By: Lama Khachab

Amazon.com, Inc. (“Amazon”) closed all its Amazon Go and Amazon Fresh stores in early 2026, but the legal battle against the “Just Walk Out” cashierless checkout technology in those stores is far from over.[1] A class action pending in the Northern District of Illinois claims that the technology collected shoppers’ biometric information in violation of the Illinois Biometric Information Privacy Act (“BIPA”).[2] Meanwhile, Amazon continues to license “Just Walk Out” technology to more than 140 third-party locations, including sports arenas, airports, and hospitals.[3] Those businesses are relying on a defense that may not hold up under BIPA’s text, with liability growing for each consumer that walks through their doors.[4]

Just Walk Out technology allows shoppers to enter a store, take items from the shelves, and leave without visiting a register.[5] Cameras and sensors detect the products a shopper takes and charges the shopper through the Amazon app.[6] On September 20, 2023, three Illinois shoppers filed a putative class action in violation of BIPA, alleging that Amazon scanned their facial and hand geometry at fourteen Chicago-area Amazon Fresh and Amazon Go stores without written notice or consent.[7] Amazon maintains that the system tracks products, not people, but the court has ordered Amazon to produce a limited source code governing how the system tracks shoppers.[8]

Under § 15(b) of BIPA, a private entity is prohibited from collecting a person’s biometric identifier unless it discloses to the consumer the purpose and length of the collection in writing, and obtains a written release.[9] The statute defines a “biometric identifier” as a “retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry,” but limits “biometric information” to information based on a biometric identifier that is “used to identify an individual.”[10] In Zellmer v. Meta Platforms, Inc.,[11] the Ninth Circuit held that facial data incapable of identifying a person is neither a biometric identifier nor biometric information.[12] Under that reasoning, hand tracking that only follows products could fall outside of BIPA.[13]

Although Zellmer does not bind Illinois courts, there are three reasons to read BIPA differently. First, the Illinois legislature attached an identification requirement to biometric information but not to biometric identifiers, which include any “scan of hand geometry.”[14] Second, the Illinois Supreme Court has applied BIPA as written, holding that the plaintiffs need not prove actual harm and that claims accrue with every unlawful scan.[15] Third, BIPA protects data that cannot be replaced: unlike a Social Security number, a face or hand cannot be changed once compromised, and the legislature specifically identified grocery stores as testing grounds for biometric-facilitated financial transactions.[16] Unlike the face signatures in Zellmer, Just Walk Out must link what it tracks to a shopper’s account to charge the shopper, presenting the type of biometric privacy concern identified in BIPA’s legislative findings.[17]

The financial stakes for businesses using this technology are significant because BIPA provides liquidated damages of $1,000 per negligent violation and $5,000 per intentional or reckless violation.[18] In 2023, the Illinois Supreme Court held that a separate claim accrues each time an entity scans a person’s biometrics; the legislature amended BIPA in 2024 so that repeated collection of the same person’s biometric identifier by the same method constitutes a single violation.[19] Even so, with a proposed class reaching back to 2018, the potential exposure for businesses remains substantial.[20]

Amazon’s exit does not end the risk that other businesses may face; shoppers have already sued Hudson Group, a separate company using the same technology at Chicago’s Midway Airport, demonstrating that businesses licensing the technology may face similar litigation risks.[21] BIPA’s obligations apply to any private entity that collects biometric data, not only the vendor that designed the system.[22] Businesses should investigate what the system captures and require vendors to carry insurance covering BIPA claims.[23]

Businesses should be cautious about relying exclusively on Amazon’s defense because BIPA’s list of biometric identifiers does not expressly require identification, and Zellmer does not bind Illinois courts, therefore a “scan of hand geometry” may fall within the statute regardless of whether it identifies a person or not.[24] Until courts resolve the question, businesses can take two measures to reduce risk. First, they should review their licensing agreements and require the providers to disclose what the system collects and include indemnification provisions.[25] Second, they should obtain each shopper’s signed consent through an in-app setup.[26] The 2024 amendment allowing BIPA releases to be signed electronically ensures businesses can maintain the convenience of the Just Walk Out technology while protecting their biometric data.[27] Business lawyers should advise their clients that the convenience of checkout-free technology does not excuse compliance violations.[28]

 

[1] Todd Bishop, Amazon Closing All Amazon Fresh and Go Stores to Focus on Whole Foods and Grocery Delivery, GeekWire (Jan. 27, 2026, at 07:01 ET), https://www.geekwire.com/2026/amazon-closing-all-amazon-fresh-and-go-stores-to-focus-on-whole-foods-and-grocery-delivery/ [https://perma.cc/B3TQ-YDG9].

