Freifeld v. Sonder biometric privacy lawsuit

An Illinois man sued short-term rental manager Sonder & its contractor Persona on June 28, 2024, alleging Persona captured his face geometry from a driver's license photo without consent. The complaint says he was asked for a license image after booking a Sonder-managed rental, & that Persona compared the geometry to him at check-in. It claims both companies violated 740 ILCS 14/15(b), part of Illinois's Biometric Information Privacy Act (BIPA). The suit seeks statutory damages of $5,000 per person for each willful or reckless violation, or $1,000 for each negligent one. A February 11, 2025 second amended complaint names only Persona & alleges, on information and belief, it passed his biometrics to at least one third-party subprocessor. The court ruled on Persona's motion to dismiss on March 11, 2026, in an order Persona later called an order denying that motion.

Freifeld's stay at The Hillsboro

David Freifeld, a resident of Vernon Hills, Illinois, signed up in late May 2024 for a rental unit at The Hillsboro through Expedia, for June 3 through June 7, 2024. The complaint says he did not use or visit the Sonder website, & identifies The Hillsboro, in Hillsboro Beach, Florida, as one of the rentals Sonder managed. His original complaint alleges:

After booking, Plaintiff was asked to provide an image of a driver's license. Sonder's contractor Persona captured and stored the face geometry from the photo on the license, comparing it to Plaintiff when he checked in.

Freifeld says he was given no disclosure about what was done with the biometric information, how or where it was stored, or how long it would be retained, & that he did not consent to its use.

The second amended complaint, brought against Persona alone, alleges:

On information and belief, Defendant then transmitted, disclosed, or otherwise disseminated Plaintiff's biometrics to at least one of its third party subprocessors.

According to the complaint, Persona's privacy policy listed every potential third-party subprocessor that may receive any type of data without providing any specific information about where, or to whom, biometrics were transmitted.

Background

Sonder Holdings Inc. & certain of its subsidiaries filed Chapter 7 petitions in the U.S. Bankruptcy Court for the District of Delaware on November 14, 2025.

Freifeld's June 2024 complaint said Sonder managed short-term rentals, such as apartment hotels, in North America, Europe, & Dubai, with over 9,000 units in over 40 cities. The complaint said Sonder had at least eight properties in Chicago & that Persona furnished biometric identification & information storage services to Sonder by contract.

Sonder's Form 10-K annual report described its identity verification process in the report's risk factors:

Specifically, the third parties that provide the identity verification process for us may use facial geometry data to verify that a guest's selfie picture matches the photograph on the government-issued identification provided by the guest, similar to a front desk worker at a traditional hotel visually comparing a guest's government identification to the guest's face.

The same filing said BIPA has generated significant class action activity & warned that the cost of litigating & settling any claims that Sonder had violated BIPA or similar laws could be significant.

Lawsuit

Claims

Freifeld filed the complaint as a class action with a jury demand in the U.S. District Court for the Northern District of Illinois, case No. 1:24-cv-05459, & it was assigned to Judge Jorge L. Alonso. His lawyers, at Edelman, Combs, Latturner & Goodwin, LLC, pleaded a single count:

Defendants Sonder and Persona violated 740 ILCS 14/15(b) by failing to obtain informed written consent and releases before obtaining biometric identifiers and information from Plaintiff and the class members.

The proposed class covered individuals with Illinois addresses, or who rented at a Sonder location in Illinois, according to the defendants' records, whose biometric information Persona captured or used as Sonder's contractor on or after a date five years before the suit was filed. Besides statutory damages, the complaint asked for attorneys' fees & costs under 740 ILCS 14/20(3).

The first amended complaint, filed December 4, 2024, alleges that Freifeld was asked to provide the image of his driver's license to Persona.

Freifeld filed the second amended complaint on February 11, 2025. It pleads two counts, one under 740 ILCS 14/15(b) & one under 740 ILCS 14/15(d). Count II alleges that Persona disseminated his biometrics without obtaining his informed, written consent regarding dissemination to, or proper identification of, any third parties who were to receive them, including Persona's third party vendors or data processors. The amended class is defined as:

All Illinois residents whose biometric identifiers or biometric information were collected, captured, stored, used, disclosed or otherwise disseminated by Defendant within the state of Illinois any time within the applicable limitations period.

