MAC Cosmetics Facial Recognition Lawsuit: Are You in It?

A shopper tried on lipstick at a MAC counter outside Chicago. She says the sales rep scanned her face to do it. In June 2026, a federal judge let her lawsuit go forward.

The case is Javid v. M.A.C. Cosmetics Inc. It was filed in the Circuit Court of Cook County on August 25, 2025, as No. 2025CH08774. MAC moved it to federal court a month later, where it is No. 1:25-cv-11693 in the Northern District of Illinois. On June 4, 2026, Judge Georgia N. Alexakis denied MAC's motion to dismiss.

Most coverage of this case was written from a press summary. I read the 17-page complaint and the 16-page ruling instead. Here is what they say, starting with the question most people arrive with.

Are you in this? The two proposed classes

The complaint proposes two classes. Quoted from the filing:

Two things follow. First, both classes stop at the Illinois border. If you used MAC's virtual try-on in Ohio, this complaint does not describe you. Second, the website class turns on where you lived when you used it. A Chicago resident trying on shades from the couch fits the proposed definition.

The complaint says the classes are "reasonably believed to include thousands of persons" (paragraph 54). No judge has certified either class. Until one does, the definitions are only the plaintiff's proposal.

Is there a settlement? Can I sign up?

No, and no. There is no settlement, no fund, no claim form and no certified class. CourtListener's copy of the federal docket, which I checked on September 25, 2026, shows discovery orders in July 2026 and nothing about certification or settlement.

If a class is certified later, the complaint says members would get court-approved notice by mail, email, internet posting or published notice (paragraph 54). You would not need to pay anyone to find it. Be wary of sites that ask for your details to "check if you qualify" when nothing exists to qualify for. If you think you were scanned in an Illinois MAC store, keep your own record: roughly when you went, which location, and any receipt or order confirmation.

What the complaint says happened

The facts are ordinary, which is the point. Fiza Javid lives in Chicago. She shopped at the MAC store in Woodfield Mall in Schaumburg, where a sales rep walking the floor offered to let her try makeup on virtually.

She named a lipstick and a lipliner. The rep scanned her face and applied the color to her lips in a live video, then did the same for other products (paragraphs 21 to 24). All of it ran on devices MAC controlled (paragraph 25). She also used the try-on feature on MAC's website (paragraph 27).

There is one count, under one subsection of the Illinois Biometric Information Privacy Act. Here is that subsection in full:

The complaint alleges MAC failed all three steps (paragraphs 48 to 50):

• 15(b)(1): no written notice that face data would be collected or stored.
• 15(b)(2): no written statement of the purpose or how long the data would be kept.
• 15(b)(3): no signed written release.

Notice what the subsection leaves out. It says nothing about how MAC used the scan, whether anything leaked, or whether anyone was harmed. The whole duty is sequence: three written steps, and the word "first."

What the scan captures

The complaint says MAC's software found her face in the video and captured "the length, width, depth, and location of, as well as the distance and spacing between, various of her facial features and landmarks" (paragraph 26). From that, it says, MAC built a face template and stored it (paragraph 30).

That matters because BIPA's definition of a "biometric identifier" at 740 ILCS 14/10 includes a "scan of hand or face geometry." A photograph alone is excluded. A measurement of your face's geometry is inside the definition.

Then there is the sentence an operator should read twice:

If that holds up, storage is how the feature works. Any company running a try-on tool should know which description fits its own system. The answer decides what it can honestly say about deletion.

Why MAC lost the motion, and what an Estée Lauder case shows

MAC's main argument was about the word "identifier." A face scan counts under BIPA, MAC said, only if it can be used to identify a person, and Javid had not alleged that MAC could identify her from hers.

Judge Alexakis agreed with MAC on the law. The ruling holds that "biometric information" and "biometric identifier" are "categories that only include data that can be used to identify a person." Then she ruled against MAC on the facts. Her first paragraph says it plainly:

What met the burden was a customer account. The complaint says Javid has a MAC account holding her name, date of birth, zip code, email address and purchase history, including what she bought on the visit when she tried on makeup (paragraph 34). The judge called that a "clear preexisting relationship" between shopper and retailer.

