Coinbase Faces Federal Privacy Lawsuit That Could Cost Millions

On May 13, 2025, a class-action lawsuit was filed against Coinbase in the U.S. District Court for the Northern District of Illinois, alleging violations of the Illinois Biometric Information Privacy Act (BIPA). 

The complaint claims Coinbase collected and shared users’ faceprints without consent during its Know Your Customer (KYC) verification process.

Also read: Is Coinbase Safe? Everything You Need To Know

The lawsuit points to increased regulatory focus on data privacy practices in the cryptocurrency market as a result of the strict biometric laws in Illinois.

Users Accuse Coinbase of Secretly Collecting Facial Data

Plaintiffs Scott Bernstein, Gina Greeder, and James Lonergan claim that the exchange failed to comply with BIPA by not obtaining written consent or disclosing policies for collecting, storing, and sharing biometric data. 

The KYC process required users to submit government-issued IDs and selfies, processed by third-party facial recognition vendors including Jumio, Onfido, Au10tix, and Solaris, allegedly without user authorization. 

The complaint further accuses Coinbase of misleading consumers using deceptive business practices under the Illinois Consumer Fraud and Deceptive Business Practices Act.

The plaintiffs seek statutory damages of $5,000 per willful or reckless violation and $1,000 per negligent violation, alongside injunctive relief and litigation costs. 

Also read: Top Coinbase Competitors: Best Exchanges To Consider

A 2024 BIPA amendment may cap damages at “per person” rather than “per scan,” though courts remain divided on its retroactive application, which would affect Coinbase’s liability.

The lawsuit refers to over 10,000 arbitration requests presented to the American Arbitration Association in March and April of 2024 that the exchange stands accused of obstructing by refusing to pay fees, leading to dismissals and permitting this federal suit.

Coinbase’s History of Privacy Controversies Resurfaces

Coinbase faced a similar BIPA lawsuit in May 2023, which was paused for arbitration and dismissed without prejudice on Feb. 3, 2025, following a settlement. 

Illinois’ BIPA, one of the strictest privacy laws in the country, has driven several lawsuits against tech and crypto firms, with harsh penalties for non-compliance.

Adding to the exchange’s woes, on May 15, 2025, the exchange announced a data breach of bribed support staff customers, affecting fewer than 1% of customers, resulting in six additional lawsuits. This data breach, together with an SEC probe into the number of customers, was responsible for causing a 7% price loss of shares, as previously reported by Ecoinimist.

Biometric Privacy Case Could Shake Up Coinbase

As of May 19, 2025, the Illinois federal court has greenlit the lawsuit to proceed, denying Coinbase’s motions to refer the case to small claims or pre-dispute resolution. The exchange has not issued a public statement about the lawsuit.

Also read: Coinbase Is on an Acquisition Spree—Are Competitors Ready?

The outcome of the case could result in substantial financial penalties under BIPA, given the large fines of BIPA and the prospect of involving thousands of users, as stated by the arbitration claims.

The lawsuit may also establish benchmarks for biometric data compliance in the cryptocurrency industry, increasing the levels of compliance and customer confidence. Since courts decide whether or not the 2024 BIPA amendment applies, the monetary impact of harm remains uncertain.