizen of Illinois. This is enough to assure the minimal
diversity required by CAFA. The requisite amount in contro-
versy is also secure: claims of individual class members are
aggregated for purposes of CAFA, see 28 U.S.C. § 1332(d)(6),
and here, BIPA authorizes statutory damages of $5,000 for
each intentional or reckless violation. 740 ILCS 14/20(1)–(2).
Compass asserts, and Bryant does not contest, that the alleged
class has at least 1,000 members.
Bryant moved to remand the action to the state court,
claiming that the district court did not have subject-matter ju-
risdiction because she lacked the concrete injury-in-fact nec-
essary to satisfy the federal requirement for Article III stand-
ing. (State law apparently poses no such problem, we note, as
the Illinois Supreme Court pointed out in Rosenbach.)
The district court found that Compass’s alleged violations
of sections 15(a) and (b) were bare procedural violations that
caused no concrete harm to Bryant; accordingly, it remanded
the action to the state court. Compass petitioned this court for
permission to appeal the remand order under 28 U.S.C.
§ 1453(c); on March 13, 2020, we accepted the appeal.
No. 20-1443 5
II
A
As the party invoking federal jurisdiction, Compass bears
the burden of establishing Bryant’s Article III standing. See
Collier v. SP Plus Corp., 889 F.3d 894, 896 (7th Cir. 2018) (per
curiam). This fact has occasioned a role reversal in the argu-
ments we normally see in these cases, with the defendant in-
sisting that Article III standing is solid, and the plaintiff cast-
ing doubt on it.
For Bryant to have Article III standing, three requirements
must be satisfied: (1) she must have suffered an actual or im-
minent, concrete and particularized injury-in-fact; (2) there
must be a causal connection between her injury and the con-
duct complained of; and (3) there must be a likelihood that
this injury will be redressed by a favorable decision. Lujan v.
Defs. of Wildlife, 504 U.S. 555, 560–61 (1992). Only the first of
those criteria is at issue here: any injury she suffered was
caused directly by Compass’s failure to comply with BIPA,
and the prospect of statutory damages shows that such an in-
jury is redressable.
In Spokeo, the Supreme Court explained that a “concrete”
injury must actually exist but need not be tangible. 136 S. Ct.
at 1548–49. A legislature may “elevate to the status of legally
cognizable injuries concrete, de facto injuries that were previ-
ously inadequate in law.” Id. (quoting Lujan, 504 U.S. at 578).
But “a bare procedural violation, divorced from any concrete
harm,” does not “satisfy the injury-in-fact requirement of Ar-
ticle III.” Id. “Instead, the plaintiff must show that the statu-
tory violation presented an ‘appreciable risk of harm’ to the
underlying concrete interest that [the legislature] sought to
6 No. 20-1443
protect by enacting the statute.” Groshek v. Time Warner Cable,
Inc., 865 F.3d 884, 887 (7th Cir. 2017) (quoting Meyers v. Nicolet
Rest. of De Pere, LLC, 843 F.3d 724, 727 (7th Cir. 2016)).
Compass urges that BIPA has elevated to protectible status
a person’s inherent right to control her own body, including
the associated biometric identifiers and information. The vio-
lation or trespass upon that right, it reasons, is a concrete in-
jury-in-fact for standing purposes. Compass relies on the Illi-
nois Supreme Court’s recent decision in Rosenbach, in which
that court decided who qualifies as an “aggrieved” person for
purposes of a state-court action pursuant to BIPA. The state
supreme court had no cause to consider Article III standing
requirements, but Compass argues that its conclusions about
the interests BIPA was intended to protect nonetheless shed
light on the question before us.
In Rosenbach, the plaintiff alleged that defendant Six Flags
violated the procedures spelled out in section 15(b). 432 Ill.
Dec. at 658–59. Six Flags argued that the plaintiff had to allege
more in order to pursue her action—some tangible injury or
harm. Id. at 659. The Illinois appellate court agreed with that
contention, but the Illinois Supreme Court reversed, explain-
ing that it is the well-established understanding in Illinois that
“a person is prejudiced or aggrieved, in the legal sense, when
a legal right is invaded by the act complained of or his pecu-
niary interest is directly affected by the decree or judgment.”
Id. at 662 (internal citation and quotation marks omitted). Be-
cause section 15(b) of BIPA confers a right to receive certain
information from an entity that collects, stores, or uses a per-
son’s biometric information, the violation of that right, stand-
ing alone, is an actionable grievance. Id. at 663.
