Articles Posted in Class-Action

|

Illinois is the busiest forum in the country for consumer class
actions, and the theories change faster than most businesses can track.
A company that believed its exposure was under control discovers a new
statute, a new wave of filings, and a new set of plaintiffs’ lawyers at
the door. The encouraging news for defendants is that the last two years
have also produced real defense victories, and a business that
understands the current landscape can meet these cases from a position
of strength.

Our firm defends businesses against consumer class actions of every
kind, from biometric and genetic privacy claims to website tracking,
telemarketing, consumer fraud, and data breach suits. This post walks
through the developments shaping Illinois class action defense in 2026
and what a business should do when the complaint arrives.

Continue reading ›

|

Thirty days. That is the window a defendant has to decide where an Illinois class action will be litigated, and the decision is frequently made by default, in the middle of a document collection, by a company that has not yet read the complaint closely enough to know what it is holding. The forum question looks procedural. It is not. It determines which standing doctrine applies, whether a certification ruling can be appealed before trial, which precedents bind the judge, and in the privacy and statutory damages cases that dominate Illinois class litigation, it often determines whether the case survives at all.

The instinct to remove is usually right, and the analysis that supports it is more forgiving than defendants expect. Under the Class Action Fairness Act, 28 U.S.C. section 1332(d), a federal court has jurisdiction over a class action where any class member is a citizen of a state different from any defendant, the proposed class has at least one hundred members, and the aggregated claims exceed five million dollars. In Dart Cherokee Basin Operating Co. v. Owens, the Supreme Court held that a notice of removal need include only a plausible allegation that the amount in controversy is met, with evidence required later and only if the plaintiff contests it or the court questions it, and the Court noted that no antiremoval presumption applies to cases invoking CAFA. In Standard Fire Insurance Co. v. Knowles, a unanimous Court held that a named plaintiff cannot defeat CAFA jurisdiction by stipulating before certification that the class will not seek more than five million dollars, because he cannot bind absent class members before they are a class.

Continue reading ›

|

The complaint arrives styled as a class action, and the number at the bottom of the page is built to frighten you. A single fee, a single line in a form contract, or a single advertisement, multiplied across every customer you have served for years, until the demand looks large enough to swallow the company. The plaintiff’s lawyer wants you to see that number and reach for the checkbook before anyone asks the harder question. Can this case be a class action at all?

Most consumer fraud class actions are won or lost at class certification, the stage where the court decides whether one named plaintiff may sue on behalf of thousands. Illinois law gives a defendant real tools to defeat certification, and the strongest of them rests on one idea. A consumer fraud claim requires that each plaintiff was actually deceived, and deception rarely reaches thousands of people the same way.

Continue reading ›

|

By Peter S. Lubin and James V. DiTommaso

A process server hands your company a class action complaint late on a Friday. By Monday you are reading a theory that turns one disputed
charge or one form document into a claim brought on behalf of thousands of people. The instinct is to wait, to answer the complaint, and to see how bad it gets. That instinct is a mistake. What a defendant does in the first thirty days often decides the case, because the early choices
about where the lawsuit is heard and whether the plaintiff can clear the threshold hurdles shape everything that follows.

This is a plain guide to the opening moves that protect a business sued in a putative class action, from removal to federal court through
the standing defenses that can end the case before a class is ever certified.

Continue reading ›

|

Your hiring process probably uses artificial intelligence right now, whether you know it or not. The applicant tracking system that ranks resumes before a human reads them. The assessment platform that scores candidates on a video interview. The scheduling tool that screens out applicants who cannot work certain shifts. Vendors sold these tools as efficiency. Illinois law now treats them as a compliance obligation with teeth.

On January 1, 2026, Public Act 103-0804 took effect. It amends the Illinois Human Rights Act, 775 ILCS 5, to regulate the use of artificial intelligence in employment decisions, and it applies to recruitment, hiring, promotion, renewal of employment, selection for training or apprenticeship, discharge, discipline, tenure, and the terms, privileges, and conditions of employment. That list covers nearly everything an employer does.

