Jump To

Top Caption [Combined Opinion

                    by Scudder](https://www.courtlistener.com/opinion/10805022/tanya-svoboda-v-amazoncom-inc/about:blank#o1)

Support FLP

CourtListener is a project of Free
Law Project, a federally-recognized 501(c)(3) non-profit. Members help support our work and get special access to features.

Please become a member today.

Join Free.law Now

March 6, 2026 Get Citation Alerts Download PDF Add Note

Tanya Svoboda v. Amazon.com Inc.

Court of Appeals for the Seventh Circuit

• Citations: None known
• Docket Number: 25-1361

• Judges: Scudder

• Opinion

• Authorities (29)

• Cited By (0)

• Summaries (0)

• Similar Cases (2.1K)

• PDF

Combined Opinion

                        by [Michael Yale Scudder Jr.](https://www.courtlistener.com/person/8633/michael-yale-scudder-jr/)

In the

United States Court of Appeals
For the Seventh Circuit

---

No. 25-1361
TANYA N. SVOBODA and ANTONELLA M. ORTIZ COLOSI,
Plaintiffs-Appellees,
v.

AMAZON.COM INC. and AMAZON.COM SERVICES, LLC,
Defendants-Appellants.

---

Appeal from the United States District Court for
the Northern District of Illinois, Eastern Division.
No. 1:21-cv-05336 — Jorge L. Alonso, Judge.

---

ARGUED SEPTEMBER 9, 2025 — DECIDED DECEMBER 17, 2025

AMENDED MARCH 6, 2026

---

Before ROVNER, HAMILTON, and SCUDDER, Circuit Judges.
SCUDDER, Circuit Judge. Tanya Svoboda and Antonella
Ortiz Colosi used a Virtual Try-On feature through Amazon’s
mobile site and app to virtually test facial products like lip-
stick and eyewear. They later brought this class action against
Amazon alleging that the VTO feature violates the Illinois Bi-
ometric Information Privacy Act through its capture and use
2 No. 25-1361

of their facial data. The district court certified a class of Ama-
zon VTO users within Illinois. Seeing no abuse of discretion,
we affirm.
I
A
Amazon’s mobile website and application offer the VTO
feature to customers to virtually “try on” makeup and eye-
wear products. The VTO software operates to render facial
products over an image or video of a user’s face so they can
see what a product will look like before making a purchase
decision.
Amazon used two VTO programs during the relevant pe-
riod—one developed in-house and another developed by a
company named ModiFace. Both programs function simi-
larly. An Amazon customer shopping on a mobile device can
preview a product by clicking a “try on” button on the prod-
uct page. On the first VTO use, the application prompts the
user to give Amazon permission to access the camera on their
device. Once users grant access, they can opt to preview the
product on a live video or actual photo of their face. They can
also preview a product in “model mode,” which displays the
product on a model’s face rather than the user’s. If users elect
to preview on their own image, the VTO feature activates the
camera on their device to capture their facial geometry from
the live video or photo and then analyzes it to determine
where to overlay the product. The VTO application sends in-
formation about the product to the device, which then renders
the product on the user’s image in the appropriate area.
Svoboda and Colosi’s claims under the Illinois Biometric
Information Privacy Act arise out of their use of Amazon’s
No. 25-1361 3