No. 20-1443 7
Compass highlights the fact that the Illinois Supreme
Court recognized that “[t]hrough the Act, our General Assem-
bly has codified that individuals possess a right to privacy in
and control over their biometric identifiers and biometric in-
formation.” Id. A key part of the right to control biometric in-
formation is “the power to say no by withholding consent.”
Id. When an entity fails to adhere to the statutory procedures
and thereby denies someone the ability to make an informed
decision about whether to provide her biometric identifier,
“the right of the individual to maintain his or her biometric
privacy vanishes into thin air” and “[t]he precise harm the Il-
linois legislature sought to prevent is then realized.” Id. (in-
ternal citation and quotation marks omitted). And as Com-
pass emphasizes, the court declared that such a violation “is
no mere ‘technicality.’ The injury is real and significant.” Id.
In Compass’s view, the Illinois Supreme Court’s characteriza-
tion of BIPA’s purpose and the nature of the injury is dispos-
itive.
Helpful though Rosenbach may be, however, we cannot un-
critically assume perfect overlap between the question before
the state court and the one before us. As we alluded to earlier,
standing requirements in Illinois courts are more lenient than
those imposed by Article III. See Greer v. Illinois Hous. Dev.
Auth., 122 Ill. 2d 462, 491 (1988) (“We are not, of course, re-
quired to follow the Federal law on issues of justiciability and
standing.”); Duncan v. FedEx Office and Print Servs., Inc., 429
Ill. Dec. 190, 197 (Ill. App. Ct. 2019) (“Illinois courts generally
are not as restrictive as federal courts in recognizing the
standing of a plaintiff to bring a claim. Although federal law
and Illinois law both require an ‘injury in fact’ to find stand-
ing, it does not necessarily mean that both forums define that
8 No. 20-1443
requirement in the same way.” (internal citations and quota-
tion marks omitted)). As understood by Illinois courts, for an
injury-in-fact to be considered “‘actual’ does not mean that a
wrong must have been committed and an injury inflicted; ra-
ther, the term requires a showing that the underlying facts
and issues of the case are not moot or premature.” Messenger
v. Edgar, 157 Ill. 2d 162, 170 (1993).
In short, federal courts and Illinois courts define “injury-
in-fact” differently. With this in mind, we must inde-
pendently determine whether the BIPA violations Bryant al-
leges suffice to support Article III standing.
B
There have been only a few BIPA cases in federal circuit
courts; none has decided the precise standing question pre-
sented here. We describe them briefly in order to show how
far they did, or did not, go.
In Miller v. Southwest Airlines Co., 926 F.3d 898 (7th Cir.
2019), we held that union airline workers had standing to
bring claims of violations of sections 15(a) and (b) of BIPA in
federal court. We found that the workers had alleged the
“concrete dimension” necessary to establish Article III injury-
in-fact because they faced the “prospect of a material change
in [their] terms and conditions of employment,” if the em-
ployer, in light of the Act, had to bargain with the employee
union to obtain employees’ consent or change how employees
clocked in. Id. at 902. Additionally, the employees alleged a
heightened risk of improper dissemination of biometric infor-
mation if the employers were “not following the statutory
data-retention limit and … used outside parties to administer
their timekeeping systems.” Id.
No. 20-1443 9
In Patel v. Facebook, Inc., 932 F.3d 1264 (9th Cir. 2019), the
Ninth Circuit held that plaintiffs alleged a sufficiently con-
crete injury for Article III standing purposes when they
claimed that Facebook’s use of facial-recognition technology
without users’ informed consent violated Illinois’s BIPA. The
court concluded that the common-law right to privacy sup-
plied a concrete interest that was infringed by an “invasion of
an individual’s biometric privacy rights.” Id. at 1273. It also
noted that the BIPA provisions at issue were intended “to pro-
tect an individual’s ‘concrete interests’ in privacy, not merely
procedural rights.” Id. at 1274.
In contrast, in a nonprecedential disposition the Second
Circuit concluded that a plaintiff bringing Illinois BIPA claims
against a video-game company lacked Article III standing be-
cause none of the alleged procedural violations raised “a ma-
terial risk of harm” to a plaintiff’s interest in “prevent[ing] the
unauthorized use, collection, or disclosure of an individual’s
biometric data.” Santana v. Take-Two Interactive Software, Inc.,
717 F. App’x 12, 15 (2d Cir. 2017) (summary order). The alle-
gations showed that the plaintiff had already given as much
consent as one could imagine, by agreeing to the scan of his
face, sitting still for fifteen minutes while the scan took place,
and creating his game avatar for use in online games. All that
was left was a bare procedural violation.
