TAG

Biometric & minors' data

Biometric identifiers and children's online privacy regimes.

PRIV-02 · 01

Biometric Privacy Laws: Consent, Retention, Security, and Litigation Exposure

9 MIN · PRIV

Biometric rules are state law, and only Illinois gives private plaintiffs a broad right to sue. This brief maps what is regulated, what consent must look like, and where the money risk concentrates.

Illinois BIPA is the only major biometric statute with a broad private right of action, which is why class filings concentrate there.
Rosenbach v. Six Flags (Ill. 2019) held that a plaintiff need not prove actual injury beyond the statutory violation itself.
Cothron v. White Castle (Ill. 2023) made claims accrue per scan; an August 2024 amendment limits repeated scans to one recovery.

Read the full brief →

PRIV-03 · 02

Children's Online Privacy: COPPA Coverage, Parental Consent, and Age-Assurance Questions

8 MIN · PRIV

Most children's privacy disputes begin with whether the rule applies at all. This brief works the coverage test first, then consent mechanics, the recently amended FTC Rule, and the unsettled state layer.

COPPA reaches operators of services directed to children under 13 and operators with actual knowledge they collect a child's personal information.
Verifiable parental consent must precede collection, and the FTC recognizes specific methods rather than any reasonable-looking age gate.
The FTC finalized amendments to the COPPA Rule in 2025, effective that year with certain compliance obligations extending into 2026.

Read the full brief →

PRIV-10 · 03

Health Data Outside HIPAA: Apps, Wearables, and Consumer Health Rules

8 MIN · PRIV

HIPAA follows the entity, not the data. This brief maps the rules that reach health information held by apps, wearables, and consumer services, and where the private-suit risk sits.

HIPAA applies to covered entities and business associates, so most apps, wearables, and consumer health services fall entirely outside it.
The FTC reaches that data through Section 5 and the Health Breach Notification Rule, amended in 2024 to cover health apps and connected devices explicitly.
Washington's My Health My Data Act carries a private right of action, which makes it the highest-exposure consumer health statute in the country.

Read the full brief →