Voiceprint and Facial Recognition Laws – Coming to a City Near You

We tend to view regulation and litigation as wholly separate enterprises. But federal regulatory agencies have always operated alongside private civil litigation, with each supplying functions the other cannot. Agencies set prospective standards and monitor compliance at scale. Litigation responds to concrete harm, remedying often unanticipated—or minimized—risks. Prior posts in this series traced the procedural mechanics of mass aggregation —from the equitable origins of representative litigation through Rule 23 to the modern MDL—and explained why those mechanisms exist as a structural response to the access failures of bilateral litigation . This post addresses a related but distinct question: Why private enforcement matters not just as a substitute for bilateral litigation, but as a necessary complement to public regulation. This symbiotic dynamic has held for decades, and an examination of that history underscores the importance of mass tort litigation as a regulatory backstop. The Structural Limits of Administrative Oversight The relationship between regulatory agencies and private litigation is complementary rather than redundant. Even at full capacity, administrative agencies face structural constraints that limit their effectiveness as enforcement mechanisms. The resource gap is the most straightforward. Regulated industries consistently outspend the agencies that oversee them. The pharmaceutical industry employs scientists, lawyers, and regulatory specialists whose collective depth of knowledge exceeds what any federal agency can match across its full portfolio of regulated products. An agency charged with monitoring thousands of products and reviewing hundreds of new applications annually necessarily operates with inherent informational disadvantages relative to the firms it oversees. The capture problem is more subtle but no less significant. Regulatory agencies are staffed, in significant part, by individuals who move between government service and the industries they regulate . This is not an indictment of those individuals—it reflects the reality that domain expertise concentrates in the private sector. But it nonetheless creates structural pressures that shape enforcement priorities in ways that do not always align cleanly with public interests. The latency problem is perhaps the most consequential. Pre-market approval is a snapshot, not an ongoing guarantee. An agency that approves a pharmaceutical compound based on clinical trial data cannot know what population-scale, long-term use will reveal. Post-market surveillance is resource-intensive and chronically underfunded . Harms that emerge years or decades after initial regulatory clearance may never trigger administrative enforcement action. These are not new problems. They have characterized the administrative state for decades, and they are precisely why private litigation has long served as a necessary counterpart to administrative enforcement. The Opioid Crisis: What Happens When Regulation Falls Short The opioid epidemic illustrates—at enormous human cost—what happens when regulatory oversight fails to keep pace with private-sector harm, and what private enforcement can accomplish when it fills the gap. The FDA approved OxyContin in 1995 based on clinical data that did not capture the addiction potential of mass-market, long-duration prescribing. Regulators, empowered to act against manufacturers and distributors flooding suspicious channels, were slow to exercise that authority at scale. State medical boards, operating in an environment shaped by industry-funded campaigns redefining pain management standards, did not flag prescribing patterns that, in hindsight, were plainly problematic. By the time the regulatory apparatus mobilized a meaningful response, hundreds of thousands of Americans had died. The tens of billions of dollars in settlements and judgments that followed came not through administrative action but through litigation— state attorneys general, municipalities, and private plaintiffs coordinated in MDL proceedings—that forced production of internal documents demonstrating what manufacturers and distributors knew and when they knew it. That information entered the public record through discovery. It informed subsequent regulatory responses, shaped public health policy, and produced one of the largest coordinated public health settlements in American history. PFAS and the Limits of Pre-Market Review Per- and polyfluoroalkyl substances—PFAS, or “forever chemicals”—illustrate a different dimension of the same structural problem. Manufacturers possessed internal research suggesting health risks associated with certain PFAS compounds for decades before that information became public. The EPA, constrained by the evidentiary standards of the Toxic Substances Control Act and facing significant industry opposition, did not set enforceable drinking water limits for the most common PFAS compounds until 2024 —roughly seventy years after their widespread industrial introduction. Private litigation, brought by communities near manufacturing facilities, military bases, and industrial sites, has produced more actionable information about PFAS health effects than decades of administrative process. Discovery in PFAS proceedings has surfaced internal documents , epidemiological data, and risk assessments that were never voluntarily disclosed. Those materials have informed subsequent regulatory action and generated