VTO feature. Biometric identifiers such as facial data and fin-
gerprints are unique to each person and unalterable. If com-
promised, the privacy harm cannot be mitigated by changing
them. The Illinois General Assembly enacted BIPA to
strengthen biometric data security. See 740 ILCS 14/5; see also
Fox v. Dakkota Integrated Sys., LLC, 980 F.3d 1146, 1149–50 (7th
Cir. 2020) (explaining BIPA’s history and purposes). To this
end, the enactment regulates the “collection, use, safeguard-
ing, handling, storage, retention, and destruction of biometric
identifiers and information.” 740 ILCS 14/5(g).
Two provisions of BIPA are relevant here. Section 15(a) re-
quires private entities in possession of biometric data to de-
velop, publish, and comply with a written policy that estab-
lishes a data retention schedule and guidelines for destroying
biometric identifiers and information. See 740 ILCS 14/15(a).
Section 15(b), in turn, prohibits private entities from “col-
lect[ing], captur[ing], purchas[ing], receiv[ing] through trade,
or otherwise obtain[ing]” a person’s biometric data unless
they first: (1) provide written notice that biometric data will
be collected or stored, (2) inform the person of the length and
reason for which the biometric data will be collected, stored,
and used, and (3) receive a written release signed by the per-
son. 740 ILCS 14/15(b).
The parties agree that BIPA is not extraterritorial—any
statutory violation must occur in Illinois to warrant relief. Il-
linois Supreme Court precedent gives us no reason to ques-
tion that proposition. See Avery v. State Farm Mut. Auto. Ins.
Co., 835 N.E.2d 801, 852 (Ill. 2005) (observing that under Illi-
nois law, a “statute is without extraterritorial effect unless a
clear intent … appears from the express provisions of the
4 No. 25-1361

statute.” (quoting Dur-Ite Co. v. Indus. Comm’n, 68 N.E.2d 717,
722 (Ill. 1946))).
BIPA provides for statutory damages. “A prevailing party
may recover” $1,000 for each negligent violation and $5,000
for each intentional or reckless violation. 740 ILCS
14/20(a)(1)–(2). A separate statutory violation generally ac-
crues with “every scan” of biometric data. Cothron v. White
Castle Sys., Inc., 216 N.E.3d 918, 929 (Ill. 2023), as modified on
denial of reh’g (July 18, 2023). The statute also entitles success-
ful plaintiffs to recover reasonable attorneys’ fees and costs.
See 740 ILCS 14/20(a)(3).
The Illinois General Assembly amended BIPA in 2024 to
cap statutory damages in certain circumstances. See Act of
Aug. 2, 2024, Pub. Act 103-0769, 2024 Ill. Laws 6757, 6759–60.
Section 20(b) now specifies that an entity that collects the
same biometric data from the same person using the same
method of collection in violation of Section 15(b) only com-
mits a single violation. See 740 ILCS 14/20(b). Whether this
amendment ultimately may cap the damages that some class
members can recover is not a question before us, as the an-
swer does not affect our review of the district court’s class cer-
tification decision.
Tanya Svoboda alleges that she used Amazon’s VTO in Il-
linois while shopping for lipstick on its mobile website in
2020. In September 2021, she filed a putative class action
against Amazon in Illinois state court. Amazon removed the
case to federal court under the Class Action Fairness Act. See
28 U.S.C. §§ 1332 (d), 1453(b). Antonella Ortiz Colosi joined
the action in an amended complaint in May 2022, alleging that
she too used Amazon’s VTO for makeup products while in
No. 25-1361 5

Illinois. Colosi testified that she used the VTO in 2019, 2020,
2021, and 2022.
Together, Svoboda and Colosi allege that Amazon’s use of
the VTO feature violated Sections 15(a) and (b) of BIPA. More
specifically, Amazon allegedly collected, captured, stored,
and used their own facial geometry and associated personal
identifying information and that of “thousands if not mil-
lions” of people who used the VTO feature in Illinois without
providing notice and the required information, obtaining in-
formed written consent, or creating written publicly available
data retention and destruction guidelines. They seek statu-
tory damages, injunctive relief, and fees and costs.
B
Svoboda and Colosi moved for class certification under
Federal Rule of Civil Procedure 23(b)(3). The district court
granted the motion and certified a class of “all individuals
who used a [VTO] feature on Amazon’s mobile website or
app while in Illinois on or after September 7, 2016.”
The district court determined that the proposed class sat-
isfied Rule 23(a)’s threshold requirements for certification.
Only commonality is relevant to this appeal and, even then,
only insofar as it relates to predominance under Rule 23(b)(3).
The district court found that the same alleged course of con-
duct unites the alleged BIPA violations: Amazon’s unlawful
use of the VTO application. The court identified questions
common to the class that, if answered, would resolve issues
central to each claim “in one stroke.” Those questions gener-
ally concern the functionality of the VTO software, Amazon’s
use of the class members’ biometric data, and legal questions
6 No. 25-1361