If the pattern of the last decade holds, the plaintiffs’ bar will treat this statute the way it treated the Biometric Information Privacy Act and the Genetic Information Privacy Act: find a technical violation, file on behalf of a class of applicants or employees, and multiply. The employers who fared best in the BIPA wave were the ones who fixed their practices before the first demand letter. This statute offers the same head start.

Continue reading ›

|

The demand letter usually starts with a fingerprint. Your employees clock in and out on a biometric time clock, the way millions of workers do, and a plaintiff’s lawyer has noticed. The complaint says the company collected those fingerprints without the written consent the Illinois Biometric Information Privacy Act requires, and then it multiplies. Every scan, by every employee, on every shift, across years, becomes a separate violation, each one tagged at $1,000 or $5,000, and the spreadsheet at the bottom of the letter reaches a figure that looks like the entire value of the company. The message is the one every BIPA demand is built to send. Settle now, because trial would be extinction.

That math is built to look fixed. It is not, and since August 2024 it is wrong on its face. The Illinois legislature amended BIPA that month, and the year before, the Illinois Supreme Court had already said that the damages a plaintiff demands are not the damages the statute commands. The company’s real exposure under the law the courts are actually applying today is a fraction of the number on the demand letter, and understanding why changes the entire posture of the case.

BIPA, codified at 740 ILCS 14, requires a business to give written notice and obtain a written release before it collects a person’s fingerprint, faceprint, or other biometric identifier, and section 20 sets liquidated damages of $1,000 for a negligent violation and $5,000 for one that is intentional or reckless, plus attorney’s fees. The Illinois Supreme Court held in Rosenbach v. Six Flags Entertainment Corporation that a person need not prove any actual injury beyond the statutory violation to sue, which is the holding that keeps these cases alive in state court and the premise on which every demand letter is built. The defense begins where that premise ends.

Continue reading ›

|

A clinic across town conducts pre-employment physicals for your company. The clinic’s intake form asks routine medical questions, including a section on family medical history. Two years later a class action arrives, naming your company under a statute most Illinois employers had not heard of three years ago. The complaint says you required disclosure of genetic information by asking, through the clinic, about heart disease, diabetes, and cancer in the applicant’s parents and siblings. The demand letter multiplies $15,000 per intentional violation by the number of applicants over the last several years and arrives at a number that looks like the cost of the lawsuit settling itself.

The statute is the Illinois Genetic Information Privacy Act, 410 ILCS 513, and the wave of cases under it is real. By industry counts, more than fifty putative class actions were filed in 2023 alone, and the filings have continued. The plaintiffs’ bar is treating GIPA as the new BIPA, with one important difference. The damages are higher. GIPA’s private right of action lets a court award $2,500 per negligent violation and $15,000 per intentional or reckless violation, plus attorney fees and costs, two and a half to three times BIPA’s $1,000 and $5,000 amounts. For an employer that screens dozens or hundreds of applicants each year, the math is exactly as alarming as it sounds.

It is also not the math the law has settled on. GIPA litigation is several years younger than BIPA litigation, and the doctrinal walls are still being built. But early defense decisions, statutory text the plaintiffs’ bar tends to underplay, and standard federal-court tools already give Illinois employers more leverage than the demand letter suggests.

Start with what GIPA actually prohibits. Section 25, 410 ILCS 513/25, bars an employer from directly or indirectly soliciting, requesting, requiring, purchasing, or otherwise obtaining genetic information of an individual or a family member as a condition of employment or for use in employment decisions. Section 10 defines genetic information, in language borrowed from federal law, to include the manifestation of a disease or disorder in family members of the individual, which is the legal phrase for family medical history. Section 30 restricts disclosure of genetic testing and information. Section 40 supplies the right of action and the liquidated damages.

