Seventh Circuit Narrows BIPA Healthcare Exemption: Key Takeaways from Clements v. Gunnar Optiks

Newsletter

Can a company avoid Illinois's biometric information privacy law simply because its product has a health-related purpose? The Seventh Circuit said no—at least not without some evidence to support this assertion. The court revived a class action over an eyewear company’s facial-geometry scanning application and signaled a more skeptical approach to BIPA’s healthcare exemption in general. Given BIPA’s potential extraterritorial application, this decision carries immediate implications for companies collecting biometric data through consumer-facing technology. Read the full analysis below.

Introduction: The Illinois Biometric Information Privacy Act

The Illinois Biometric Information Privacy Act (BIPA), 740 ILCS 14/1 et seq., enacted in 2008, is one of the most significant, and most litigated, biometric privacy statutes in the United States. BIPA regulates the collection, use, storage, and dissemination of information derived from a biometric identifier, which is defined to include retina or iris scans, fingerprints, voiceprints, and scans of hand or face geometry.

BIPA imposes several key obligations on businesses that collect, store, or use biometric information (defined as “any information, regardless of how it is captured, converted, stored, or shared, based on an individual's biometric identifier used to identify an individual”)1:

  • Informed Written Consent. Before collecting or obtaining a person’s biometric information, businesses must inform the individual in writing of the specific purpose and length of time for which the data will be collected, stored, and used, and must obtain the individual’s written release.
  • Written Data Retention and Destruction Policy. Companies must develop and make publicly available a written policy establishing a retention schedule and guidelines for permanently destroying biometric data.
  • Prohibition on Profiting from Biometric Data. Businesses may not sell, lease, trade, or otherwise profit from a person’s biometric identifiers or information.
  • Private Right of Action. BIPA provides a private right of action with statutory damages of $1,000 per negligent violation and $5,000 per intentional or reckless violation—creating substantial exposure for companies that handle biometric data at scale.

These provisions have made BIPA the subject of extensive litigation, particularly as companies have increasingly deployed technologies—such as facial recognition, virtual try-on features, and fingerprint timekeeping systems—that capture biometric information from consumers and employees.

The BIPA Healthcare Exemption

BIPA contains a significant carve-out: biometric identifiers “do not include information captured from a patient in a healthcare setting or information collected, used, or stored for health care treatment, payment, or operations under the federal Health Insurance Portability and Accountability Act of 1996.” This exemption has two distinct prongs:

  • Prong One (Healthcare Setting). Information captured from a patient in a healthcare setting is excluded from BIPA’s definition of biometric identifiers.
  • Prong Two (HIPAA-Related Use). Information collected, used, or stored for healthcare treatment, payment, or operations “under” HIPAA is likewise excluded.

The exemption reflects the Illinois legislature’s apparent intent to avoid imposing duplicative regulatory requirements on entities already subject to the comprehensive data-protection obligations of HIPAA. Companies have sought to invoke this exemption in a variety of contexts, arguing that their products or services have health-related attributes that bring their biometric data collection within the statutory carve-out.

Until recently, appellate courts had provided limited guidance on the exemption’s scope—particularly with respect to how “health care treatment” should be construed and what role HIPAA compliance plays in the analysis. The Seventh Circuit’s decision in Clements v. Gunnar Optiks now offers important new guidance.

Case Summary: Clements v. Gunnar Optiks LLC

Gunnar Optiks LLC (Gunnar) sells eyeglasses marketed to relieve digital eye strain. To help consumers visualize its products, Gunnar offered a “virtual try-on” tool that activated a device camera, scanned the user’s face, and transmitted facial geometry data so images of various frames could be displayed. A proposed class action alleged that Gunnar collected this biometric data from Illinois consumers without providing notice or obtaining written consent as BIPA requires.

Gunnar did not dispute that facial geometry is a biometric identifier under the statute, nor that it failed to comply with BIPA’s consent and retention rules—instead, it invoked the healthcare exemption. The U.S. District Court for the Northern District of Illinois (Judge Sara L. Ellis) dismissed the case under Rule 12(b)(6), accepting that defense at the pleading stage. Notably, when previously sued in Illinois state court on similar claims, Gunnar relied on Prong One of the exemption (“information captured from a patient in a health care setting”), which the Illinois First District Appellate Court rejected in Marino v. Gunnar Optiks LLC, 2024 IL App (1st) 231826 (September 2024), finding that an online retail environment is not a healthcare setting. In the federal action, Gunnar shifted to Prong Two, arguing the data was collected for “health care treatment … under … HIPAA.”

The Seventh Circuit’s Decision

In an opinion authored by Judge Easterbrook and joined by Chief Judge Brennan and Judge Taibleson (argued February 24, 2026; decided July 10, 2026), the Seventh Circuit reversed the district court’s dismissal and remanded for further proceedings.

