Johnson & Johnson’s consumer health division, Kenvue, agreed to pay $4.7 million to settle federal charges that its Neutrogena Skin360 app illegally collected and stored facial biometric data from approximately 11,000 Illinois residents without their informed consent. The settlement, filed for preliminary approval in February 2026, resolves a violation of Illinois’s Biometric Information Privacy Act (BIPA), one of the nation’s strictest laws protecting facial recognition and biometric data. Under the terms, affected consumers who used the Skin360 app between December 9, 2019, and May 5, 2023, may be eligible to receive individual payments—likely in the hundreds of dollars per person after legal fees and administrative costs are deducted.
The violation centered on how Neutrogena deployed the Skin360 service, which used a smartphone camera to scan users’ faces for skincare analysis. The company collected and retained these facial images without first obtaining the explicit, written consent required under Illinois law. For someone who downloaded the app to get personalized skincare recommendations and unknowingly had their facial biometric data stored indefinitely, this settlement represents one of the largest payouts for a BIPA violation in recent years and underscores the growing legal and financial risks companies face when mishandling biometric information.
Table of Contents
- What is BIPA and Why Did the Neutrogena Skin360 App Violate It?
- How Neutrogena Collected Facial Scan Data Without Proper Consent
- Who Is Eligible to Claim Settlement Money from This Neutrogena Settlement?
- How Much Money Can You Expect to Receive, and When?
- Important Limitations and Things You Need to Know
- What Changes Is Kenvue Required to Make Going Forward?
- What This Settlement Means for Biometric Privacy and Other Companies
- Conclusion
What is BIPA and Why Did the Neutrogena Skin360 App Violate It?
The Illinois Biometric Information Privacy Act, passed in 2008, is a landmark statute that protects consumers’ biometric identifiers—including fingerprints, facial geometry, and iris scans. Unlike many federal privacy laws that require proof of harm, BIPA imposes strict requirements on how companies collect, store, and use biometric data. The law demands that organizations obtain informed, written consent before capturing any biometric information and maintain transparent policies about how long they retain that data. It also grants consumers the right to sue directly, without having to prove actual injury, making it one of the most powerful privacy protections in American law.
Kenvue violated BIPA by collecting facial scans through the Skin360 app without first providing users with a clear, separate consent document explaining what data would be collected, how long it would be retained, and how it would be used or destroyed. Instead, users who opened the app and activated the camera feature had their facial geometry analyzed and stored without understanding they were providing biometric data subject to indefinite retention. This distinction matters enormously: the law doesn’t just require a mention buried in a terms-of-service document; it requires explicit, informed, written consent obtained before collection begins. The company’s failure to obtain proper consent before capturing and storing facial scans became the basis for the class action lawsuit. What makes the Skin360 case particularly significant is that the violation occurred across three product variants—Neutrogena Skin360, Neostrata Skin360, and related co-branded versions accessed via mobile app or web browser. This multiplied the reach of the unlawful data collection, affecting tens of thousands of consumers who believed they were using a simple skincare tool rather than submitting their biometric data to long-term storage.
How Neutrogena Collected Facial Scan Data Without Proper Consent
The Neutrogena Skin360 service worked by prompting users to hold their smartphone camera to their face, allowing the app to photograph and analyze their skin in three dimensions. This real-time biometric scanning created a digital map of facial features—essentially a facial fingerprint unique to each user. What many users did not realize was that Neutrogena retained these facial images in its database long after the analysis was complete. The company maintained these scans without a documented retention schedule or a clear deletion timeline, meaning facial biometric data could theoretically be stored indefinitely. During the class period from December 2019 through May 2023, Neutrogena did not provide users with a separate, standalone consent document before activating the facial scan feature.
The company did not explain in plain language what biometric data was being collected, nor did it disclose how long images would be kept or for what purposes they might be used or shared. For a user concerned about privacy, there was no clear opportunity to opt out of biometric data collection while still using the basic skincare recommendations the app offered. This practice runs counter to BIPA’s requirement that companies respect consumers’ autonomy in deciding whether their biometric information can be collected and retained. A critical limitation of the settlement is that consumers whose facial images were stored can only claim damages if they were residents of Illinois during the collection period. Users in other states, even if their data was collected, fall outside the class definition and cannot participate in this particular settlement, though they may have claims under other state privacy laws or BIPA if they can establish an Illinois connection.
Who Is Eligible to Claim Settlement Money from This Neutrogena Settlement?
