Virtual Try-On Tools Outpace Privacy Law
Retailers expand selfie-based shopping features while biometric privacy litigation over facial scans remains unresolved.
Updated on Nov. 5, 2026 in Beauty
Live Poll
Do you trust online stores to handle your selfie data responsibly?
Virtual try-on tools are now built into beauty, eyewear, and apparel shopping, and users typically upload a selfie and choose a shade or style. An Illinois class action against MAC Cosmetics, alleging its tool scanned facial geometry without written consent, remains open after a motion to dismiss was denied.
Why it matters
Online retailers operate across borders, so biometric data collected through a single try-on feature can fall under several legal regimes at once. The litigation shows how existing biometric and data protection laws are being tested against tools that most shoppers treat as routine.
Try-on tools save reference photos for reuse, as ChatGPT's feature does, so a single selfie may be stored beyond the initial session. The Illinois BIPA and the EU's GDPR, in force since 2018, set the consent and handling rules that apply to such scans.
The players
MAC Cosmetics
A beauty brand owned by Estée Lauder that is the defendant in an Illinois class action over its virtual try-on tool.
Estée Lauder
A global cosmetics company that faced a 2024 suit alleging failure to warn customers about biometric collection by try-on tools.
The details
A user uploads a selfie and selects a product shade or style, and the tool maps facial features to render the product on the image. The MAC Cosmetics complaint alleges this process scanned facial geometry without the written consent BIPA requires, while the earlier Estée Lauder suit alleged customers were not warned that biometric information would be collected.
Timeline
2018: The General Data Protection Regulation took effect in the European Union.
2024: A biometric privacy suit was filed against Estée Lauder over try-on tools.
June 2026: MAC Cosmetics moved to dismiss the class action, and the motion was denied.
Privacy Frontier
The MAC Cosmetics litigation applies the Illinois Biometric Information Privacy Act's written-consent requirement to consumer shopping tools, extending a statute built largely around workplace timekeeping devices into everyday retail. Each new case tests whether that consent framework can keep pace with selfie-based shopping that spans beauty, eyewear and apparel.
Before uploading a selfie to a try-on tool, check whether the retailer discloses how long images are stored and whether they can be deleted. Shoppers in Illinois have specific consent rights under state biometric law, and similar protections apply in the EU under GDPR.
The takeaway
Virtual try-on convenience comes with a biometric data trade-off, so reviewing a retailer's storage and consent practices before uploading a photo is a practical step. The outcome of the MAC Cosmetics case may clarify how much consent retailers must obtain up front.
Further reading
For more on the products driving this trend, see the Beauty section.
Live Poll
Do you trust online stores to handle your selfie data responsibly?
