A new lawsuit alleges that a prominent software company has been unlawfully using personal information from Illinois residents to improve its own products. The complaint, filed by Ian Winans in the Superior Court of California, County of San Francisco on August 30, 2024, targets Plaid Inc., a well-known provider of identity verification services.
Winans' class action complaint accuses Plaid Inc. of violating the Illinois Identification Card Act (IICA) and the Illinois Driver’s License Act (IDLA). According to the lawsuit, Plaid uses information obtained from Illinois identification cards and driver’s licenses not only for their intended purpose—such as onboarding and age verification—but also for an undisclosed purpose: to enhance its machine learning and artificial intelligence algorithms. "Plaid never requested—nor did Plaintiff ever provide—consent to use his license for this purpose," states the complaint.
The core of the issue lies in how Plaid handles user data. When users submit their identification documents and selfies through Plaid's Identity Verification API, Plaid verifies their personal details against available records. However, Winans alleges that Plaid goes beyond these necessary checks by using this data as "training data" for its AI systems without explicit consent from users. This practice is claimed to be in direct violation of both IICA and IDLA, which prohibit using such information for purposes unrelated to the original transaction.
The plaintiff's experience highlights these allegations. In May 2024, Winans uploaded his Illinois driver’s license via Plaid’s software while trying to become a verified user of Binance, one of Plaid's clients. After completing the necessary verification process, Winans discovered that his information was used by Plaid for improving its services—a use he never consented to.
The legislative history behind IICA and IDLA supports Winans' claims. These laws were enacted following concerns about misuse of ID information, with specific provisions stating that any information obtained should only be used for identification or completing the commercial transaction it was collected for. The complaint cites multiple sources including legislative transcripts and press releases from the Office of the Illinois Secretary of State emphasizing these protections.
Winans seeks various forms of relief from the court: statutory damages amounting to $250 per violation, injunctive relief requiring Plaid to comply with IICA and IDLA regulations, declaratory relief confirming that Plaid's actions were unlawful, and coverage for attorneys’ fees and litigation costs.
Representing Winans are attorneys Philip L. Fraietta and Matthew Girardi from Bursor & Fisher P.A., based in New York City; along with L. Timothy Fisher from Bursor & Fisher P.A.'s Walnut Creek office in California. The case has been assigned Case ID CGC-24-617709 in front of Judge Daeja Rogers.