Retail & Fintech · Retail (beauty) · Private litigation
Ulta Beauty
Headline
The BIPA class actions concern Ulta's GLAM Lab virtual try-on, and the mechanism is the point: a feature that lets you see how lipstick would look requires mapping the geometry of your face, which is biometric…
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
The BIPA class actions concern Ulta's GLAM Lab virtual try-on, and the mechanism is the point: a feature that lets you see how lipstick would look requires mapping the geometry of your face, which is biometric identifier collection under Illinois law regardless of what the marketing calls it. Illinois BIPA requires informed written consent before collection and lets individuals sue without proving harm, which is why virtual try-on has become one of the most litigated features in retail. Ulta separately drew regulatory and litigation attention over reselling returned cosmetics. Allegations, not findings.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Case status. Private litigation; no sources are on file yet, so no legal tier is assigned.
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
SEPARATE TRACKING-TECHNOLOGY LAWSUIT: Ulta was separately sued in a proposed class action in federal court in the Southern District of California (reported Dec. 12, 2022 by Law360 and Cosmetics Business), alleging it used 'session replay' SPYWARE-STYLE software to record website visitors' interactions without knowledge/consent, in violation of the California Invasion of Privacy Act and the federal Wiretap Act — the same pattern documented for Chewy, Michaels, and AutoZone elsewhere in this tracker.
Data sharing
BIPA (BIOMETRIC PRIVACY) CLASS ACTIONS filed in Illinois state court over Ulta's 'GLAMlab' virtual try-on, 'Foundation Shade Matcher' and 'Skin Analysis' tools (reported by ArentFox Schiff, July 2021; case names and current status not retrieved) (launched 2016, expanded via a 2018 tech-startup acquisition): plaintiffs allege Ulta scans customers' FACIAL GEOMETRY via phone camera/app to let users virtually try on foundation shades, false eyelashes, and hair colors — WITHOUT disclosing this biometric collection or obtaining the written consent Illinois' BIPA requires, and without publishing the legally-required data retention/destruction policy. A reported 2023 voluntary dismissal of one case could not be verified; the suits' current status is unknown. Ulta's OWN CURRENT PRIVACY POLICY candidly confirms it collects 'Biometric Information' (facial geometry), 'Audio and Visual Information' (including recorded customer service calls), and even, in some cases, 'PERSONAL TEMPERATURE' — an unusually specific and sensitive data category rarely seen disclosed elsewhere in this tracker. Ulta's policy also explicitly states it 'sells' and 'shares' personal information (as defined under California law) with advertising/analytics/marketing partners, though it commits not to knowingly sell/share data of California residents 16 or younger.
Fees and billing
SEPARATE, UNRELATED WAGE-THEFT LITIGATION: distribution-center and retail employees have sued Ulta over allegedly UNPAID TIME spent undergoing mandatory security/bag checks after clocking out but before being allowed to leave — an employee wage issue, not a customer-privacy finding.
Contacts
Privacy contact. Not recorded.
Legal notice. PUBLIC COMPANY (ULTA). Service route: c/o General Counsel / Corporate Secretary, Bolingbrook, Illinois — the corporate address on the SEC Form 10-K cover page is the official address of record. Confirm the exact street address on the current 10-K at sec.gov/edgar, and check the state-of-incorporation registered agent (usually Delaware; most large filers use The Corporation Trust Company or Corporation Service Company) via the Secretary of State business-entity search. A registered agent MUST accept service, which is why it is the reliable channel when a company publishes no privacy address.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy ulta.com/company/privacy | Not fetched yet | NO (HTML only) |
| Terms of service ulta.com/company/terms-of-use | Not fetched yet | NO (HTML only) |
| Website ulta.com | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No comprehensive state privacy statute on file for Illinois