about whether that use violated Sections 15(a) and 15(b) of
BIPA.
The district court also found that the class satisfied the pre-
dominance and superiority requirements of Rule 23(b)(3). Af-
ter identifying common questions, it acknowledged that indi-
vidual inquiries might be needed to assess whether potential
class members used the VTO in Illinois. But it determined that
this issue was manageable enough to justify certification
without violating Amazon’s due process right to challenge
particular class members’ showing of a statutory violation or
entitlement to a particular damages award. Nor did Ama-
zon’s proposed affirmative defenses defeat predominance be-
cause they either did not apply to BIPA claims or reflected
common issues.
The district court further determined that a class action
was superior to individual litigation because individuals
would be unlikely to sue on their own and common issues
made class resolution efficient. The prospect of high aggre-
gate or individual damages under BIPA did not alter this con-
clusion because the district court observed that it retains eq-
uitable discretion to reduce unconstitutionally excessive dam-
ages.
Amazon timely filed an interlocutory appeal challenging
the district court’s class certification ruling. See 28 U.S.C.
§ 1292 (e); Fed. R. Civ. P. 23(f).
II
Rule 23(a) imposes four requirements for class certifica-
tion: numerosity, commonality, typicality, and adequacy of
representation. See Fed. R. Civ. P. 23(a)(1)–(4). Once a class
satisfies Rule 23(a), it must also fit into one of three types of
No. 25-1361 7

class actions enumerated in Rule 23(b). The plaintiff bears the
burden of showing that the proposed class satisfies Rule 23 by
a preponderance of the evidence. See Eddlemon v. Bradley
Univ., 65 F.4th 335, 338 (7th Cir. 2023). If the class meets all
requirements, the district court must certify it. See id.
Svoboda and Colosi sought class certification under Rule
23(b)(3), which requires that “questions of law or fact com-
mon to class members predominate” over individual ques-
tions and that “a class action is superior to other available
methods for fairly and efficiently adjudicating the contro-
versy.” Fed. R. Civ. P. 23(b)(3).
Rule 23(b)(3)’s predominance requirement “builds on
commonality.” Eddlemon, 65 F.4th at 338 (quoting Howard v.
Cook County Sheriff's Off., 989 F.3d 587, 607 (7th Cir. 2021)); see
also Amchem Prods., Inc. v. Windsor, 521 U.S. 591, 623–24 (1997)
(“[T]he predominance criterion is far more demanding [than
commonality].”). While commonality requires that common
questions exist, predominance requires that they also pre-
dominate. See Eddlemon, 65 F.4th at 338. Predominance tests
whether the class is “sufficiently cohesive” to justify class ad-
judication. Tyson Foods, Inc. v. Bouaphakeo, 577 U.S. 442, 453
(2016) (quoting Amchem, 521 U.S. at 623). Central to this in-
quiry is whether the claims “arise from a common nucleus of
operative facts and issues.” Scott v. Dart, 99 F.4th 1076, 1092
(7th Cir. 2024) (quoting Beaton v. SpeedyPC Software, 907 F.3d
1018, 1029 (7th Cir. 2018)).
The Supreme Court has emphasized the rigor required in
a proper predominance analysis. See Comcast Corp. v. Behrend,
569 U.S. 27, 33–34 (2013) (observing that class certification re-
quires “rigorous analysis” and that “Rule 23(b)(3)’s predomi-
nance criterion is even more demanding than Rule 23(a)”); see
8 No. 25-1361