The first defense is the one most employers miss. GIPA does not prohibit collection of the applicant’s own personal medical history. It prohibits collection of genetic information, which as a matter of statutory definition is information about the applicant’s genetic tests, the genetic tests of family members, or family medical history, the disease history of family members. An intake form that asks an applicant whether the applicant has had hypertension, diabetes, or back surgery is asking about the applicant. It is not asking about family. The same form that asks whether the applicant’s parents, siblings, or grandparents have had heart disease or cancer is asking about family medical history and is in GIPA’s territory. The distinction is not cosmetic. It can be the difference between liability and a routine occupational-health question.

The second defense comes from the leading appellate decision interpreting GIPA’s reach. In Bridges v. Blackstone, Inc., the Seventh Circuit affirmed the dismissal of a putative class action arising from Blackstone’s all-stock acquisition of the genealogy company Ancestry. The plaintiffs alleged that the acquisition itself was a disclosure of their genetic information in violation of Section 30. The Seventh Circuit disagreed, holding that a run-of-the-mill corporate acquisition, without more, does not result in a compulsory disclosure of genetic information under the statute. Bridges is the first appellate decision to push back on an aggressive reading of GIPA, and its reasoning is portable. It tells defense counsel that the statute’s words mean what they say, that the conduct the plaintiff is challenging must actually fit the statutory verb being invoked, and that the courts will not stretch GIPA into every transaction or every form that touches medical information in a tangential way. Continue reading ›

|

The complaint reads like an indictment of your marketing department. A national class. Allegations that a label, a website disclosure, or a price representation deceived consumers. A nationwide class period stretching back five years. A demand for restitution, actual damages, punitive damages, and a permanent injunction against your business practices. The Illinois Consumer Fraud and Deceptive Business Practices Act, 815 ILCS 505, is one of the broadest consumer-protection statutes in the country, and the plaintiffs’ bar treats it that way. The complaint is written to make a settlement feel inevitable long before discovery starts.

The complaint is doing what it is supposed to do. The Illinois Supreme Court and the Seventh Circuit have built five distinct doctrinal walls that most ICFA class actions never finish climbing. An Illinois defendant who learns those walls early often resolves the case at the pleading stage or wins at class certification, not after eighteen months of merits discovery. The settlement number a plaintiff demands on day one is usually the number that fits the case the plaintiff hopes to have. It is not the case Illinois law gives them.

The first wall is the extraterritorial limit, set by the Illinois Supreme Court in Avery v. State Farm Mutual Automobile Insurance Co. The Act does not reach a transaction that occurred outside Illinois. The Court held that there is no bright-line formula, but the inquiry asks whether the circumstances relating to the disputed transaction occurred primarily and substantially within Illinois. In Avery itself, a Louisiana plaintiff whose accident, repair, estimate, and dealings with the insurer all happened in Louisiana had no cause of action under the Illinois statute. The implication for class actions is enormous. A putative nationwide class that includes residents of forty-nine other states, whose purchases occurred everywhere except Illinois, runs straight into Avery. Many of these claims should not survive a motion to dismiss as to the out-of-state plaintiffs, and they almost never survive a contested class certification.

The second wall is choice of law in nationwide classes, illustrated by the Seventh Circuit’s decision in In re Bridgestone/Firestone, Inc. Tires Products Liability Litigation. Judge Easterbrook, writing for the panel, reversed certification of two nationwide classes because the claims would have to be adjudicated under the law of so many different jurisdictions that a single nationwide class was not manageable. The Seventh Circuit explained that the choice-of-law rules of the forum state ordinarily point to the consumer-protection law of each plaintiff’s home jurisdiction, not to a single state’s statute applied across the country. The implication for an Illinois ICFA class action that tries to reach beyond Illinois purchasers is direct. Where the trial court would have to apply Illinois law to some plaintiffs, California law to others, New York law to others, and so on, the predominance and manageability findings that Rule 23 demands collapse. Bridgestone is the case that prevents a single Illinois plaintiff from acting as a national consumer-protection regulator through one complaint. Continue reading ›

