Coffee Meets Bagel biometric data collection

The dating app Coffee Meets Bagel scans the selfies users upload during its photo verification step, and its third-party vendor Persona collects scans of their facial geometry from those photos and videos. In 2024, two proposed class actions alleged that the company captured Illinois users' face templates and shared them with third-party service providers without the written notice and written release the Illinois Biometric Information Privacy Act requires. Both suits ended within months of filing without a ruling on the merits: Cajas v. Coffee Meets Bagel was terminated June 17, 2024, and Moller v. Coffee Meets Bagel was terminated July 16, 2024.

Background

Coffee Meets Bagel is an online dating service that ships two Google Play builds under two corporate entities: io.cmbus.app under "Coffee Meets Bagel Inc.," and com.coffeemeetsbagel under "COFFEE MEETS BAGEL PTE. LTD." The app offers a photo and video verification feature that asks a user to upload a selfie so the service can confirm the person's identity. According to the company's privacy policy, this verification data is collected not by Coffee Meets Bagel directly but by an outside vendor. The policy states that the information is collected by "our third party vendor, Persona, an identity verification company." Persona's own processor privacy policy states that Persona "acts as a processor (or similar role under applicable law) on behalf of the customer controller who has contracted with us to provide the age assurance or identity verification services."

Biometric data collection

Coffee Meets Bagel's privacy policy, last updated September 4, 2025, discloses that during identity verification, "Persona may collect, use, and store scans of your facial geometry extracted from photos and videos you upload during the verification process." The company's separate Biometrics Policy defines the "biometric information" at issue as "a scan of your facial geometry extracted from photos and videos you upload during the identity verification process," and sets a retention cap of "2 years from when you provided the biometric information." That policy also states that Coffee Meets Bagel "will not permit Persona to disclose your biometric information to any party other than its vendors" absent consent or legal process. Persona's processor policy separately confirms that it collects "a scan of your facial geometry based on the photos or video you provide."

The company's privacy policy states that Coffee Meets Bagel "does not sell personal information to third parties," but "does permit third parties to collect the personal information described above through our service and shares personal information with third parties for business purposes," and it lists "Service providers and business partners" among the parties with which it shares.

Illinois BIPA class actions

The Illinois Biometric Information Privacy Act defines a "biometric identifier" to include a "scan of hand or face geometry." Under 740 ILCS 14/15(b), no private entity may collect or capture a person's biometric identifier unless it first informs the subject in writing and "receives a written release." Under 740 ILCS 14/15(a), an entity in possession of biometric identifiers must maintain a written, publicly available retention and destruction schedule, and under 740 ILCS 14/15(d) an entity may not disclose or redisclose that data without consent. The statute's private right of action, at 740 ILCS 14/20, provides liquidated damages of $1,000 for a negligent violation and $5,000 for an intentional or reckless violation.

Cajas v. Coffee Meets Bagel

Cajas v. Coffee Meets Bagel, Inc., No. 3:24-cv-00144, was filed January 8, 2024 in the United States District Court for the Northern District of California and assigned to Judge Vince Chhabria. ClassAction.org, reporting on the filing, described the 12-page complaint: when a consumer sets up an account, the app asks them to upload a selfie, and "the app then scans the photograph to create a 'biometric template' of the user's face." The complaint alleged that Coffee Meets Bagel had shared "thousands" of face templates belonging to Illinois residents with "third-party service providers" without authorization. Plaintiff Anthony Cajas filed a notice of voluntary dismissal on June 14, 2024, and the docket was terminated June 17, 2024.

Moller v. Coffee Meets Bagel

Moller v. Coffee Meets Bagel, Inc., No. 1:24-cv-03015, was filed April 15, 2024 in the United States District Court for the Northern District of Illinois and assigned to Judge Jorge L. Alonso. The complaint alleged that the company scans the selfies users upload, "creates a biometric template of the user's face," and compares the face to profile photographs to verify identity. It pleaded three counts under BIPA: 740 ILCS 14/15(a) for the lack of a public retention and destruction schedule, 740 ILCS 14/15(b) for collection without written notice or a written release, and 740 ILCS 14/15(d) for disclosure to third-party service providers without consent. The complaint sought statutory damages of $5,000.00 for each intentional or reckless violation under 740 ILCS 14/20, or $1,000.00 for each negligent violation. Bloomberg Law, reporting the filing, wrote that Coffee Meets Bagel allegedly collected members' biometric information when they uploaded selfies during sign-up and "provided the information to a third-party identity-verification provider, Persona Identities Inc." The docket was terminated July 16, 2024.

Neither suit reached a ruling on the merits of the BIPA allegations. The current privacy policy still describes Persona collecting facial geometry during verification, so the underlying practice continues.

Google Play "Data safety" label

The Google Play "Data safety" section for the com.coffeemeetsbagel build declares "No data shared with third parties" and states that "the developer says this app doesn't share user data with other companies or organizations," while listing "Photos and videos" and "Personal info" among the data types the app collects. The label for the io.cmbus.app build likewise declares "No data shared with third parties." The same company's privacy policy discloses that its vendor Persona collects users' facial geometry during verification.

Google's own developer documentation defines the term "Sharing" as "transferring user data collected from your app to a third party," and states that transfers to a "service provider ... that processes it on behalf of the developer" are among "the following types of data transfers [that] do not need to be disclosed as 'sharing'." Persona describes itself as a processor acting on the customer's behalf, and its processor policy states that "Persona does not sell or share personal data with third parties."

See also

• Coffee Meets Bagel
• Walmart
• Anker
• Lockdown Browser
• Friend app