also Schroeder v. Progressive Paloverde Ins. Co., 146 F.4th 567,
573 (7th Cir. 2025) (emphasizing the same point); Eddlemon, 65
F.4th at 338 (same). Predominance does not entail a mechani-
cal tallying of common questions against individual ques-
tions. Instead, a district court must identify the elements of
each claim, the proof necessary for each, the manageability of
those issues at trial, and alternative procedural tools. See
Schroeder, 146 F.4th at 574; Simer v. Rios, 661 F.2d 655, 672–75
(7th Cir. 1981). From there the court must scrutinize the rela-
tionship between common and individual questions and as-
sess their relative importance. See Tyson Foods, 577 U.S. at 453.
Rule 23(b)(3) separately requires a showing of superiority.
The plaintiff must demonstrate that a class action is “the most
practical and efficient way to resolve the litigation.” Jacks v.
DirectSat USA, LLC, 118 F.4th 888, 898 (7th Cir. 2024). The su-
periority inquiry is comparative: instead of considering the
cost of a class action “in a vacuum,” a court must consider its
costs and benefits in light of other available methods. Mullins
v. Direct Digital, LLC, 795 F.3d 654, 663–64 (7th Cir. 2015).
To be sure, predominance and superiority analyses often
overlap. Indeed, Rule 23(b)(3) provides a non-exhaustive list
of considerations relevant to both:
(A) the class members’ interests in individually
controlling the prosecution or defense of sepa-
rate actions;
(B) the extent and nature of any litigation con-
cerning the controversy already begun by or
against class members;
No. 25-1361 9

(C) the desirability or undesirability of concen-
trating the litigation of the claims in the partic-
ular forum; and
(D) the likely difficulties in managing a class ac-
tion.
Fed. R. Civ. P. 23(b)(3)(A)–(D); see Amchem, 521 U.S. at 615
(stating that the list of factors in Rule 23(b)(3) is non-exhaus-
tive).
III
Our review of a district court’s class certification decision
is deferential. We give the district court considerable leeway
to exercise its discretion unless it commits legal error or
makes clearly erroneous factual findings. See Jacks, 118 F.4th
at 894–95.
Amazon limits its challenge to the district court’s determi-
nation on predominance and superiority under Rule 23(b)(3).
We take each in turn and, in the end, see no abuse of discre-
tion by the district court.
We begin with predominance. The district court con-
cluded that six common questions about Amazon’s liability
predominate over three individual questions: the locational
element of a BIPA claim, affirmative defenses, and damages.
A
Recall that the parties start from a common point of legal
agreement: class members must show that they were in Illi-
nois when they used Amazon’s VTO to establish a statutory
violation of BIPA. The district court primarily analyzed this
location requirement as an issue of class identification and
manageability. This approach was incomplete. Location is
10 No. 25-1361

relevant beyond just identifying class members. For the pur-
poses of this appeal, we assume it is also a requirement of a
BIPA claim. As a result, the district court needed to go a step
further and assess whether proof of location generates an in-
dividualized question of fact that predominates over common
questions. See Eddlemon, 65 F.4th at 339–40 (holding that the
district court abused its discretion in finding that common is-
sues predominated where it failed to identify and separately
analyze the elements of the claims and conducted only a scant
analysis); Santiago v. City of Chicago, 19 F.4th 1010, 1016–17
(7th Cir. 2021) (holding the same where the district court
failed to identify the claims or discuss their elements and
other clarity issues in the record complicated appellate re-
view).
But this shortcoming was not fatal because the substance
of the district court’s reasoning touched sufficiently on all
components required for a proper predominance analysis.
Remand is therefore unnecessary, as it is clear from our own
review that common questions predominate. See United States
v. Nonahal, 338 F.3d 668, 671 (7th Cir. 2003) (“[R]emand is un-
necessary because the district court’s reasons … are appar-
ent.”).
Location Presents an Individual Question
Sections 15(a) and (b) of BIPA both require proof that Am-
azon collected, captured, obtained, or possessed biometric
data. As the district court recognized, this requirement, in
turn, raises two common questions that may require expert
discovery on the VTO software: (1) whether the facial data
used by the operation of the VTO application constitutes bio-
metric identifiers or information within the meaning of BIPA
and (2) whether the use of the VTO means Amazon collected,
No. 25-1361 11