the factual record on which ongoing public health policy depends. This is the information function of private litigation operating precisely as it should: Reaching into corporate decision-making in ways that administrative oversight either cannot compel or has not yet prioritized. Social Media and the Enforcement Frontier The current mass tort litigation against social media platforms for harms to adolescent mental health illustrates how private enforcement operates at the frontier of regulatory capacity. Congress has repeatedly attempted and failed to pass legislation governing platform design, algorithmic amplification, and the targeting of minors. The FTC’s authority is potentially applicable but has not been deployed at scale. The regulatory frameworks needed to establish clear standards remain, years into public awareness of the problem, largely unbuilt. Into that gap have stepped coordinated proceedings in federal MDL and state courts, alleging that platform features were designed with internal knowledge of their addictive potential and their disproportionate effects on adolescent development. Whatever the ultimate resolution of those cases, the litigation has already begun forcing into the public record information about internal product decisions and user research that no regulatory proceeding has yet reached. In March 2026, a California jury found Meta and YouTube liable for negligent platform design, rejecting both Section 230 and First Amendment defenses—the first bellwether verdict to hold platforms accountable for design-based harms to adolescents. Private enforcement is not a substitute for thoughtful legislation. But it is filling the gap that legislation has not occupied. The social media cases are, it should be noted, the most legally contested example in this series. Unlike pharmaceutical or chemical exposure litigation, platform liability claims must navigate Section 230’s broad immunity provisions and First Amendment questions that the opioid and PFAS cases did not present. The ultimate merits of these cases may differ from the prior examples. But even litigation that does not ultimately succeed forces into the public record information that regulatory silence cannot reach—and that distinction matters regardless of outcome. The Practical Consequence of a Smaller Administrative Footprint The structural argument for private enforcement as a complement to regulation is well-established. What fluctuations in agency capacity add is urgency.  Regulation and private litigation each supply what the other cannot. Regulation operates ex ante , setting prospective standards based on information available at approval. Litigation operates ex post , responding to harm that has materialized with discovery tools that can reach information never voluntarily shared. Regulation generalizes across industries; litigation develops facts specific to individual defendants and affected populations. Where these functions operate in tandem, the enforcement system is more complete. Where one contracts, the other must bear more weight. When agency enforcement capacity declines—whether through budget reductions, staff attrition, or shifts in enforcement priorities—the civil justice system is not simply one option among several. For many categories of diffuse harm, it becomes the only remaining mechanism capable of generating accountability. Companies that externalize costs onto the public face reduced administrative scrutiny. The deterrence effect of potential enforcement weakens. The information that litigation forces into the public record, and that regulators themselves have often relied upon, is no longer generated. One need not have a settled view on the optimal scope of the administrative state to recognize this dynamic. The practical question is not whether federal agencies should be larger or smaller. It is whether, given the enforcement landscape that actually exists, the civil justice system is equipped to do the work that system requires. Conclusion The debate over federal regulatory scope will continue, as it should. Reasonable people hold genuine disagreements about the appropriate role of administrative agencies, and those disagreements deserve serious engagement. But the institutions available to enforce safety norms and produce corporate accountability do not wait for that debate to resolve. When the administrative footprint contracts, courts and private litigation occupy the space. Mass tort aggregation, as this series has argued from the beginning, is not a procedural anomaly or an artifact of plaintiff-side opportunism. It is a structural feature of how diffuse harm gets addressed in a system where regulation has never been sufficient on its own. That function does not become less important when regulatory capacity declines. It becomes more so. Oliver Wendell Holmes once observed that “[t]he life of the law has not been logic: it has been experience.” The Common Law 1 (1881). The experience of the opioid epidemic, the decades of PFAS contamination, and the accumulating evidence of adolescent harm from platform design all point to the same structural lesson: Regulation and private enforcement are not competitors in an institutional zero-sum game. They are partners in an enforcement system that neither can sustain alone. The debate about their proper balance will continue. But dismissing private enforcement as mere opportunism ignores what experience has consistently shown: When private enforcement is absent, no one else fills the gap.