|

The complaint usually starts with a text message that looked perfectly ordinary on the way out the door. Your marketing team uploaded a customer list, the platform sent the campaign, and the response rates were strong. Months later a class action lands in the Northern District of Illinois on behalf of every recipient. The demand letter multiplies the number of texts by $500 per call under the Telephone Consumer Protection Act, then helpfully reminds you that the number can become $1,500 each if the conduct was willful, and the total has a comma in places you did not expect.

That math, like the math in most class action demands, is built to look fixed. It is not. In the last five years three different decisions, two of them issued in 2025, have moved the law harder in the defense’s direction than at any point since Congress passed the TCPA in 1991. An Illinois business defending a TCPA case today is operating in a very different statute than the one its adversaries are still describing.

Start with the statute itself. The TCPA, 47 U.S.C. 227, restricts calls and texts made using an automatic telephone dialing system, an artificial or prerecorded voice, and certain marketing to numbers on the federal do-not-call registry. Section 227(b)(3) lets a private plaintiff recover actual damages or $500 per violation, whichever is greater, with treble damages of $1,500 per call available where a court finds a willful or knowing violation. Multiplied across a putative class, the exposure is the entire point of the statute and the entire point of the demand letter.

The first decision that reshaped this landscape is Facebook, Inc. v. Duguid, decided by the United States Supreme Court in April 2021. The Court read the TCPA’s definition of an automatic telephone dialing system, often called an ATDS, in its plain terms. To qualify, a system must use a random or sequential number generator to store or produce the numbers it dials. Equipment that simply dials from a stored list of customer numbers, the workhorse of modern marketing platforms, does not qualify. The Seventh Circuit had already reached the same result a year earlier in Gadelhak v. AT&T Services, Inc., an opinion authored by then-Judge Amy Coney Barrett that the Supreme Court effectively ratified. The practical consequence in Illinois federal court is significant. A great many of the text and call campaigns that anchored the explosion of TCPA class actions a decade ago no longer involve an ATDS at all. The complaint may still allege one. The technology often does not support the allegation. That mismatch is a defense from the pleading stage forward. Continue reading ›

|

The complaint usually arrives with a number attached, and the number is designed to take your breath away. A former employee, now a class representative, says your company scanned her fingerprint every time she punched the clock. Multiply one finger scan by every shift, by every worker, across several years, and the demand letter floats an exposure figure that looks less like a lawsuit and more like a going-out-of-business sale. The message is not subtle. Settle now, settle big, and do not ask too many questions.

That message is a negotiating tactic. It is not a legal conclusion. The Illinois Biometric Information Privacy Act, 740 ILCS 14/1 and following, is a real statute with real teeth, and we do not pretend otherwise to our clients. But the law in this area has moved hard over the last three years, and a meaningful share of that movement has favored the defense. The Illinois business that understands the current landscape negotiates from a much stronger position than the business that reaches for the checkbook the day it is served.

Start with what the statute actually requires, because most demand letters blur it. BIPA regulates biometric identifiers and biometric information, which the Act defines to include fingerprints, retina and iris scans, voiceprints, and scans of hand or face geometry. Section 15(b) is the heart of most cases. Before a private entity collects that data, it must tell the person in writing that the data is being collected, state the specific purpose and the length of term for which it will be collected and stored, and obtain a written release. Section 15(a) requires the entity to publish a written retention and destruction policy and to destroy the data when the purpose is satisfied or within three years of the person’s last interaction, whichever comes first. Section 15(c) bars selling or profiting from the data. Section 15(d) restricts disclosure. Section 15(e) requires a reasonable standard of care in storage. Section 20 supplies the damages that make these cases attractive to the plaintiffs’ bar: liquidated damages of $1,000 for each negligent violation and $5,000 for each intentional or reckless violation, or actual damages if greater, plus attorney fees and an injunction.

