The Sosa v. Onfido BIPA settlement is a roughly $28.5 million class action resolution in the U.S. District Court for the Northern District of Illinois, covering people whose facial biometric data was allegedly collected by Onfido without the notice and written consent required by the Illinois Biometric Information Privacy Act. The claims deadline was October 6, 2023, and payments to eligible class members are being distributed in installments over three years following final approval.1Sosa v. Onfido, Inc. Home
Who Was Covered by the Settlement
The class included anyone who, while in Illinois, uploaded a photo or video of themselves along with a photo ID to any application or website operated by an Onfido customer between June 12, 2015 and May 5, 2023. Onfido provides identity verification behind the scenes for other companies. Users interacted with apps like the OfferUp marketplace, and Onfido’s technology compared the selfie to the ID photo using facial recognition.
People who had already signed a written release specifically naming Onfido before their data was collected were excluded from the class.2Sosa v. Onfido, Inc. FAQ
If you did not submit a claim by October 6, 2023, you are no longer eligible for a payment from this settlement.1Sosa v. Onfido, Inc. Home
What Onfido Was Accused Of
Named plaintiff Fredy Sosa used OfferUp, which relied on Onfido’s verification tools. The complaint alleged that when users uploaded their ID and selfie, Onfido’s system extracted their facial geometry without ever giving them written notice that biometric data was being collected, explaining why it was being collected or how long it would be kept, and without obtaining a signed written release. The complaint also alleged Onfido had no publicly available policy establishing when biometric data would be destroyed.
A central issue was that Onfido operated as a vendor rather than a consumer-facing brand. The lawsuit argued that being a behind-the-scenes provider did not excuse Onfido from BIPA compliance, because Onfido was the entity actually scanning faces and extracting facial geometry.
Onfido moved to dismiss on the ground that Sosa had not suffered a concrete injury sufficient for Article III standing. The court denied the motion, relying on the Seventh Circuit’s decisions in Bryant v. Compass Group USA, Inc. and Fox v. Dakkota Integrated Systems, LLC. Under those rulings, skipping BIPA’s notice-and-consent steps invades personal rights in a concrete way, and failing to maintain and follow a data-retention schedule counts as unlawful retention of biometric information.3Justia Law. Sosa v. Onfido Inc The case could proceed without any allegation of financial loss or data breach.
How the Settlement Money Is Divided
Rather than fight class certification, the parties settled. The court certified two separate settlement classes based on the type of Onfido customer that facilitated the data collection, each with its own fund and its own estimated payout range.
- Financial Institution Class: people whose biometric data was collected through a financial institution client of Onfido. Fund of $12,785,595.90. Estimated individual payouts of $65 to $110, with the lower range reflecting additional legal defenses that applied to these claims.
- Non-Financial Institution Class: people whose data was collected through a non-financial client such as OfferUp. Fund of $15,714,404.10. Estimated individual payouts of $210 to $350.
The combined settlement value is approximately $28.5 million. Actual payments within each class depend on how many valid claims were submitted, because each fund is divided among claimants after deducting settlement expenses, attorneys’ fees, and incentive awards for the class representatives.2Sosa v. Onfido, Inc. FAQ
When Payments Arrive
Onfido is paying the settlement in installments spread over three years from final approval. The final approval hearing was scheduled for November 9, 2023.
For class members receiving electronic payments, the schedule is:
- 25 percent at 60 days after final approval
- 20 percent at one year and 60 days
- 20 percent at two years and 60 days
- 35 percent at three years and 60 days
Class members receiving paper checks get 25 percent in the first installment and the remaining 75 percent in the final installment.2Sosa v. Onfido, Inc. FAQ
Are the Payments Taxable
Payments from a privacy case like this are generally taxable as income. The IRS treats settlement proceeds as taxable unless a specific exclusion applies. The main exclusion under IRC Section 104(a)(2) covers damages for personal physical injuries or physical sickness, and a BIPA claim over biometric data collection is a non-physical injury, so it does not qualify.4Internal Revenue Service. Tax Implications of Settlements and Judgments
Class members should report each installment as income on the federal tax return for the year it was received. Because the payments arrive across multiple years, they can affect more than one tax year. IRS Publication 4345 offers further guidance on class action settlement payments.4Internal Revenue Service. Tax Implications of Settlements and Judgments
What Onfido Has to Change
Beyond the payments, the settlement requires Onfido to bring its Illinois practices in line with BIPA Section 15. The company must provide an informed written consent form disclosing biometric data collection, ensure users view and agree to that form before any facial recognition or identity verification takes place, and maintain a publicly available policy covering how long biometric data is kept and when it is permanently deleted.3Justia Law. Sosa v. Onfido Inc
Why BIPA Cases Produce Settlements This Size
BIPA gives individuals a private right of action, so a person can sue directly rather than wait for a government agency. A prevailing plaintiff can recover $1,000 per negligent violation or $5,000 per intentional or reckless violation, plus reasonable attorneys’ fees and court costs, along with injunctive relief.5Illinois General Assembly. 740 ILCS 14/20 – Right of Action Multiplied across a class of Illinois users, that exposure is what drives companies to settle cases like Sosa rather than test the numbers at trial.