The majority of the district courts in this circuit have re-
jected standing for plaintiffs alleging only violations of sec-
tions 15(a) and (b), without some further harm. See Hunter v.
Automated Health Sys., Inc., 2020 WL 833180 (N.D. Ill. Feb. 20,
2020); Colon v. Dynacast, LLC, 2019 WL 5536834 (N.D. Ill. Oct.
17, 2019); McGinnis v. United States Cold Storage, Inc., 382 F.
Supp. 3d 813 (N.D. Ill. 2019); Aguilar v. Rexnord LLC, 2018 WL
10 No. 20-1443
3239715 (N.D. Ill. July 3, 2018); Goings v. UGN, Inc., 2018 WL
2966970 (N.D. Ill. June 13, 2018); Howe v. Speedway LLC, 2018
WL 2445541 (N.D. Ill. May 31, 2018); McCollough v. Smarte
Carte, Inc., 2016 WL 4077108 (N.D. Ill. Aug. 1, 2016); but see
Figueroa v. Kronos Inc., 2020 WL 1848206 (N.D. Ill. Apr. 13,
2020). These decisions are not binding on us, however, and
they did not rest on the nature of the interest BIPA seeks to
protect—personal or public (see Spokeo, Thomas, J., concur-
ring), informational, or formal. We consider this a question of
first impression.
C
Our starting point is Spokeo itself, which provides substan-
tial guidance about cases alleging the kind of intangible harm
to personal interests that Bryant asserts. In addition, her right-
to-control claim is fundamentally about the informed consent
requirement in section 15(b); this gives rise to a question
about informational injury, and more broadly about how
Compass’s collection, storage, and use of Bryant’s fingerprint,
even for purposes of which she was fully aware, might be a
concrete injury either because it is closely analogous to histor-
ical claims for invasion of privacy or because she lost her right
to control her own biometric information and effectively
yielded it to Compass. We begin with a closer look at Spokeo,
and we then look at other examples of the harm (or lack
thereof) from a company’s failure to disclose information it
was obligated by law to provide to a consumer.
The statute at issue in Spokeo was the Fair Credit Reporting
Act (FCRA). Spokeo was a company that called itself a “peo-
ple search engine.” Customers could ask it to scour a wide
variety of sources for information about someone, and it
No. 20-1443 11
would return a report to them. Someone asked Spokeo to pre-
pare such a report on plaintiff Robins. It did so, and Robins
eventually found out about the report, which he said was rid-
dled with inaccuracies. Citing a number of injuries that he al-
leged this report had inflicted, or would inflict upon him, no-
tably a number of adverse effects on his ongoing job search,
Robins filed a suit against Spokeo under FCRA. The district
court dismissed his action for lack of Article III standing, but
the Ninth Circuit reversed. The Supreme Court took the case
to consider the standing issue.
In the end, it did not rule one way or the other on Robins’s
standing. It found instead that the Ninth Circuit had used the
wrong test for injury-in-fact. That court had focused exclu-
sively on the question whether Robins had alleged a particu-
larized harm, which the Supreme Court was willing to assume
that he had. But, while necessary, the Court held that this was
not sufficient. 136 S. Ct. at 1548. Article III also requires an in-
jury that is concrete. Explaining, the Court said that “[a] ‘con-
crete’ injury must be ‘de facto’; that is, it must actually exist.”
Id. But, it added, “‘[c]oncrete’ is not, however, necessarily syn-
onymous with ‘tangible.’ Although tangible injuries are per-
haps easier to recognize, we have confirmed in many of our
previous cases that intangible injuries can nevertheless be
concrete.” Id. at 1549. In addition, the risk of real harm can suf-
fice, id., and injury-in-fact is not defeated just because the in-
jury is “difficult to prove or measure,” id.
Because the court of appeals failed to address the concrete-
ness criterion, the Supreme Court thought it best to remand
for application of the proper test. In essence, the task was to
decide whether, in the relevant part of FCRA, Congress had
identified a concrete injury that met Article III minima and
12 No. 20-1443
created a right for people in Robins’s position to sue on that
claim, or if Robins was complaining about no more than a
“bare procedural violation,” id. at 1550, which would not be
enough to engage the judicial power.1
Justice Thomas joined the majority’s opinion, but he
added a concurrence that drew a useful distinction between
two types of injuries. The first, he said, arises when a private
plaintiff asserts a violation of her own rights; the second oc-
curs when a private plaintiff seeks to vindicate public rights.