Compare Castelaz v. Estée Lauder Cos., No. 22 CV 5713 (N.D. Ill. Jan. 10, 2024), a case the ruling discusses. There, as Judge Alexakis summarizes it, the plaintiffs failed to give "any specific factual allegations" that the company could identify them "by using the collected facial scans, whether alone or in conjunction with other methods or sources of information." On the ruling's own reading, what separated the two cases was a specific allegation tying the scan to a known customer.

This is the detail I have not seen anyone else pull out, and it matters for every retailer. Under this ruling, the risky part of a try-on tool is the join between the face scan and the customer account. The ruling leaves that question open for discovery: "it remains to be seen, via discovery, whether MAC (or another entity) was capable of connecting the dots."

The court also declined to dismiss Javid's demand for the higher damages tier for intentional or reckless violations. She does not have to plead MAC's state of mind at this stage.

What "motion to dismiss denied" does and does not mean

A lot of coverage blurs this. On a motion to dismiss, the court assumes the complaint's facts are true and asks only whether they state a claim. The ruling says so: "the Court assumes the facts alleged in the complaint are true."

So the June 4 order lets the case continue. It finds nothing about what MAC actually did. The judge directed the parties to file a proposed discovery schedule by June 18, 2026. Discovery is where the account-linking question gets tested.

The damages math after SB 2979 and Clay

Every write-up quotes BIPA's figures: $1,000 per negligent violation and $5,000 per intentional or reckless one, under 740 ILCS 14/20(a). The complaint asks for exactly those amounts (paragraph 66).

The arithmetic around them changed. In Cothron v. White Castle System, Inc., 2023 IL 128004, the Illinois Supreme Court read each scan as a separate violation. The legislature answered with Senate Bill 2979, Public Act 103-769, effective August 2, 2024. It added this to section 20:

On April 1, 2026, the Seventh Circuit held in Clay v. Union Pacific Railroad Co., No. 25-2185, that the amendment applies to cases already pending. Here is a detail that ties the two cases together. Clay came up from Judge Alexakis's own courtroom, where the district court had ruled the amendment did not reach pending cases. The Seventh Circuit reversed: "The district courts in all three cases erred by holding otherwise." Javid now sits in that same federal court, so Clay governs its damages.

Read section 20(b) closely and one question stays open for this case. The cap runs per person per "method of collection." The complaint pleads two channels, a store device and a website, with a class for each. Whether those count as one method or two is a question the statute does not answer.

The practical effect for a company is simple. "How many times did we scan her" became a small question. "Can we produce the notice and the signed release" became the whole question.

The option that was already on the page

The complaint reproduces MAC's own marketing as figures. One try-on page, Figure 3, lists three steps. The second reads:

Choose a model. Right beside the camera option, MAC's instructions offered a path that used someone else's face.

That does not answer the complaint. The statute asks for written notice and a signed release before a scan, and an alternative elsewhere on the page supplies neither. It does change the business argument. The usual defense of these tools is that the face scan is essential. MAC's own page listed a version that did not need yours.

If you run virtual try-on, what you would have to produce

Set the lawsuit aside. If your company runs any tool that maps a customer's face, for makeup, eyewear or hair color, ask this about one real customer. If she emailed today saying your tool scanned her face in March, could you produce the notice she saw, the release she signed, and proof of whether her scan was ever tied to her account, with dates, within a week?

Each item below is something this case already puts in dispute:

None of this requires anyone to see the biometric itself. It requires a tamper-evident record of what your company did and when, which is a different thing from the face scan and much easier to keep.

Illinois is the state where a shopper can sue directly, so it produces most of these cases. Texas (Tex. Bus. & Com. Code § 503.001) and Washington (RCW 19.375) have biometric statutes enforced by their attorneys general. Colorado's HB 24-1130 took effect July 1, 2025. Where you operate changes who can bring the claim. It does not change whether you should be able to answer the question above.

This describes what the statutes require and what the filings in this case say. It is not legal advice; anyone with real exposure should check their position with counsel.