The facial-recognition check-in trials that a number of major conferences had run in 2024, generally on an opt-in basis and framed as accuracy-focused pilots rather than full production rollouts, drew their first significant legal challenge in 2025, when a class-action lawsuit filed against a conference organizer and its biometric-technology vendor tested whether existing biometric-privacy statutes applied as directly to conference check-in as they had to the retail and workplace contexts where most prior biometric litigation had concentrated.

What the Lawsuit Specifically Alleged

The suit centered on allegations that attendees hadn’t received sufficiently clear, specific disclosure about how their facial-recognition data would be collected, stored, and eventually deleted, and that the consent attendees provided during registration didn’t meet the more specific informed-consent standards that biometric-privacy statutes in several states had established — standards generally more detailed than the general privacy-policy consent language that had historically sufficed for less sensitive categories of registration data. The case echoed the fact pattern of earlier, better-established biometric litigation in the retail and employment contexts, applying that same legal theory to the newer conference-check-in use case for essentially the first time at this scale.

Why the Conference Context Presented Genuinely Novel Questions

Biometric-privacy statutes in states with the most developed case law had accumulated meaningful legal precedent primarily from retail and workplace biometric use — fingerprint time clocks, in-store facial recognition for loss prevention — contexts with some genuine factual differences from conference check-in, including the typically shorter data-retention window most conference biometric systems used and the fact that conference attendance, unlike employment, was a discrete, voluntary, time-limited relationship rather than an ongoing one. Legal observers noted these factual differences didn’t necessarily change the statutory analysis, since most biometric-privacy statutes’ core requirements around disclosure and consent didn’t turn on the underlying relationship’s duration, but the case still represented a genuinely novel application of the legal theory to conference-specific facts, without a comparable body of dispositive case law directly on point that the biometric check-in vendor could confidently rely on for its data-handling design assumptions.

Vendors and Organizers Responded With Caution

The lawsuit’s filing prompted a broader wave of caution across the event-technology industry beyond the specific parties involved, with several biometric check-in vendors and organizers who had been planning expanded facial-recognition rollouts pausing or scaling back those plans pending the case’s outcome, unwilling to expand exposure to a legal theory whose application to conference check-in specifically remained genuinely untested at the time. Some organizers who had planned to move from 2024’s opt-in pilot framing toward broader default-enabled biometric check-in delayed that expansion explicitly citing the pending litigation as a reason for caution.

The case’s ultimate resolution — whether through settlement, dismissal, or a substantive ruling on the merits — remained pending, but its filing alone had already established that biometric check-in operated on genuinely less certain legal ground than event-technology vendors marketing these systems had generally represented, with disclosure and consent requirements demanding a similarly demanding standard as had already applied in more established biometric use cases in other industries. Organizers evaluating any biometric check-in offering going forward increasingly needed to treat the specific disclosure and retention practices of their chosen vendor as a genuine risk factor requiring dedicated legal review, not a routine registration feature comparable in risk profile to standard photo ID verification.

The Statutory Text Organizers’ Legal Teams Were Actually Reviewing

The specific statutory language driving this litigation is worth understanding directly rather than only through case summaries, since it shapes exactly what a conference organizer’s disclosure and consent process needs to satisfy. Illinois’s Biometric Information Privacy Act — the most litigated biometric-privacy statute in the country and the one most closely watched by event-technology vendors nationally, even for organizers running events outside Illinois specifically because of how much precedent has developed under it — requires that an entity collecting biometric identifiers provide written notice of the specific purpose and length of term for which the data is being collected, obtain a written release from the subject, and follow a publicly available written policy establishing a retention schedule and destruction guidelines. Several other states have since enacted comparable, though not identical, biometric-privacy statutes, and the specific wording differences between them — what counts as a sufficiently specific disclosure, what “written release” requires procedurally at a conference registration kiosk versus a paper form — have become exactly the kind of granular legal question conference organizers’ counsel needed to work through jurisdiction by jurisdiction rather than assuming a single national compliance approach would satisfy every relevant state’s statute.

For organizers operating multi-city conference series, this state-by-state variation added genuine operational complexity beyond the headline legal-exposure question: a biometric check-in disclosure and consent process designed to satisfy one state’s statute wasn’t guaranteed to satisfy another’s, meaning a series running events across several states potentially needed jurisdiction-specific consent language and retention practices rather than a single standardized process, a compliance burden that made some multi-city organizers more cautious about biometric adoption than a single-city, single-jurisdiction event might otherwise have been.

Frequently Asked Questions

What did the 2025 biometric check-in lawsuit specifically allege?

That attendees hadn’t received sufficiently clear, specific disclosure about facial-recognition data collection, storage, and deletion, and that registration consent didn’t meet the more detailed informed-consent standards established by biometric-privacy statutes in several states.

Why was applying biometric-privacy law to conference check-in considered legally novel?

Most existing biometric-privacy case law had developed from retail and workplace contexts with different factual patterns than conference check-in, including shorter data retention windows and a discrete, voluntary attendance relationship, leaving the statutes’ application to conferences specifically without a comparable body of dispositive precedent.

How did the event-technology industry respond to the lawsuit?

Several biometric check-in vendors and organizers paused or scaled back planned facial-recognition expansions, unwilling to expand legal exposure to a theory whose application to conference check-in remained genuinely untested at the time.

No — the case’s outcome remained pending, but its filing alone established that biometric check-in operated on less certain legal ground than vendors had generally represented, requiring organizers to treat vendor disclosure and retention practices as a genuine risk factor.

For related coverage, see our piece on the growing state-by-state privacy law patchwork affecting conference data. The full statutory text organizers’ legal teams reference most often is the Illinois General Assembly’s Biometric Information Privacy Act, 740 ILCS 14.