As examples of the first, he mentioned actions for trespass,
infringement of intellectual property rights, and unjust en-
richment, id. at 1551; as examples of the second, he pointed to
actions seeking to abate a public nuisance, or disputes over
the use of public land, id. at 1551–52.
Applying Justice Thomas’s rubric, we have no trouble con-
cluding that Bryant was asserting a violation of her own
rights—her fingerprints, her private information—and that
this is enough to show injury-in-fact without further tangible
consequences. This was no bare procedural violation; it was
an invasion of her private domain, much like an act of trespass
would be. Each individual person has distinct biometric iden-
tifiers. The common interest in robust protections of personal
privacy, however, is the same as the shared support for the
types of laws Justice Thomas mentioned. A direct application
of Spokeo, in our view, leads to the result that Bryant satisfied
the injury-in-fact requirement of Article III.
1 On remand, the Ninth Circuit concluded that Robins had adequately
alleged both a concrete and a particular interest for Article III purposes,
and so it found that he had standing to sue. Robins v. Spokeo, Inc., 867 F.3d
1108, 1118 (9th Cir. 2017), cert. denied, 138 S. Ct. 931 (2018).
No. 20-1443 13
If we instead analyze this case as a type of informational
injury, we come to the same conclusion. Usually these cases
arise when information that is required by statute to be dis-
closed to the public is withheld. See, e.g., Fed. Election Comm’n
v. Akins, 524 U.S. 11, 19–25 (1998). The injury inflicted by non-
disclosure is concrete if the plaintiff establishes that the with-
holding impaired her ability to use the information in a way
the statute envisioned. See Bensman v. U.S. Forest Serv., 408
F.3d 945, 955–56 (7th Cir. 2005); see also Akins, 524 U.S. at 20–
21 (plaintiffs’ inability to obtain information with which they
could more effectively evaluate candidates for public office “is
injury of a kind that [the Federal Election Campaign Act]
seeks to address”); Pub. Citizen v. U.S. Dep’t of Justice, 491 U.S.
440, 449 (1989) (“[R]efusal to permit appellants to scrutinize
the [American Bar Association] Committee’s activities to the
extent [the Federal Advisory Committee Act] allows consti-
tutes a sufficiently distinct injury to provide standing to
sue.”).
Our recent decisions on informational injuries are instruc-
tive. In Groshek v. Time Warner Cable, the plaintiff argued that
his prospective employer violated FCRA’s requirement that
an employer seeking to obtain a consumer report on a pro-
spective employee had to give the applicant a stand-alone
written disclosure stating that a consumer report may be ob-
tained. 865 F.3d at 884–89. Instead of a stand-alone disclosure
document, Time Warner provided Groshek with a document
that contained the required disclosure as well as other infor-
mation. Groshek signed the form, thereby authorizing Time
Warner to obtain his consumer report. We concluded that
Time Warner’s violation of the stand-alone disclosure require-
ment inflicted only “a statutory violation completely removed
from any concrete harm or appreciable risk of harm.” Id. at
14 No. 20-1443
887. Critically, FCRA “does not seek to protect Groshek from
the kind of harm he claims he has suffered, i.e., receipt of a
non-compliant disclosure.” Id. at 888. Instead, the purpose of
FCRA is “to decrease the risk that a job applicant would un-
knowingly consent to allowing a prospective employer to
procure a consumer report.” Id. Groshek did not allege that
he was unable to give knowing and informed consent because
the disclosure document he received also contained other in-
formation; thus, he did not allege a concrete injury that Con-
gress made cognizable.
In Robertson v. Allied Solutions, LLC, 902 F.3d 690 (7th Cir.
2018), in contrast, a company failed to provide a prospective
employee with a copy of her background report before re-
scinding her employment offer on the basis of information
contained in that report. We held that this omission consti-
tuted an injury-in-fact for a FCRA claim. Robertson’s informa-
tional injury was both particularized and concrete because
she had a “substantive interest,” protected by FCRA, in being
able to “review the reason for any adverse decision and to re-
spond.” Id. at 696. The critical question, we said, is whether
“the plaintiff is entitled to receive and review substantive in-
formation.” Id. at 697 (emphasis added). “Article III’s stric-
tures are met not only when a plaintiff complains of being de-
prived of some benefit, but also when a plaintiff complains
that she was deprived of a chance to obtain a benefit.” Id. Ac-
cordingly, it was “immaterial” that Robertson did not plead
what she would have done if she had been given the chance
to respond. Id. It was sufficient that Robertson, unlike
Groshek, was wholly deprived of the information necessary
to respond in the way FCRA contemplated.
