Coinbase · Governance finding · severity 1 of 5
Coinbase has faced two proposed class actions alleging that the facial recognition in its identity checks breaks Illinois' Biometric Information Privacy Act (BIPA). The first, filed on 1 May 2023 in the Northern District of California, claimed Coinbase collected and stored face geometry and fingerprints without the required written consent. It was stayed for arbitration and dismissed in February 2025. A second suit, filed on 13 May 2025 in the Northern District of Illinois, alleges that Coinbase refused to pay fees in more than 10,000 arbitrations and shared face scans with vendors including Jumio and Onfido without consent. Coinbase argues that BIPA's exemption for financial institutions applies to it. The second case was stayed in August 2025 and remains open.
Record last reviewed Oct 21, 2026 · Markdown
Date
Institution
Country
United States
AI system
Facial recognition matching a selfie to a government ID photo during onboarding (KYC) · vendor: Third-party identity verification providers (the 2025 complaint names Jumio, Onfido, Au10tix, Solaris and Liquid)
AI?
Machine-learning system (inferred from the record)
The sources describe a machine-learning model; nobody on the record labelled it AI.
Category
Status
Court filing
Severity
1 of 5
Impact
The proposed classes cover Illinois users whose face scans were captured during Coinbase identity checks; no count has been established. No data breach or financial loss is alleged. · Statutory damages of $1,000 per negligent and $5,000 per intentional or reckless violation are claimed.
What happened?
On 1 May 2023 a Coinbase user filed a proposed class action, Massel v. Coinbase, in the US District Court for the Northern District of California. It claimed that Coinbase's know-your-customer check, which requires a photo of a government ID and a selfie, creates a biometric template of the user's face to match the two images. It said Coinbase "had no written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric information", in breach of BIPA.[1][2]
Coinbase moved to stay the case pending arbitration, and the plaintiff did not oppose. The court granted the stay on 6 October 2023, and the case was dismissed on 3 February 2025 on the parties' stipulation. According to the later Illinois complaint, 7,926 people filed individual arbitration demands against Coinbase on 6 March 2024 and another 2,565 followed on 5 April 2024. The American Arbitration Association decided in March 2025 to charge its published fees, Coinbase refused to pay them, and the arbitrations were closed.[2][3][6]
On 13 May 2025 three Illinois users filed Bernstein v. Coinbase Global in the Northern District of Illinois. The complaint says "Coinbase’s identity verification process uses facial recognition technology" supplied by third-party verification providers, "primarily Jumio and Onfido", which measures the distances between facial features to verify identity. It alleges that Coinbase did not give written notice, obtain written consent, publish a retention schedule, or get consent before disclosing biometric data to those providers. It seeks $1,000 per negligent and $5,000 per intentional or reckless violation.[3][6]
Coinbase asked the Illinois court to pause the case while the Seventh Circuit decided Cisneros v. Nuance, an appeal about BIPA's exemption for financial institutions covered by the Gramm-Leach-Bliley Act. Coinbase said it intended to argue that it falls within that exemption. The court granted the stay on 21 August 2025. The Seventh Circuit decided Cisneros on 28 August 2026, holding that Nuance, a voice-ID vendor to Charles Schwab, is exempt.[4][7]
When did it happen?
- May 1, 2023
Massel v. Coinbase, a proposed BIPA class action, is filed in the Northern District of California.[1][2]
- Oct 6, 2023
The California court stays the case pending arbitration.[2]
- Mar 6, 2024
7,926 claimants file individual arbitration demands against Coinbase; 2,565 more follow on 5 April 2024.[3]
- Feb 3, 2025
The Massel case is dismissed on the parties' stipulation.[2][6]
- May 13, 2025
Bernstein v. Coinbase Global is filed in the Northern District of Illinois after the arbitrations close.[3][5]
- Aug 21, 2025
The Illinois court stays the case pending the Seventh Circuit's ruling on BIPA's financial-institution exemption.[4]
- Aug 28, 2026
The Seventh Circuit holds in Cisneros v. Nuance that a voice-ID vendor to a broker-dealer is exempt from BIPA.[7]
What was the impact?
- Customers: The proposed classes cover Illinois users whose face scans were captured during Coinbase identity checks; no count has been established. No data breach or financial loss is alleged.[3][6]
- Other: Statutory damages of $1,000 per negligent and $5,000 per intentional or reckless violation are claimed.[3][6]
Severity 1 of 5: Contained: privacy-law allegations by proposed classes with no finding, no reported data exposure and no customer losses; the cases were stayed, and Coinbase argues it is exempt.
How did Coinbase respond?
Coinbase told Cointelegraph in May 2023 that it had no comment to add. In court, it sought arbitration in the first case and, in the second, a stay so that it could argue that BIPA's financial-institution exemption covers it. No public statement on the merits was found as of 2026-10-21.[1][4]
What was the outcome, and did regulators act?
The 2023 California case ended in a stipulated dismissal on 3 February 2025. The 2025 Illinois case remains open: after the Seventh Circuit's August 2026 Cisneros ruling, the docket shows new activity, including a filing on 15 October 2026 docketed as a request to dismiss for failure to state a claim. No ruling on the merits, settlement or regulator action has been reported.[2][5][7]
Why was Coinbase sued over face scans?
Illinois users allege that Coinbase's identity check, which matches a selfie to a government ID with facial recognition, captures face geometry without the written notice, consent and public retention policy required by Illinois' Biometric Information Privacy Act. They also allege the data was shared with vendors such as Jumio and Onfido without consent.
Is facial recognition for KYC an AI system?
The complaints describe facial recognition software that measures the distances between facial features to verify identity. That is machine-learning-based face matching, but neither the court papers nor Coinbase call it AI, so this record labels the AI link as inferred from the record rather than stated.
Was any Coinbase customer data leaked or money lost?
No. The suits allege procedural violations of an Illinois privacy law: collecting and sharing biometric data without the required consent and disclosures. They do not allege a breach or financial loss. They seek statutory damages of $1,000 to $5,000 per violation.
What is the status of the Coinbase BIPA lawsuits?
The 2023 California case was stayed for arbitration and dismissed in February 2025. The 2025 Illinois case was stayed in August 2025 pending a Seventh Circuit ruling on BIPA's financial-institution exemption. That ruling came in August 2026, and the Illinois case is open with no decision on the merits.
- Coinbase faces suit over alleged privacy violations in biometrics collection news
- Massel v. Coinbase, Inc., 3:23-cv-02123 (N.D. Cal.) — docket court
- Bernstein et al. v. Coinbase Global, Inc. and Coinbase, Inc. — Class Action Complaint court
- Bernstein v. Coinbase Global, Inc. — Memorandum Opinion and Order granting stay (Doc. 37) court
- Bernstein v. Coinbase Global, Inc., 1:25-cv-05313 (N.D. Ill.) — docket court
- Coinbase faces lawsuit over alleged breaches of Illinois biometric privacy law news
- Norma Cisneros v. Nuance Communications, Inc., No. 24-2982 (7th Cir. 2026) court
When AI goes wrong at a bank, the next morning's brief says so.
when one of these regulators moves, the next morning's brief says so · six sourced stories · 7 am PT · free
plus every regulation, bank and agent page update, the morning after · leave any morning