For several years the Illinois Supreme Court read those provisions in ways that steadily raised the stakes. In Rosenbach v. Six Flags Entertainment Corp., the Court held that a person is aggrieved, and may sue, on the bare violation of the statute, with no need to plead an actual injury. In Tims v. Black Horse Carriers, Inc., the Court held that the generous five-year catch-all limitations period governs every BIPA claim. And in Cothron v. White Castle System, Inc., a divided Court held that a separate claim accrues with every scan and every transmission, not just the first one. Cothron is the decision that produces the eye-watering numbers, because it lets a plaintiff multiply a single fingerprint by years of daily punches.

Here is what the demand letters tend to leave out. The legislature answered Cothron. Effective August 2, 2024, Public Act 103-0769 amended Section 20 so that a private entity that collects or discloses the same biometric identifier from the same person using the same method commits a single violation, for which the aggrieved person is entitled to, at most, one recovery. The same amendment confirmed that an electronic signature satisfies BIPA’s written-release requirement. In plain terms, the per-scan multiplication that drove the catastrophic exposure figures was cut off at the knees for conduct going forward, and the recovery is now anchored to the person, not the punch.

The defense news did not stop there. In Clay v. Union Pacific Railroad Co., one of a set of consolidated appeals the United States Court of Appeals for the Seventh Circuit decided in April 2026, the court held that the 2024 damages amendment applies retroactively to cases that were already pending when it took effect. The court reasoned that the change was remedial rather than substantive, because it altered only the damages available and not the underlying standard of liability, and that Illinois courts apply remedial changes retroactively. For Illinois businesses defending claims premised on years of historical scans, that holding can transform the math the plaintiff has been counting on.

The amendment limits the size of the case. Several established defenses can dispose of it altogether or push it out of the forum the plaintiff wants. Three are worth understanding.

The first is the health care exemption. Section 10 excludes information collected, used, or stored for health care treatment, payment, or operations under HIPAA. In Mosby v. Ingalls Memorial Hospital, the Illinois Supreme Court read that exemption in the disjunctive and applied it to the fingerprints health care workers used to access medication dispensing systems for patient care. A hospital, clinic, or other provider sued over biometrics tied to patient care should look hard at Section 10 before conceding the statute even applies.

The second is federal labor preemption. In Walton v. Roosevelt University, the Illinois Supreme Court held that Section 301 of the Labor Management Relations Act preempts BIPA claims brought by union employees when the collective bargaining agreement contains a broad management-rights clause, because the dispute belongs in the grievance and arbitration process, not in court. For employers with a unionized workforce, and a management-rights clause is common, Walton can move the entire fight to a different arena. Continue reading ›

Contact Information
Chicago Office
19 S LaSalle St #702
Chicago, IL 60603
Phone: 630-333-0333
Mailing Address
17W220 22nd St #410
Oakbrook Terrace, IL 60181
Phone: 630-333-0333 Please direct all mail correspondence to our Oakbrook Terrace address office.
Highland Park Office
189 Whistler Rd
Highland Park, IL 60035
Direct Line: 630-710-4990
We accept the following credit cards
Credit Cards Accepted
We accept payment via Venmo at: @L-A-LAW
Phone: 603-333-0333
Visit our site: chicagobusinesslawfirm.com

Prior results do not guarantee a similar outcome. Every case is different and results depend on the facts of the individual matter.

Please do not include any confidential or sensitive information in a contact form, text message, or voicemail. The contact form sends information by non-encrypted email, which is not secure. Submitting a contact form, sending a text message, making a phone call, or leaving a voicemail does not create an attorney-client relationship.

Copyright © 2026, DiTommaso Lubin, P.C.
JUSTIA Law Firm Blog Design