Johnson & Johnson (J&J) is under fire in a proposed class action lawsuit over its Neutrogena Skin360 facial-scanning service. The lawsuit stems from claims that the company failed to properly inform users about the collection and use of their biometric data, specifically facial scans, which allegedly violates Illinois' Biometric Information Privacy Act (BIPA).
Neutrogena Skin360 is a technology that allows consumers to perform a personalized at-home skin assessment. By using their mobile devices to scan their faces, users receive detailed information about their skin health, along with recommendations for Neutrogena skincare products.
The technology relies on artificial intelligence (AI) to compare users' facial scans to a database of images, providing a customized skin health assessment. While convenient, the service has come under scrutiny for allegedly collecting and storing biometric data without proper disclosure.
In a court ruling on March 6, 2025, Federal Judge Michael A. Shipp dismissed J&J’s defense that the Skin360 service should be exempt from BIPA due to its ties to healthcare. The company had argued that the service qualified under the healthcare exemption within BIPA, which applies to medical care provided by professionals.
Judge Michael A. Shipp determined that Neutrogena Skin360 does not involve licensed medical professionals, making it a non-medical service under the law. The judge called the idea of categorizing the service as "medical care" a "reach."
The plaintiffs, four Illinois residents, claim that when using the Skin360 app between 2020 and 2022, their biometric data—including unique facial geometries—was collected and stored without their consent.
They allege that J&J failed to inform them about the biometric data being captured, used, or shared. According to the lawsuit, this data was tied to personally identifiable information, such as names and birthdates, raising significant privacy concerns.
The lawsuit is part of a broader trend focusing on the use of biometric data in consumer services. With growing concerns about data privacy, especially regarding sensitive information like facial scans, regulatory scrutiny on companies collecting such data is intensifying.
Illinois' BIPA law is one of the strictest in the U.S., and this case could set a precedent for how other states approach the collection and use of biometric data. As companies continue to collect more sensitive data, ensuring transparency and obtaining clear consent from users will become increasingly important.
The ruling against Johnson & Johnson over the Neutrogena Skin360 service marks an important moment in the ongoing debate over privacy, consumer rights, and biometric data. As more companies use AI and facial recognition technologies in their consumer products, it is likely that we will see more legal challenges and regulatory scrutiny on how companies handle biometric data.
