Recently, Johnson & Johnson (J&J) is facing a proposed biometric privacy class action after a U.S. federal judge rejected its argument that the Neutrogena Skin360 facial-scanning service qualifies for an exemption under Illinois’ Biometric Information Privacy Act (BIPA).
The lawsuit centers on claims that Skin360, which provides personalized at-home skin assessments by analyzing users’ facial scans, violated BIPA by collecting and storing biometric data without proper disclosure. Users must activate their live cameras for a 180-degree facial scan, after which the technology assesses their skin and recommends a Neutrogena skincare regimen. However, no medical professionals are involved in the process.
Illinois plaintiffs Helene Melzer, Christine Borovoy, Andy Sajnani, and Patricia Biewald, who used the app between 2020 and 2022, allege that J&J failed to inform them that their biometric data—including facial geometries linked to personally identifiable information—was being captured, stored, or used. They argue that the company did not obtain their consent or provide the required disclosures under BIPA.
J&J sought to dismiss the case, contending that the Skin360 service qualifies for BIPA’s healthcare exemption. However, New Jersey federal judge Michael A. Shipp ruled on March 7, 2025, that this classification was “a reach,” emphasizing that the technology merely provides AI-driven assessments rather than medical care. The court noted that Skin360 relies on artificial intelligence to compare users’ skin conditions against a database of images, offering a virtual skin health coach for guidance.
Neutrogena, now part of Kenvue following J&J’s 2023 spin-off, continues to face scrutiny over the privacy implications of its Skin360 service as the lawsuit progresses.
