# You Thought You Were Taking a Selfie. The Law May Call What Happened Next Biometric Data. 2026-09-18 · Somerset County, New Jersey · Reported Feature A new court-authorized Skin360 settlement notice shows how easily a casual consumer interaction can become a legally significant data transaction. A new court-authorized Skin360 settlement notice shows how easily a casual consumer interaction can become a legally significant data transaction. --- A lot of modern technology consent barely feels like consent at all. A screen asks for access to your camera. You line up your face. Maybe you move closer to the light. A progress ring spins for a few seconds, and the reward is something ordinary: a skin assessment, a product recommendation, a little personalized advice about moisturizer. Nothing about that sequence feels especially dramatic. That is precisely what makes the latest notice in the Neutrogena Skin360 biometric-privacy case worth paying attention to. A court-authorized settlement notice issued Sept. 11 from Trenton concerns a proposed $4.7 million class-action settlement involving Johnson & Johnson Consumer Inc., now known as Kenvue Brands LLC. The lawsuit alleges that versions of the Skin360 tool collected, stored, disclosed or profited from biometric identifiers or information from Illinois users who scanned their faces for a skin assessment without first providing the written disclosures and consent required by the Illinois Biometric Information Privacy Act, or BIPA. Kenvue denies wrongdoing, and the court has not decided which side is right. The settlement has been preliminarily approved, with a final approval hearing scheduled for Dec. 17. The proposed class covers people who used a Skin360 skin assessment while in Illinois through a mobile app or web application between Dec. 9, 2019 and May 5, 2023. Court filings estimate roughly 11,000 class members. Under the settlement, valid claimants would share the fund after fees and expenses, and the company would be required to confirm deletion of images obtained during Skin360 assessments in the class period and maintain notice, written-consent and retention practices for the service, subject to the settlement terms. The legal details matter. But the more interesting consumer question sits one layer above them: when did looking at your own face become a data transaction you needed to understand like a contract? Illinois law makes an important distinction that helps answer that question. BIPA does not define an ordinary photograph itself as a biometric identifier. It does, however, specifically include a scan of face geometry. That difference is the whole story in miniature. To a consumer, the action may feel like taking a selfie. To the underlying system, the same moment can allegedly become an opportunity to measure, derive or store information about the structure of a face. The privacy problem is not that every selfie is secretly biometric data. It is that a familiar interface can be the front door to a much more complicated process, while giving the user very little intuitive sense that the category of the interaction has changed. We are getting very good at making sophisticated data collection feel mundane. A fingerprint unlocks a phone. A face opens an app. A voice command starts the lights. A camera estimates age, mood, skin condition or body position. Each interaction is presented through an interface designed to make the technology disappear. The best consumer experience is supposed to feel effortless, which means the collection step is often reduced to a button, a permission prompt or a sentence nobody wants to interrupt the experience to read. That design philosophy works beautifully for convenience. It is much less comfortable when the information involved is difficult to replace, unusually revealing or legally protected. If a password is compromised, you can change it. Your face is not quite as cooperative. That is one reason biometric privacy laws focus not only on whether information is collected, but on notice, purpose, retention and consent. Illinois law requires private entities covered by BIPA to explain in writing that biometric information is being collected or stored, state the purpose and length of time for the collection, and obtain a written release. It also requires a publicly available retention-and-destruction policy for covered biometric information. Those requirements are procedural, but the problem they are trying to solve is deeply human: people cannot make a meaningful choice about an interaction they do not understand they are having. A button labeled "analyze my skin" describes the benefit. It does not necessarily describe the machinery. That gap between the consumer-facing verb and the system-level verb is becoming one of the defining privacy problems of ordinary technology. We tap "enhance," while a service processes an image. We tap "personalize," while a system builds a profile. We tap "verify," while software compares measurements. The interface tells us what we get. The legal notice tells us what may have happened underneath. This is not an argument that personalization tools are inherently suspect. Consumers often want them, and many people will happily trade some information for a genuinely useful service. The issue is whether the trade is visible enough to be understood as a trade. Consent works poorly when the two sides of an interaction are using different vocabularies. The user thinks in terms of selfies, recommendations and convenience. The system may think in terms of geometry, identifiers, retention schedules and derived data. Both descriptions can refer to the same event, but only one of them usually appears on the friendly screen inviting you to continue. That mismatch is where the Skin360 settlement becomes more than a legal footnote. The case is a reminder that consumer technology has become exceptionally skilled at hiding complexity without necessarily eliminating consequence. We increasingly experience advanced data systems through playful, helpful and low-friction interfaces. The smoother those interfaces become, the easier it is to forget that an ordinary gesture can carry an extraordinary amount of technical meaning. The next generation of privacy literacy may depend less on teaching people to fear technology and more on teaching them to ask a different question: not only "What am I doing on this screen?" but "What is the system doing with what I just gave it?" Because sometimes you are taking a selfie, and sometimes the selfie is only the part you can see. SOURCE NOTES • Court-authorized Skin360 BIPA settlement notice, Sept. 11, 2026 • Plaintiffs’ memorandum supporting preliminary approval of the settlement, U.S. District Court for the District of New Jersey, filed Feb. 17, 2026 • Illinois Biometric Information Privacy Act — definition of biometric identifier • Illinois Biometric Information Privacy Act — retention, collection, disclosure and destruction requirements --- ProbleMattic is written and maintained by Matthew Kulcsar, a software engineer, project manager, technologist, platform builder, emergency-services-trained helper, grandfather, and lifelong collector of broken systems, odd behaviors, and useful nonsense.