captured, obtained, or possessed it. If the answer to both ques-
tions is yes, Amazon violated Section 15(a) if it failed to de-
velop and publish a policy for data retention and destruction,
with the latter inquiry itself presenting a common question.
Amazon separately violated Section 15(b) if it failed to dis-
close information required by Sections 15(b)(1) and (b)(2) or
failed to obtain signed written releases from VTO users per
Section 15(b)(3). Those statutory requirements likewise pre-
sent common questions.
Location—the geographic place from which a class mem-
ber used the VTO—is the countervailing individual question.
That observation follows from the evidence that would be
used to prove location at trial. See Tyson Foods, 577 U.S. at
453 (“An individual question is one where ‘members of a pro-
posed class will need to present evidence that varies from
member to member….’” (quoting 2 W. Rubenstein, Newberg
on Class Actions § 4:50 (5th ed. 2012))).
Svoboda and Colosi proposed proving location with three
sources of information: VTO user billing addresses, IP ad-
dresses and geolocation data, and personal affidavits from
class members in which they attest to using the VTO applica-
tion within Illinois. The record developed in the district court
shows that Amazon maintains VTO usage data with accom-
panying billing address information associated with the
user’s account and, in certain circumstances, corresponding
IP address and geolocation data. If a user is signed into an
Amazon account or, in the case of the ModiFace VTO, the user
adds the tested product to their virtual shopping cart, Ama-
zon records the IP address associated with the VTO use.
A cybersecurity expert testifying for Amazon in the dis-
trict court explained how IP addresses reveal (or can be
12 No. 25-1361

analyzed to yield) geolocation information associated with
VTO usage. IP addresses, the expert explained, contain indi-
cators that roughly correlate with the location of the associ-
ated device. It also appears that Amazon contracts with a
third-party provider to generate geolocation information,
which includes an approximation of the state corresponding
to the IP address and to the VTO usage data. It is not clear
from the record at what level of completeness Amazon cap-
tures IP addresses. That fact matters because it bears on how
closely the captured IP address information correlates with
the location of the device using the VTO application. Based on
our review of the record, what stands out is the testimony of-
fered by an Amazon witness during a deposition. The witness
stated that Amazon captures and maintains VTO usage rec-
ords with full IP address information. This leads us to believe
that, at least in some circumstances, reasonable findings about
location information will follow.
What all of this means as a practical matter is that common
proof of location including billing address and geolocation in-
formation will be available for some claimants. But, as the dis-
trict court acknowledged, individualized inquiries will be
necessary for others. For example, where billing address and
geolocation data point to different states, or are unavailable
for an alleged VTO use, individual affidavits or other proof
will be necessary to show that the claimant used the VTO in
Illinois.
Location Does Not Predominate Over Common Questions
The district court did not abuse its discretion in finding
that individualized questions connected to proof of location
will not predominate over common questions related to BIPA
liability. But, if we accept that BIPA requires proof of location,
No. 25-1361 13

not all elements of liability must be resolved on a classwide
basis to satisfy Rule 23. Supreme Court precedent is clear on
this point. See Amgen Inc. v. Conn. Ret. Plans & Tr. Funds, 568
U.S. 455, 469 (2013) (“Rule 23(b)(3) … does not require a plain-
tiff seeking class certification to prove that each element of her
claim is susceptible to classwide proof.” (cleaned up)). We
have emphasized the same on many prior occasions. See, e.g.,
Beaton, 907 F.3d at 1029–30 (“[Defendant] misreads Supreme
Court precedent in arguing that liability with regard to all
class members must be resolved in a single stroke.” (citing
Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338, 350 (2011))); Bell v.
PNC Bank, Nat’l Ass’n, 800 F.3d 360, 380–81 (7th Cir. 2015) (ob-
serving that Rule 23 does not require a class action to resolve
all liability issues and discussing cases); Suchanek v. Sturm
Foods, Inc., 764 F.3d 750, 759 (7th Cir. 2014) (holding that it was
an “error of law” to conclude that the individual question of
causation, “as required to establish liability” in a consumer
action, predominated).
To the contrary, it is not uncommon for class actions to
have a “final phase” for class members to submit individual-
ized proof of a claim. Suchanek, 764 F.3d at 756. After proving
a defendant’s actions relevant to liability, each claimant must
show that those actions harmed them. See id. at 757. A phase
requiring individual presentations of proof on all (or part of)
an element of a claim does not defeat predominance. Stated
another way, an individual question does not predominate
where common questions of law and fact relevant to liability
otherwise generate significant efficiencies and the individual
question is manageable. See Dukes, 564 U.S. at 350 (“What
matters to class certification … [is] the capacity of a class-wide
proceeding to generate common answers apt to drive the res-
olution of the litigation.” (cleaned up)); see, e.g., Scott, 99 F.4th
14 No. 25-1361