The second amended complaint asks for injunctive relief requiring Persona to comply with BIPA, statutory damages of $5,000 for each willful or reckless violation & $1,000 for each negligent violation, & attorneys' fees.

Persona's financial-institution exemption argument

On March 27, 2026, Persona moved under 28 U.S.C. § 1292(b) to amend the March 11, 2026 order, which the motion calls the Order Denying Persona's Motion to Dismiss, & to certify that order for interlocutory appeal, asking the court to add language stating that the order involves a controlling question of law as to which there is substantial ground for difference of opinion & that an immediate appeal may materially advance the ultimate termination of the litigation. Persona's motion, signed by Joel C. Griswold of Baker & Hostetler LLP, framed the controlling question of law as:

Whether a company whose business is authenticating the identity of customers conducting financial and nonfinancial transactions qualifies as a financial institution or an affiliate of a financial institution that is subject to Title V of the federal Gramm-Leach-Bliley Act of 1999 and the rules promulgated thereunder ("GLBA"), and is therefore exempt from the Illinois Biometric Information Privacy Act ("BIPA"), 740 ILCS 14/1 et seq.

The motion cites 740 ILCS 14/25(c), which it quotes as stating:

Nothing in this Act shall be deemed to apply in any manner to a financial institution or an affiliate of a financial institution that is subject to Title V of the federal Gramm-Leach-Bliley Act of 1999 and the rules promulgated thereunder.

Persona also asked the court to stay the proceedings pending either a Seventh Circuit decision in Cisneros v. Nuance Communications, Inc., No. 24-2982, or the interlocutory appeal of Freifeld's case, whichever is the first proceeding to resolve the question on which Persona sought interlocutory appeal. In a footnote, Persona wrote that the Seventh Circuit had ordered supplemental briefing in Cisneros on injury in fact & could uphold the dismissal of the Cisneros complaint on jurisdictional grounds without reaching the issue of the applicability of the GLBA exemption under BIPA.

Cisneros v. Nuance Communications decision

Cisneros v. Nuance Communications is a BIPA suit by Norma Cisneros, a customer of Charles Schwab, which lets customers authenticate telephone requests with voice-ID technology that Nuance Communications provides under contract. The Northern District of Illinois granted judgment on the pleadings to Nuance, & Cisneros appealed. A Seventh Circuit panel of Judges Easterbrook, Scudder, & Kolar affirmed on August 28, 2026, in an opinion by Judge Easterbrook.

The opinion says Nuance was the only defendant because Schwab is subject to federal regulation as a financial institution & therefore is exempt from BIPA. The court wrote that the Federal Reserve had determined by regulation, 12 C.F.R. § 225.86(a)(2)(iii), that authenticating the identity of persons conducting financial and nonfinancial transactions is an activity so closely related to banking as to be a proper incident thereto. It concluded:

It follows that Nuance is exempt under §25(c) to the extent that it authenticates the identity of Schwab's customers in financial transactions.

The opinion noted that the Third Circuit had affirmed the Delaware district court decision the Cisneros trial judge relied on, in McGoveran v. Amazon Web Services, Inc., 175 F.4th 434 (3d Cir. 2026), & that ruling for Cisneros would require the Seventh Circuit to create a conflict among the circuits on a question of Illinois law.

Chamber of Commerce citation of the complaint

The Chamber of Commerce of the United States & the Illinois Chamber of Commerce cited Freifeld's original complaint in a proposed amicus brief attached to their September 2, 2025 motion for leave to file it in the Seventh Circuit, in Clay v. Union Pacific Railroad Co., No. 25-2185. The brief lists it among examples of businesses facing BIPA litigation:

A start-up company helping other businesses implement secure identity or age verification platforms to combat online fraud also faces BIPA liability.

See also

• Age verification
• Coffee Meets Bagel biometric data collection
• Lockdown Browser