No. 20-1443 15
It is possible, however, to plead oneself out of court. That
is what happened in Casillas v. Madison Avenue Associates, 926
F.3d 329 (7th Cir. 2019). In that case, a debt collector failed to
inform a debtor that any response to its debt collection notice
needed to be in writing, as the Fair Debt Collection Practices
Act required. We drew a contrast between the substantive in-
formation the plaintiff in Robertson was denied—information
on which her prospective employer relied when rescinding
her employment offer—and the purely procedural flaw in
Casillas’s case. Casillas pointed to nothing that hinged on the
difference between oral and written notice and gave no reason
to think that any harm resulted from the type of notice she
received. Id. at 334–35. Indeed, she admitted that no amount
of notice or information would have changed her behavior. In
those circumstances, Casillas lacked standing to sue the debt
collector for its technical violation of the Act. Id. at 335.
Returning to the facts presented here, the substantive and
personal nature of the information Compass was obligated
under BIPA to disclose to consumers such as Bryant makes
this case more like Robertson than Casillas for purposes of her
claim under section 15(b). As the Illinois Supreme Court rec-
ognized in Rosenbach, the informed-consent regime laid out in
section 15(b) is the heart of BIPA. The text of the statute
demonstrates that its purpose is to ensure that consumers un-
derstand, before providing their biometric data, how that in-
formation will be used, who will have access to it, and for how
long it will be retained. The judgment of Illinois’s General As-
sembly is that the sensitivity of biometric information and the
risk of identity theft or other privacy or economic harm that
may result from its dissemination, necessitates that people be
given the opportunity to make informed choices about to
whom and for what purpose they will relinquish control of
16 No. 20-1443
that information. Compass’s failure to abide by the require-
ments of section 15(b) before it collected Smart Market users’
fingerprints denied Bryant and others like her the oppor-
tunity to consider whether the terms of that collection and us-
age were acceptable given the attendant risks.
This was not a failure to satisfy a purely procedural re-
quirement. Rather, as in Robertson, Compass withheld sub-
stantive information to which Bryant was entitled and thereby
deprived her of the ability to give the informed consent section
15(b) mandates. Equipped with the missing information, she
may have chosen not to use the vending machines and instead
brought her own lunch or snacks. Or she may have opted for
the convenience of the machines. She did not realize that there
was a choice to be made and what the costs and benefits were
for each option. This deprivation is a concrete injury-in-fact
that is particularized to Bryant. She thus meets the require-
ments for Article III standing on her section 15(b) claim.
D
Bryant’s claim under section 15(a) is a separate matter. Sec-
tion 15(a) obligates private entities that collect biometric in-
formation to make publicly available a data retention sched-
ule and guidelines for permanently destroying collected bio-
metric identifiers and information. In contrast to the obliga-
tions set forth under section 15(b), the duty to disclose under
section 15(a) is owed to the public generally, not to particular
persons whose biometric information the entity collects. This
provision is not part of the informed-consent regime, and Bry-
ant alleges no particularized harm that resulted from Com-
pass’s violation of section 15(a).
No. 20-1443 17
We conclude that Bryant did not suffer a concrete and par-
ticularized injury as a result of Compass’s violation of section
15(a). She therefore lacks standing under Article III to pursue
that claim in federal court. As we noted earlier, we have no
authority and no occasion to address her state-court standing
to bring this claim.
III
Recognizing the privacy and economic risks involved in
the wide use of biometric information, the Illinois General As-
sembly mandated in section 15(b) of BIPA that private entities
make certain disclosures and receive informed consent from
consumers before obtaining such information. As alleged,
Compass did not make the requisite disclosures to Bryant or
obtain her informed written consent before collecting her fin-
gerprints. By failing to do so, Compass inflicted the concrete
injury BIPA intended to protect against, i.e. a consumer’s loss
of the power and ability to make informed decisions about the
collection, storage, and use of her biometric information. This
injury satisfies the requirements for Article III standing, and
so Bryant’s claim under section 15(b) may proceed in federal
court.
We therefore REVERSE the judgment of the district court re-
manding the action to the Circuit Court of Cook County, and
REMAND this case to the district court for further proceedings
consistent with this opinion.