at 1092–93 (holding in a class action alleging inadequate den-
tal care that common questions predominated even though
individualized trials would be needed to prove causation and
seek damages and not every class member will have suffered
a denial of adequate care); Bell, 800 F.3d at 378–80 (holding the
same in a class action alleging failure to pay overtime wages
where each class member would need to individually prove
they worked overtime and were entitled to relief) (discussing
cases); Pella Corp. v. Saltzman, 606 F.3d 391, 394 (7th Cir. 2010)
(holding the same in a product liability class action where
each class member would need to individually prove causa-
tion and damages).
The district court did not abuse its discretion in conclud-
ing that the same reasoning applies here. One alleged course
of conduct sufficiently unites the class’s claims—Amazon’s
unlawful use of the VTO feature. And the entire class will
“prevail or fail in unison” on common questions related to
that conduct. Amgen, 568 U.S. at 460. Some common questions
require expert discovery to analyze the VTO software. None
will benefit from repeated adjudication. And the potential
class is estimated to be over 100,000 people. These factors
point to class resolution as an efficient method of adjudica-
tion. See Suchanek, 764 F.3d at 760; Scott, 99 F.4th at 1092–93.
If the common questions are all answered in favor of the class,
it will have established a statutory injury. Even if location is
necessary for individual recovery under BIPA, it is more char-
acteristic of the individual questions permitted and often iso-
lated in class actions than a core liability question based on
Amazon’s alleged statutory violations.
The district court’s manageability analysis, though only
part of predominance, is also relevant. See Rule 23(b)(3)(D);
No. 25-1361 15

Simer, 661 F.2d at 677 (“[A]ny discussion of predominance
must incorporate the concept of manageability because the is-
sues for individual adjudication may be adequately managed
with certain procedural devices.”). Our view on manageabil-
ity parallels much of our reasoning on how we see class mem-
bers proving the locational element. In short, the district court
did not abuse its discretion in finding that the combination of
billing addresses, IP and geolocation data, and affidavits
make the locational element manageable.
No proxy alone may suffice or be perfect to prove location.
Billing addresses may be out of date. Geolocation data has a
margin of error, especially for cellular data, according to Am-
azon’s cybersecurity expert. But the same expert reported that
even the company’s vendor’s lowest estimate of geolocation
accuracy correctly resolves a cellular IP address to a city 54%
of the time within a 100-kilometer radius. On this record, we
cannot say the district court abused its discretion in finding
that this data, combined with billing addresses and affidavits,
can prove a claimant was more likely than not in Illinois when
they used the VTO. See Beaton, 907 F.3d at 1030 (observing
that affidavits and auditing procedures can be used to handle
individualized inquiries).
Amazon’s challenge to predominance fares no better as a
due process argument. The company will still have the oppor-
tunity to challenge class members’ individual proof of loca-
tion. It can choose to challenge the reliability of the location
data on the merits, contest the credibility of subgroups—such
as class members for whom there is no geolocation data—or
present evidence challenging particular affidavits. See id. (ex-
plaining that a defendant’s due process rights are not harmed
by case management tools for individual inquiries); Mullins,
16 No. 25-1361