Class action litigators who practice in the BIPA space received clarity in April 2026 following the Seventh Circuit Court of Appeals’ decision in Clay v. Union Pacific Railroad Co. (“Clay”).[1] In a concise 17-page opinion, the court held that the Illinois General Assembly’s 2024 BIPA amendments, which established that BIPA damages should be evaluated on a per-person basis, should be applied retroactively to cases pending at the time of enactment. This decision is a setback for plaintiffs’ counsel who had invested heavily—in time and resources—in BIPA litigation as the next major vehicle for class action recovery. An overview of how we got here is below followed by a summary of the decision. History of BIPA In 2008, Illinois enacted the Biometric Information Privacy Act to respond to the “increasing use of biometric data in commerce.”[2] BIPA was intended to give individuals the right to control their biometric identifiers and information while providing a right of action and meaningful damages against entities that mishandled them. But one question quickly came to the fore: was a new claim accruing each and every time an employer collected the same information from the same employee? As one defendant argued, such a per-scan theory of claim accrual would create “potentially crippling financial liability” for employers who violate BIPA by “repeatedly collecting the same information in the same way.”[3] Recognizing the question’s importance, the Seventh Circuit, in Cothron v. White Castle System, Inc., certified the question of claim accrual to the Supreme Court of Illinois. During briefing, the defendant invoked Section 20—which sets the damages a plaintiff can recover “for each violation”—to dissuade the court from adopting its per-scan reading of Section 15, citing potentially astronomical awards. In a 2023 decision, the Illinois Supreme Court sided with the plaintiffs and held that pursuant to Section 15, claims accrue “with every scan or transmission” of biometric information.[4] The Illinois Supreme Court acknowledged the prospect of “potentially excessive damage awards,” but noted that concern is “best addressed by the legislature.”[5] Accordingly, the court concluded its opinion by “respectfully suggest[ing] that the legislature review these policy concerns and make clear its intent regarding the assessment of damages under the Act.”[6] The Illinois General Assembly Acts Less than a year and a half after Cothron, the Illinois General Assembly heeded the court’s call and passed an amendment that added two clauses to Section 20. The first provided that any entity that collects biometric information “in more than one instance… from the same person using the same method of collection in violation of subsection (b) of Section 15 has committed a single violation…for which the aggrieved person is entitled to, at most, one recovery under this Section.[7] The second added the same operative language for violations of Section 15(d).[8] Going forward, it was now clear that only “one recovery” was available per person (regardless of how many scans there were), transforming potentially excessive damages into more modest ones. But the legislature left one question open: should the amendments apply retroactively to cases already in progress? The Clay Decision According to the Seventh Circuit, Illinois courts have a simple decision tree when it comes to assessing retroactivity. First, did the legislation expressly indicate the temporal reach of the amendment? If yes, case closed. If not, then the court must assess whether the amendment in question constituted a substantive or procedural change to the law. Under Illinois law, a substantive amendment “prescribes the rights, duties, and obligations of persons to one another as to their conduct or property and … determines when a cause of action for damages or other relief has arisen.”[9] Conversely, a procedural amendment involves the “rules that prescribe the steps for having a right or duty judicially enforced, as opposed to the law that defines the specific rights or duties themselves.”[10] While the Clay court acknowledged that the distinction between the two can, in many different contexts, “be unclear,”[11] the court had no trouble deciding the case at bar for one simple reason: the “amendment to BIPA Section 20 is a remedial change,”[12] and “the Supreme Court of Illinois treats remedial changes as procedural, not substantive.”[13] Two features of the amendments were critical: First, the legislature located the amendments in Section 20, which governs liquidated damages, rather than Section 15, which sets the substantive standards for liability under the Act. Second, the amendments’ plain language “focuses on remedies,”[14] indicating that an “aggrieved person is entitled to, at most, one recovery under this Section.”[15] The court’s analysis was straightforward. For those BIPA litigants involved in currently pending cases, the litigation terrain just got bumpier for plaintiffs and more favorable for defendants. Plaintiffs’ settlement leverage in these cases has been significantly reduced. Nevertheless, with enough putative class members, BIPA cases could still be worth bringing, even if they are no longer as valuable. We will continue to monitor the ramifications of this decision. Notes: [1] No. 25-2185 (7th Cir. Apr. 1, 2026). [2] Id. at 3. [3] Id. [4] Cothron v. White Castle System, Inc., 216 N.E.3d at 921 (Ill. 2023). [5] Id. at 929. [6] Id. [7] 740 ILCS 14/20(b). [8] Id. at 14/20(c). [9] Perry v. Dept. of Fin. & Prof. Regulation, 106 N.E.3d 1016, 1034 (Ill. 2018). [10] Id. [11] Clay at 8. [12] Id. at 9. [13] Id. at 8. [14] Id. at 10. [15] 740 ILCS 14/20(b), (c) (emphasis added).