A federal lawsuit filed in Illinois claims the Chicago Cubs and their security contractors used facial recognition technology on fans at Wrigley Field without following basic legal requirements under state privacy law.
The proposed class action, lodged on September 15, 2025, says the team and two private security firms captured biometric data without proper notice or permission.
The legal complaint names the Cubs alongside Blue Star Security, LLC and Security Services Holdings LLC, which operates under the name Protos Security.
We obtained a copy of the complaint for you here.
Together, they are accused of deploying facial recognition tools at Wrigley Field that scanned the faces of attendees without providing the written disclosures or obtaining the signed releases required by Illinois law.
The suit states that this happened to “millions of fans.”
Illinois’ Biometric Information Privacy Act (BIPA), passed in 2008, sets out some of the most protective rules in the country when it comes to biometric data.
The statute prohibits the collection of biometric identifiers, like fingerprints or facial geometry, unless the person is informed in writing and gives signed authorization.
Lawsuits can be brought by individuals even if they haven’t suffered financial or emotional harm, a position backed by the Illinois Supreme Court in Rosenbach v. Six Flags.
If the plaintiffs’ claims are upheld, the Cubs and their security contractors could face steep penalties. BIPA allows for $1,000 in damages per violation if done negligently, and $5,000 per violation if the collection was intentional or reckless. Given the scale alleged in the complaint, the financial stakes are considerable.
This lawsuit joins a wave of legal actions challenging the quiet rollout of biometric systems in both public and private settings.
While companies argue these tools are intended to improve safety and efficiency, the law in Illinois places strict limits on how this data can be collected and used.
