Starbucks hit with BIPA class action: the AI-surveillance bill comes due

I came into the newsroom Tuesday with two tabs open — a tip on a fresh Illinois Biometric Information Privacy Act filing against Starbucks, and the spreadsheet I keep of every BIPA nine-figure settlement of the last six years. Filing date on the lawsuit: April 7. The spreadsheet, top to bottom: Facebook at $650 million in 2020. TikTok at $92 million in 2021. Google at $100 million in 2022. Clearview AI at $51.75 million, final approval entered March 20, 2025. The Starbucks complaint is the first entry in the ledger that is not a pure-play technology company. It is a QSR.

The contrarian read I want to mark before this story gets absorbed into the general-counsel news flow: this is the bellwether case for QSR computer-vision deployments, and the verdict — whether by settlement, dismissal, or trial — will price every kitchen camera, drive-thru gaze tracker, and barista-station vision system in the United States for the back half of the decade. The settlement ledger above is the precedent stack. The EU AI Act’s workplace emotion-recognition prohibition is the parallel regulatory perimeter. The Starbucks filing is the moment the two converge on hospitality.

A confidence note. The lawsuit was filed today; trade-press coverage is preliminary and the specifics of the complaint — which biometric system, which Illinois locations, which class period — are not yet verified through a primary court filing I can cite cleanly. What follows leans on the BIPA precedent ledger and the EU regulatory frame, both of which are dated and citable. Treat the Starbucks-specific allegations as reported-not-verified until the docket clears.

What BIPA actually punishes

BIPA, passed in 2008, was the first US biometric-privacy statute with a private right of action. Statutory damages: $1,000 per negligent violation, $5,000 per intentional or reckless violation. The math compounds at the per-employee, per-scan level — which is the structural reason every prior settlement has landed in nine figures. Facebook’s $650 million in 2020 was photo-tagging face templates. Google’s $100 million in 2022 was Google Photos. TikTok’s $92 million in 2021 was in-app face and voice prints. Clearview AI’s $51.75 million, approved March 2025, was the scraped-faceprint database — and it is the entry that matters most for a QSR fact pattern, because Clearview’s exposure was not a consumer product. It was an enterprise surveillance tool that captured biometric data without consent in the course of operations.

A QSR camera system that runs face, gaze, or expression analysis on employees or customers in an Illinois venue sits inside the same statutory perimeter Clearview just settled out of. The Starbucks complaint is the first QSR fact pattern to test that perimeter. Mark it.

The EU regulatory companion read

The American story does not sit on its own. Article 5 of the EU AI Act, applicable since February 2, 2025, prohibits AI systems that infer emotions of natural persons in workplaces — full stop, not a high-risk classification, not a conformity assessment, an outright prohibition. The Commission’s regulatory framework page is the cleanest citation on the Article 5 scope. The high-risk obligations downstream are still scheduled to apply from August 2, 2026, subject to the Digital Omnibus simplification cycle Oliver walked through in March.

The Starbucks case sits inside a jurisdictional asymmetry. An emotion-recognition or attention-tracking system already prohibited in an EU back-of-house is being litigated as a damages question in Illinois. Two regulatory regimes, two enforcement modes, one product category. A QSR vision vendor selling into both markets is now selling against an EU prohibition perimeter and a US statutory-damages perimeter at the same time. That is the structural read.

The same perimeter runs adjacent to the forthcoming Pass piece on the EU AI Act applied to restaurants and to the McDonald’s AI drive-thru coverage queued for May. The voice and vision stacks at the front of the house are now subject to two regulatory regimes that did not exist when the deployments were scoped.

What I’m marking

Mark three things. First: the BIPA precedent stack is the cleanest plaintiff-side fact pattern available — every prior settlement converged in the nine-figure range, and Starbucks’s Illinois class size is large enough to scale to that range on the statutory math alone. Second: the EU Article 5 prohibition is a parallel signal, not a US-law citation; but it is the regulatory direction the rest of the developed world is moving in, and it constrains the global product roadmap of every vendor in the QSR camera category. Third: the docket. The complaint will tell us which specific Starbucks system is at issue, and that will determine which downstream vendors get repriced.

The bill on QSR computer vision is coming due. Today is the line item.

— Hana edits the newsroom for TableTransfers. Tips: tips@tabletransfers.com.