Latest / Restaurant Business with Fexingo: Food Service, Hospitality, and Independent Operators / Why Restaurant Data Privacy Lawsuits Are Surging in 2026
Transcript
- Lucas: You know that moment when you walk into a restaurant, and instead of a paper menu, they scan your face or take your fingerprint to pull up your rewards profile? Luna: Yeah, I've seen it. Some of the bigger fast-casual chains use it for loyalty. Hardee's, Captain D's — they've been testing facial recognition at kiosks. Lucas: Right. Well, that convenience is turning into a legal landmine. In the first half of 2026 alone, more than 40 class-action lawsuits have been filed against restaurants over biometric data collection. Compare that to just 12 in all of 2025. Luna: That's a threefold increase in six months. What's driving it? Lucas: The biggest driver is Illinois's Biometric Information Privacy Act — BIPA. It's been on the books since 2008, but plaintiffs' lawyers have really found their stride with it. BIPA allows private citizens to sue for each violation, and damages can stack up fast. We're talking $1,000 per negligent violation, $5,000 for intentional or reckless. Luna: And if you're a chain with thousands of employees and customers whose biometrics were collected without explicit consent... that adds up. Lucas: Exactly. Take the recent settlement involving a popular fast-food chain — they agreed to pay $50 million to resolve a BIPA class action over employee fingerprint scans used for time clocks. That's not even counting the customer-facing stuff. Luna: So restaurants are getting hit from two sides: employee data and customer data. Which one is more common? Lucas: Employee data suits are actually the older wave — those started around 2018. But customer-facing biometrics? That's the new frontier. Touchless payments, facial recognition for loyalty, even voice ordering at drive-throughs — all generating biometric data that most operators haven't thought to protect. Luna: And it's not just Illinois. Other states have their own laws — Texas, Washington, California. But BIPA is the most aggressive because of that private right of action. Lucas: Right. And now there's movement at the federal level. The American Privacy Rights Act — APRA — is working its way through Congress. If it passes, it would create a national standard for data privacy, including biometrics. But it could also preempt state laws like BIPA, which is a double-edged sword for restaurants. Luna: Meaning what — they'd have one rule to follow instead of 50, but the federal rule might be less strict? Lucas: That's the fear among privacy advocates. But for operators, the immediate risk isn't theoretical. We're seeing lawsuits against independent restaurants too, not just chains. A single-plaintiff suit can still cost $100,000 to defend. Luna: So if you're a restaurant owner listening right now, what do you do? Stop using biometrics? Lucas: Not necessarily. But you need a compliance checklist. First: review all vendor contracts. If you use a time clock vendor or a loyalty platform that collects biometrics, make sure they warrant compliance with BIPA and similar laws. Second: get explicit written consent — not just buried in terms of service. Third: limit data retention. BIPA requires you to have a written policy for how long you keep biometric data and when you destroy it. Luna: And that's something a lot of operators haven't done. They just set up the system and forgot about it. Lucas: Exactly. I talked to a lawyer who specializes in this, and she said the biggest mistake restaurants make is treating biometric data like any other piece of customer info. It's not. Biometrics are immutable. You can change a credit card number, but you can't change your face. Luna: That's a powerful way to think about it. So what's the actual cost of noncompliance? Beyond the settlements. Lucas: Reputational damage is real. When a lawsuit hits the news, customers start asking questions. And there's also the cost of defending against a class action — even if you win, legal fees can run into the millions. Some operators are now buying cyber insurance that specifically covers privacy class actions, but premiums are going up. Luna: Is there any upside? I mean, could data privacy become a competitive advantage? Lucas: It already is in some markets. A few forward-thinking chains are voluntarily publishing their data collection policies and getting certified by privacy trusts. They're using it as a marketing angle — 'we protect your data better than the next guy.' And customers are noticing, especially younger demographics. Luna: So it's not just about avoiding lawsuits. It's about building trust. Lucas: Exactly. And that trust translates to repeat business. If a customer knows you're not going to mishandle their face scan or fingerprint, they're more likely to sign up for your loyalty program. Luna: Alright, so practical steps: audit your data collection, update your consent forms, check vendor contracts, and consider insurance. Anything else? Lucas: One more: train your staff. If a customer asks what happens to their data, your front of house team should know the answer. Nothing erodes trust faster than 'I don't know, let me ask the manager.' Luna: That's a good note to end on — but before we wrap, I want to mention something that ties back to this idea of diligence and trust. If these conversations have helped you think more carefully about your own operations, even in a small way, and you'd like to support the show staying independent and ad-free, you can do that at buy me a coffee dot com slash fexingo. Lucas: Yeah, we really appreciate that. It's listener support that keeps us doing deep dives like this one. And speaking of deep dives — next episode, we're looking at the economics of restaurant reservation no-shows and the tech that's finally solving it. Luna: Looking forward to it. Thanks everyone.