795 F.3d at 669 (determining that due process does not require
a “cost-effective procedure for challenging every individual
claim”). But at this stage, individual questions about location
neither predominate nor threaten the fundamental fairness
due to Amazon. See Mullins, 795 F.3d at 669 (“[A] defendant
has a due process right … to present individualized defenses
if those defenses affect its liability.” (citing Dukes, 564 U.S. at
365–67)).
B
Amazon’s affirmative defenses also convince us that the
district court did not commit any error at class certification.
The company raised, and the district court rejected, four com-
mon law defenses as challenges to predominance—consent,
failure to mitigate, estoppel, and waiver. As we understand
it, Amazon’s position is that these defenses require individu-
alized inquiries to determine if they apply to each class mem-
ber. For example, a class member who fully understood the
VTO software but chose to use it anyway, so the company’s
argument goes, should not be able to recover for BIPA viola-
tions under a failure to mitigate theory or other defense. Indi-
vidual application of these defenses may impact individual
damages calculations.
Assuming that common law defenses can operate to pre-
clude BIPA liability, which the parties contest and we have
not decided, we see no error. Consent presents a common
question because class members uniformly opt into the VTO
by clicking the “try on” button. It is therefore appropriate for
classwide resolution. See Gorss Motels, Inc. v. Brigadoon Fitness,
Inc., 29 F.4th 839, 844 (7th Cir. 2022) (observing that prior ex-
press permission may be amenable to class-wide proof when
given through uniform means).
No. 25-1361 17

Even if individual questions about the remaining defenses
and damages remain, they do not defeat class certification,
particularly where other common questions predominate. See
Tyson Foods, 577 U.S. at 453–54 (concluding that when one or
more common issues predominate, class certification is
proper even where individual questions about affirmative de-
fenses and damages exist); Arandell Corp. v. Xcel Energy Inc.,
149 F.4th 883, 887 (7th Cir. 2025) (same for damages); see also
Riffey v. Rauner, 910 F.3d 314, 315, 317–19 (7th Cir. 2018) (hold-
ing that the district court did not abuse its discretion in deny-
ing class certification where the only issue remaining, dam-
ages, would require highly individualized inquiries).
Here, damages, and affirmative defenses bearing on
measures of harm, are ancillary to the central question—lia-
bility—and can be handled at a separate phase of litigation.
See 7AA Charles Alan Wright & Arthur R. Miller, Federal Prac-
tice and Procedure § 1778, Westlaw (database updated Sept.
2025) (“[I]f the main issues in a case require the separate adju-
dication of each class member’s individual claim or defense,
a Rule 23(b)(3) action would be inappropriate.” (emphasis
added)); see, e.g., Gorss Motels, 29 F.4th at 844–45 (affirming
denial of class certification where liability turned on an af-
firmative defense requiring individual resolution).
The district court was also on solid ground in observing
that it retained discretion on a finding of liability to award
damages on a classwide basis by, for example, assessing the
amount of damages on a common per-scan basis. Remember,
too, that the district court has the flexibility to alter certifica-
tion or decertify should damages become unmanageable. See
Fed. R. Civ. P. 23(c)(1); Carnegie v. Household Int’l, Inc., 376 F.3d
656, 661 (7th Cir. 2004).
18 No. 25-1361