The court’s reasoning centered on several key points:

  • The Data’s Purpose, Not the Product’s Nature, Controls. The court emphasized that the relevant inquiry is whether the biometric information itself is being collected, used, or stored for healthcare treatment, not merely whether the product has some health-related attribute. Judge Easterbrook characterized Gunnar’s virtual try-on tool as “aesthetic, not medical,” observing that the tool’s purpose was to help consumers see how frames would look on their faces, a commercial and aesthetic function, not a medical one.
  • “Better-Appearing Glasses Are Not Medical Treatment.” The court drew a clear line between products that may incidentally relate to health and genuine healthcare treatment, analogizing to “$5 sunglasses purchased at the corner drug store to reduce eye strain at the beach when reading a novel,” which “cannot be thought of as medical treatment.”
  • HIPAA Compliance as a Prerequisite. The court observed that the exemption refers to healthcare treatment “under” HIPAA, which “implies that, to be exempt, the entity that obtains the information must comply with HIPAA, a statute that, directly and through regulations, imposes numerous requirements of consent and confidentiality.” The court noted that the legislature likely intended to avoid duplicate regulation of entities already subject to HIPAA’s robust data-protection framework—not to create a blanket exemption for any company selling health-adjacent products.
  • Resolution Not Possible at the Pleading Stage. The court held that whether Gunnar actually complies with HIPAA’s requirements for collection and confidentiality “cannot be ascertained from the complaint.” The case therefore could not be resolved on a motion to dismiss and required factual development through discovery.
  • The Door Remains Open. While reversing the dismissal, the Seventh Circuit expressly left open the possibility that the healthcare exemption could ultimately apply upon further factual development, making this a case to continue monitoring.
Why This Matters: Practical Implications

The Seventh Circuit’s decision in Clements v. Gunnar Optiks carries significant practical and legal implications for companies that collect biometric data—particularly through consumer-facing technology.

Key Takeaways
  • A Data-Centric Inquiry Emerges. The Seventh Circuit appears to be moving toward a framework that asks directly: Is the biometric data itself being collected, used, or stored for healthcare treatment? Companies cannot rely on the general health-related nature of their product as a sufficient basis for the exemption. The focus is on the function the biometric data serves, not the broader characteristics of the product or service.
  • Broad Invocations of the Healthcare Exemption Will Face Skepticism. Companies that invoke the exemption based solely on a product’s tangential connection to health—without demonstrating that the specific biometric data collection is integral to healthcare treatment—should expect increased scrutiny from courts.
  • HIPAA Compliance Adds a Critical Layer. The court’s interpretation suggests that entities seeking the benefit of the exemption’s second prong must not only use biometric data for healthcare purposes but must also comply with HIPAA’s requirements. This presents an additional hurdle for companies that do not otherwise fall within HIPAA’s regulatory framework. Can a company voluntarily comply with HIPAA to avail itself of the BIPA healthcare exemption?
  • Virtual Try-On and Similar Technologies Require Careful Assessment. Companies deploying virtual try-on tools, augmented reality features, or other consumer-facing technologies that capture facial geometry or other biometric information should assess whether the data’s purpose is genuinely healthcare-related or primarily serves a commercial, aesthetic, or consumer-experience function.
  • Discovery and Factual Development Will Be Determinative. Because the Seventh Circuit remanded for further proceedings—and expressly left open the possibility that the exemption could apply with appropriate factual support—companies in this space should consider how their internal practices, documentation, and HIPAA compliance programs would withstand discovery scrutiny. Companies should also expect that courts will be reluctant to dismiss BIPA class actions on a preliminary motion and will require the case to proceed into discovery to explore the availability of the healthcare exemption.
  • This Decision Is Not Limited to Illinois-Based Companies. Although BIPA is an Illinois statute, its reach extends to any business that collects biometric information from individuals located in Illinois—regardless of where the company is headquartered or incorporated. There have also been arguments that BIPA can apply to non-Illinois residents when the acts that violated BIPA occurred substantially and primarily in Illinois. For example, some courts have theorized that BIPA could apply to individuals outside of Illinois where the collection and storage of biometric information (without notice and consent) occurred in Illinois or where the policy decisions that led to the violation were made by leaders in Illinois. The Clements decision is therefore relevant to businesses across the country that deploy consumer-facing biometric technology accessible to Illinois residents as well as Illinois businesses operating on a multi-state or nationwide basis.
Looking Ahead

Clements v. Gunnar Optiks returns to the district court for discovery and further proceedings. The case merits close attention as it develops, particularly as the factual record is built around Gunnar’s actual data practices and any voluntary HIPAA compliance efforts. The decision also reflects a broader trend in BIPA jurisprudence toward more rigorous analysis of the healthcare exemption, signaling that companies should not treat the exemption as a broad safe harbor for health-adjacent technologies.

Companies collecting biometric data should consult with legal counsel to evaluate their compliance obligations, assess whether existing exemption defenses remain viable in light of this decision, and ensure that their data collection practices are aligned with both BIPA’s requirements and the evolving case law.

If you have questions about BIPA applicability or compliance, please contact your Quarles data privacy attorney or:

END NOTES

1 740 ILCS 14/10

Follow Quarles

Subscribe Media Contact
Back to Main Content

We use cookies to provide you with the best user experience on our website and to analyze statistics related to our website. To understand more about how we use cookies, or for instructions to change your preference and browser settings, please see our Privacy Notice. Please note that if you choose to reject cookies, doing so may impair some of our website's functionality.