[2] Housen v. Amazon.com, Inc., No. 1:23-cv-15634, 2026 U.S. Dist. LEXIS 109739, at *1 (N.D. Ill. May 18, 2026).

[3] Dilip Kumar, An Update on Amazon’s Plans for Just Walk Out and Checkout-Free Technology, Amazon News (Jan. 27, 2026), https://www.aboutamazon.com/news/retail/amazon-just-walk-out-dash-cart-grocery-shopping-checkout-stores [https://perma.cc/4BRM-WUBV].

[4] See 740 Ill. Comp. Stat. 14/15(b), 14/20(a) (2024).

[5] See Kumar, supra note 3.

[6]See id.

[7] See Housen, 2026 U.S. Dist. LEXIS 109739, at *1.

[8] Housen v. Amazon.com, Inc., No. 1:23-cv-15634, 2026 U.S. Dist. LEXIS 50477, at *5 (N.D. Ill. Mar. 11, 2026).

[9] 740 Ill. Comp. Stat. 14/15(b).

[10] 740 Ill. Comp. Stat. 14/10.

[11] 104 F.4th 1117, 1123–26 (9th Cir. 2024).

[12] Id. (holding that face signatures incapable of identifying a person are neither biometric identifiers nor biometric information under BIPA).

[13] See id.

[14] 740 Ill. Comp. Stat. 14/10 (defining “biometric identifier” without reference to identification but defining “biometric information” as information based on a biometric identifier “used to identify an individual”).

[15] Rosenbach v. Six Flags Ent. Corp., 2019 IL 123186, ¶¶ 33–34 (holding that a plaintiff need not allege actual injury beyond the violation of BIPA’s requirements); Cothron v. White Castle Sys., Inc., 2023 IL 128004, ¶¶ 23, 28, 42 (holding that a claim accrues with each scan or transmission and suggesting that the legislature address policy concerns about damages).

[16] 740 Ill. Comp. Stat. 14/5(b)–(c).

[17] But see Zellmer, 104 F.4th at 1126; see Kumar, supra note 3; 740 Ill. Comp. Stat. 14/5(c) (expressing concern regarding the collection and use of biometric identifiers).

[18] 740 Ill. Comp. Stat. 14/20(a)(1)–(2).

[19] Cothron, 2023 IL 128004, ¶¶ 23, 28 (addressing scans and transmissions in violation of §§ 15(b) and 15(d)); Act of Aug. 2, 2024, sec. 5, § 20(b)–(c), 2024 Ill. Legis. Serv. P.A. 103-769 (West) (codified at 740 Ill. Comp. Stat. 14/20(b)–(c)); Bill Status of SB 2979, Ill. Gen. Assemb., https://my.ilga.gov/ftp/legislation/103/BillStatus/HTML/10300SB2979.html [https://perma.cc/AK6F-TTQR] (last visited Oct. 19, 2026).

[20] See Housen v. Amazon.com, Inc., No. 1:23-cv-15634, 2026 U.S. Dist. LEXIS 109739, at *5 (N.D. Ill. May 18, 2026).

[21] See Coulter v. Hudson Grp. (HG) Retail, LLC, No. 1:23-cv-16176 (N.D. Ill. Nov. 6, 2024) (granting in part and denying in part the defendant’s motion to dismiss); Michael Harary, Amazon’s ‘Just Walk Out’ Tech Faces BIPA Lawsuit, Darrow (Nov. 27, 2024), https://www.darrow.ai/resources/amazon-bipa-lawsuit [https://perma.cc/W2G7-ACJG].

[22] See 740 Ill. Comp. Stat. 14/15(b).

[23] See Gregory W. Knopp & Geoffrey J. Derrick, Minimizing Legal Risks for Retailers That Use Biometric Data, Retail TouchPoints (June 5, 2019), https://www.retailtouchpoints.com/features/executive-viewpoints/minimizing-legal-risks-for-retailers-that-use-biometric-data (on file with the American University Business Law Review) (recommending vendor diligence, indemnification provisions, and vendor insurance covering BIPA claims).

[24] See 740 Ill. Comp. Stat. 14/10. But see Zellmer v. Meta Platforms, Inc., 104 F.4th 1117, 1126 (9th Cir. 2024) (holding that biometric data incapable of identifying a person falls outside BIPA).

[25] See Knopp & Derrick, supra note 23.

[26] See 740 Ill. Comp. Stat. 14/15(b)(3).

[27] Act of Aug. 2, 2024, sec. 5, § 10, 2024 Ill. Legis. Serv. P.A. 103-769 (West) (codified at 740 Ill. Comp. Stat. 14/10) (adding electronic signatures to the definition of “written release”).

[28] See 740 Ill. Comp. Stat. 14/20(a).