Recently, Johnson & Johnson’s former consumer health unit has reached a settlement in a high-profile lawsuit over its Neutrogena Skin360 app, bringing an end to a closely watched battle over biometric privacy. The agreement, approved by U.S. District Judge Michael Shipp in New Jersey, requires the case to be closed within 60 days, though the financial and structural terms remain confidential.
The class action, filed in May 2022 by plaintiff Helene Melzer, accused Johnson & Johnson Consumer Inc. (now spun off as Kenvue Inc.) of unlawfully collecting and storing facial scans through the Skin360 app. The app used artificial intelligence to analyze facial images, generate personalized skincare assessments, and recommend Neutrogena products. Plaintiffs alleged that the company linked these scans to sensitive personal details such as names and birth dates without securing informed consent, in violation of Illinois’ Biometric Information Privacy Act (BIPA)—one of the strictest data privacy laws in the U.S.
After nearly two years of litigation, the case gained momentum when Judge Shipp rejected J&J’s argument that Skin360 was exempt from BIPA as a healthcare application, noting that users were not patients and the app operated without medical oversight. That ruling set the stage for a trial that could have exposed the company to steep penalties, with BIPA violations carrying fines of up to $5,000 per instance.
The resolution highlights the legal risks surrounding biometric technologies and signals that consumer-facing health and beauty apps remain under scrutiny. With the Skin360 case closed, companies collecting biometric data face a clear reminder: in the U.S., especially under Illinois law, privacy protections carry real weight.
