It's been a decade since the state of Illinois enacted legislation to protect consumers' biometric data—their fingerprints, retina patterns and facial geometry. But a long series of legal battles that could define the scope and impact of the law is just beginning to come to a head.

The potentially broad reach of the 2008 Biometric Information Privacy Act (BIPA) was highlighted last week, when the Chicago Tribune and other outlets got wind that Google had disabled its popular “art selfie” feature in the state, as well as in Texas, which has a similar law on the books. Some lawyers viewed the move as overly cautious, while others saw it as a veiled message to other statehouses, warning them against stringent regulation. (A Google spokesman declined to comment in response to those suggestions.)

Either way, though, a number courts are on the cusp of interpreting just how big of a stick the law can be for the private plaintiffs' bar. Facebook, which was sued over its ”suggested tag” feature in 2015, has a motion pending in federal court in San Francisco arguing that plaintiffs don't have standing to sue under BIPA unless they can show real-world harm.

The social media giant is represented by lawyers at Mayer Brown, the same firm that carried Spokeo to a kinda-sorta win on the issue of “concrete” harm in a 2016 decision by the U.S. Supreme Court. (On remand, the U.S. Court of Appeals for the Ninth Circuit ruled against Spokeo over its publishing of private information. The high court denied a petition for an encore this week.) Facebook is also arguing that the Illinois law should only apply to data processing done in Illinois. There hasn't been a ruling on either of those motions yet.

Over the past year, a flurry of lawsuits have been filed under BIPA in Illinois. Lawyers at Baker McKenzie noted in an article published last fall that most of the cases have been brought against employers who switched to facial and fingerprint scan technology in place of older time-logging methods. That practice opened the door to the plaintiffs bar bringing complaints alleging that workers' data was taken without consent, a violation of the statute.

Many of those cases have settled, said Daniel Birk, a partner at Eimer Stahl in Chicago who advises companies on data privacy. But what is still coming down the pike are significant decisions interpreting the scope of the law. “I think the low-hanging fruit will be picked pretty soon. Those [employment cases] eventually will go away, and litigation will go toward more uncertain theories like the Facebook case,” Birk said.

➤➤ Are you fascinated by the intersection of law and technology? Want to keep up with how new tech is challenging courts and policymakers? Read What's Next by Ben Hancock, a weekly email briefing that examines how emerging technologies are revolutionizing the law.

With the art selfie app, Google has said it doesn't “use your selfie for anything else and only keeps it for the time it takes to search for matches,” suggesting the feature may not be subject to BIPA anyway. But the company has a reason to want to play it safe. Both it and Facebook have lost attempts to get out of lawsuits brought under BIPA on the grounds that the law only applies to in-person biometric analysis, not analyzing photos.

There are reasons, though, to think that things might go better for them on the issue of standing. An intermediate Illinois appellate court handed a win to defendants in December in a case called Rosenbach v. Six Flags Entertainment, ruling that language in the statute means a plaintiff must allege “actual harm.” It's not clear yet whether that will be taken up by the state high court. Plaintiffs last week asked for an extension to seek review.

If the decision stands and is endorsed by other courts, it could turn the tide for defendants, said Patrick Castle, an associate with Shook, Hardy & Bacon in Chicago who focuses on biometric privacy litigation. “Many plaintiffs will have a difficult time meeting that standard because most people who are suing under this haven't been injured in any meaningful way,” Castle argued.

Conversely, if plaintiffs start to get the upper hand on standing grounds, then the battle will likely next shift to assessing just how high BIPA's statutory penalties can go. The law imposes $1,000 for each negligent violation, and $5,000 for each willful violation. What counts as a violation is an issue still to be litigated, and has potentially major consequences. “Nobody wants to be on the wrong end of an 'each-violation' ruling,” Castle said.

Meanwhile, while other states around the country have considered biometric data privacy legislation — including Connecticut, Alaska and New Hampshire — there don't appear to be signs that they're on track to replicate the Illinois law. The two other states that have biometric legislation already on the books, Texas and Washington, have different models; neither contains a private right of action such as the Illinois statute.

“I think there has been a very coordinated national campaign to try and stop these laws from getting passed,” said Christopher Dore, a plaintiffs attorney at Edelson PC in Chicago, which was among the first firms to file suits under BIPA. “The litigation I think really only highlights the issue that there are companies out there collecting this information at an exponential rate.”