IV
In closing, we turn to Rule 23(b)(3)’s superiority require-
ment. Given that key common questions related to Amazon’s
liability predominate and will streamline this litigation, supe-
riority is less likely to present a barrier to class certification.
See Messner v. Northshore Univ. HealthSystem, 669 F.3d 802, 814
n.5 (7th Cir. 2012) (“There are so many common issues of law
and fact relating to the issue of Northshore’s liability … that
the superiority requirement likely poses no serious obstacle
to class certification here.”). And we agree with the district
court that the possible size of aggregate and individual dam-
ages does not alter that calculus.
Svoboda and Colosi seek statutory damages for each vio-
lation of BIPA. They tell us that this means that each time a
class member used the VTO feature, Amazon could be liable
for up to another $1,000 or $5,000 depending on the nature of
the violation. See 740 ILCS 14/20(a)(1)–(2), (b). Even if we
credit Amazon’s contention that the aggregate damages could
extend into the tens of millions of dollars, that observation is
not enough to defeat superiority. BIPA reflects a permissible
judgment of the Illinois General Assembly that the misuse of
biometric data amounts to a privacy violation warranting the
imposition of money damages. See 740 ILCS 14/5. And sanc-
tions may also deter future violations. To the extent that the
total damages disproportionately outweigh any proven
harm, the district court can reduce the award to ensure it is
not unconstitutionally punitive. See Murray v. GMAC Mortg.
Corp., 434 F.3d 948, 954 (7th Cir. 2006).
We recognize that high individual damages cut against the
primary aim of classwide adjudication—to facilitate relief
where claimants cannot or will not sue individually. See
No. 25-1361 19

Amchem, 521 U.S. at 616–17; Nagel v. ADM Inv. Servs., Inc., 217
F.3d 436, 443 (7th Cir. 2000); see also Fed. R. Civ. P.
23(b)(3)(A)–(B). This often occurs when the collective injury is
great but individual damages are too small to incentivize any
person to act alone. See Murray, 434 F.3d at 953. But Rule 23
does not bar class certification where individual damages are
high. See Amchem, 521 U.S. at 617 (observing that “the text of
Rule 23(b)(3) does not exclude from certification cases in
which individual damages run high”).
Other factors, including the lack of awareness of a claim,
inability to access an attorney, or complex, costly discovery,
can also hamper individual action regardless of the potential
award. In these circumstances, a class may be a superior ve-
hicle to vindicate individual injuries. See Mace v. Van Ru Credit
Corp., 109 F.3d 338, 344 (7th Cir. 1997) (explaining that a plain-
tiff’s awareness of their right to sue, willingness to take on the
burden of litigation, and ability to find an attorney are rele-
vant to superiority analysis); Suchanek, 764 F.3d at 760 (ob-
serving that the district court might find that “no rational in-
dividual plaintiff would be willing to bear the costs of this
lawsuit” due to costly discovery including survey evidence
and expert testimony); see also In re Facebook Biometric Info.
Priv. Litig., 326 F.R.D. 535, 548 (N.D. Cal. 2018) (“While not
trivial, BIPA’s statutory damages are not enough to incentiv-
ize individual plaintiffs given the high costs of pursuing dis-
covery on Facebook’s software and code base and Facebook’s
willingness to litigate the case.”), aff’d sub nom. Patel v. Face-
book, Inc., 932 F.3d 1264 (9th Cir. 2019).
The district court did not abuse its discretion in finding
that Amazon VTO users lack sufficient incentive to bring in-
dividual suits. The plaintiffs reported having spent over
20 No. 25-1361

$100,000 on expert discovery related to the VTO software. See
Suchanek, 764 F.3d at 760 (observing that “[common] class is-
sues often will be the most complex and costly to prove”).
And the absence of any meaningful individual VTO-related
BIPA litigation against Amazon to date is also telling. See Fed.
R. Civ. P. 23(b)(3)(B). We see no infirmity in the district court’s
conclusion based on these observations that affected users
may be unable or unwilling to undertake this costly litigation
alone without any guarantee of recovery.
Even if some individuals eventually sue, a class action
may still proceed. The superiority requirement entails a bal-
ancing analysis. See Mullins, 795 F.3d at 663–64. And as the
district court observed, this class action will resolve virtually
identical claims for potentially thousands of people. It will en-
sure uniform resolution of complex issues about the operation
of the VTO software, preserve judicial resources, and promote
efficiency. We agree with the district court that this suffices to
show superiority.
Finally, it warrants emphasis that class certification does
not carry any permanency. The district court should remain
vigilant in monitoring the propriety of certification as the case
develops.
For these reasons, we AFFIRM.