Eligible class members are approximately 11,000 individuals who resided in Illinois and used the Neutrogena Skin360, Neostrata Skin360, or related co-branded skin analysis apps at any time between December 9, 2019, and May 5, 2023. This definition captures everyone who activated the facial scanning feature during that three-and-a-half-year window, regardless of how frequently they used the service or whether they purchased any Neutrogena products. The settlement’s records—maintained by Kenvue and provided to the settlement administrator—will be cross-referenced with consumer addresses to identify and notify eligible claimants. To claim a settlement payment, eligible consumers must submit a claim form to the settlement administrator by the court-approved deadline, typically within a specific window following final settlement approval. Claim forms ask for proof of usage and may request information about when and how often the claimant used the app. Documentation might include email confirmations from app store accounts, email receipts from Neutrogena if the user The $4.7 million settlement pool is allocated primarily to individual class member payments, with substantial portions reserved for attorney’s fees (typically 25 to 30 percent of the settlement) and administrative costs for claims processing, notice, and settlement administration (usually another 5 to 10 percent). This means approximately $3.2 to $3.5 million remains available for direct consumer compensation. If the estimated 11,000 class members all submit valid claims and split this remaining amount equally, individual payouts would approximate $290 to $320 per person before any final adjustments. In practice, however, not every class member files a claim. If 5,000 people claim compensation from the settlement, per-claim payments would double to roughly $600 to $700. Conversely, if claim rates are exceptionally high—above 90 percent of the estimated class—per-claim amounts may fall closer to $250 to $300. The claim period is limited, meaning consumers who miss the deadline forfeit their share. Any unclaimed funds may be distributed as cy pres awards to related privacy advocacy organizations, rather than returned to the defendant. Payment timelines typically extend 6 to 12 months from the submission of a valid claim, depending on how quickly the settlement administrator processes claims, resolves disputes, and obtains court approval for distribution. Claimants should expect to receive payment by check or direct deposit well into 2027, assuming the preliminary approval granted in February 2026 progresses without significant legal challenges. Notably, settlement payments are generally not taxable as income because they represent compensation for a civil violation rather than income from a service or product sale. The settlement is limited to Illinois residents and does not cover consumers in other states, even if their biometric data was collected by Neutrogena. Residents of neighboring states or other parts of the country cannot file claims under this specific settlement class. However, non-Illinois consumers may have claims under their own state privacy laws or could potentially join separate litigation if another class action is filed in their jurisdiction. This geographic limitation is significant because facial recognition data has no state boundaries—a person in Wisconsin or Michigan whose data was collected is excluded from compensation despite being equally harmed. Another limitation involves the statute of limitations on discovery. Class members have a finite window to claim their settlement payment, often just 60 to 90 days after final court approval. Missing this deadline means forfeiting the right to compensation from this settlement entirely. Settlement notices will be sent by mail and email to known addresses, but some consumers may not receive notice if their address on file with Kenvue is outdated or incorrect. Those who do not receive notice but believe they should be eligible must actively search for settlement information online and file claims before the deadline passes. Additionally, the settlement does not impose punitive damages or additional penalties beyond the $4.7 million payout, meaning it does not reimburse the cost of credit monitoring, security freezes, or other protective measures some consumers may have taken after discovering their biometric data was compromised. As part of the settlement agreement, Kenvue must delete all facial images and biometric data collected during the class period and cannot re-collect similar biometric data without first obtaining explicit written consent. The company must implement new policies governing the collection, retention, and destruction of biometric information and must provide users with clear, separate consent forms before capturing any facial scans in future versions of skincare analysis apps. These requirements apply to Skin360 and any successor applications. Specifically, Kenvue must establish a written retention schedule specifying how long facial images will be kept, must provide users with the option to request deletion of their biometric data at any time, and must honor deletion requests within a reasonable timeframe. The settlement also requires Kenvue to post and maintain a policy document explaining its biometric data practices, giving consumers access to information about what data is collected and how it is protected. In effect, the settlement uses legal injunctions to force the company to comply with Illinois BIPA standards going forward, making compliance a contractual obligation subject to court oversight. The Neutrogena Skin360 settlement joins a growing category of BIPA enforcement actions that have produced multi-million-dollar settlements against companies ranging from retailers to technology firms. Prior settlements with companies like Facebook, Google, and various retail chains have established that BIPA violations can be extremely costly, creating powerful financial incentives for other organizations to audit their biometric data practices and obtain proper consent before collecting facial scans or fingerprints. The settlement sends a clear market signal: companies cannot treat facial recognition and biometric data collection as ancillary features without legal guardrails. Looking forward, this case underscores a broader trend: privacy laws are shifting from requiring proof of actual harm to holding companies accountable simply for unauthorized collection and retention of sensitive data. BIPA was ahead of its time when enacted in 2008, but newer federal and state privacy laws are now catching up, adopting similar standards requiring explicit consent for biometric collection. As more states pass biometric privacy legislation, consumers nationwide—not just in Illinois—will have stronger legal protections and clearer grounds to challenge companies that collect facial or fingerprint data without permission. For companies developing skincare, fitness, payment, or identity verification apps, the Neutrogena case is a cautionary tale about the cost of assuming consent is implied or embedded in terms of service. The $4.7 million settlement between Kenvue and Illinois consumers harmed by the Neutrogena Skin360 app represents one of the largest BIPA enforcement outcomes to date and demonstrates the real financial consequences of unauthorized biometric data collection. Approximately 11,000 eligible class members—those who used the app between December 2019 and May 2023—can expect to claim individual payments in the hundreds of dollars, contingent on filing claims before the deadline and on the total number of claims submitted. While the settlement provides financial restitution, it is limited geographically to Illinois residents and does not compensate consumers in other states, despite the fact that biometric data collection has no borders. If you used Neutrogena Skin360, Neostrata Skin360, or any co-branded variant of the facial analysis app while living in Illinois during the specified period, watch for claim notices in the mail and via email, and plan to submit your claim promptly once the settlement is finalized and the claims period opens. The settlement administrator will provide detailed instructions on how to file and what documentation may be required, but the burden falls on consumers to take action within the deadline. For more information, monitor the official class action settlement website once it becomes available, and note that you should never pay any fee to file a claim—legitimate settlement claims are always free to submit.
How Much Money Can You Expect to Receive, and When?
Important Limitations and Things You Need to Know
What Changes Is Kenvue Required to Make Going Forward?
What This Settlement Means for Biometric Privacy and Other Companies
Conclusion
You Might Also Like