Facial Recognition at Stadiums and Theme Parks | Biometric Data Privacy Lawsuits

You buy a ticket to a baseball game or take your kids to a theme park for the weekend. You go through the entrance, maybe glance toward a camera, and walk through. What you may not realize is that your face was just scanned, converted into a digital profile, and potentially stored by a private company that never asked for your explicit permission to do any of it.

This is not a hypothetical. It is happening right now at some of the most popular entertainment venues in the country, and the legal questions surrounding it are far from settled. Contact our data privacy lawyers to discuss and to learn more about your legal options. 

The Technology is Moving Faster Than the Rules

Facial recognition and facial authentication systems have become one of the most discussed technology upgrades in the sports and entertainment venue industry. According to a 2025 industry survey, nearly half of venue operators named biometric technology among their top priorities for the year. The appeal is straightforward from a business standpoint: faster entry lines, frictionless concessions, more secure access to restricted areas, and a rich stream of behavioral and demographic data about the people attending events.

Several NFL stadiums now use facial authentication software to manage access to the field, press boxes, and premium seating areas. Some venues have taken it further, allowing fans to link their face to a payment method so they can purchase a beer without ever reaching for a wallet. The technology has also expanded into security functions, with at least some U.S. venues integrating facial recognition systems into their security scanners to flag individuals who have been previously banned from the facility.

The distinction between facial authentication and facial recognition matters here. Authentication systems typically convert a fan-provided photo into an encrypted digital token for identity verification. Recognition systems go further. They capture and store actual images of faces and run comparisons against databases in real time, often without any prior enrollment by the individual being scanned.

For fans who opt into a biometric program and understand exactly how their data will be used, this may feel like a reasonable trade-off for convenience. The problem is that a growing number of venues are deploying these systems in ways that leave most attendees without a clear picture of what is being collected, how long it is retained, who can access it, and whether it might be shared with third parties, including law enforcement.

Disney, Disneyland, and a New Class Action Lawsuit

The clearest recent example of how these tensions play out in court involves the Walt Disney Company. A class action lawsuit was filed on May 15, 2026 in federal court, alleging that Disneyland and Disney California Adventure began using facial recognition technology at park entrances starting around April 28, 2026, without obtaining meaningful consent from visitors.

The complaint was brought by a park guest who visited Disneyland on May 10 with her children. It argues that Disney converts visitors’ facial images into biometric numerical values that are then compared against photos taken when a ticket was first used, all without clearly informing guests that this process is taking place. The lawsuit seeks $5 million in damages and asks the court to require Disney to obtain explicit written consent before scanning any visitor’s face.

Disney’s position is that signs are posted near entrances indicating that facial recognition is in use, and that alternative entry lanes are available for visitors who do not wish to be scanned. The complaint counters that the signage is not adequate to constitute meaningful notice, particularly in environments where guests are moving through crowded entryways with their children.

One attorney representing the proposed class put it plainly in the filing: the burden of protecting privacy should not fall on the guest. If a company wants to collect biometric data this sensitive, it should be required to ask first, and that request should be clear, written, and voluntary.

The lawsuit reflects a broader pattern developing across the country as venues rush to adopt biometric systems while regulators and courts are still working to catch up.

What Makes Biometric Data Different

Part of what makes this area of law so important is the nature of the data itself. Biometric information is not like a password or a credit card number. You can change a password in under a minute. You cannot change your face.

When a company collects your facial geometry and stores it as a data point, that information becomes permanently tied to your identity. If that data is later breached, sold, or misused, the harm is potentially irreversible. In environments like stadiums and theme parks, where tens of thousands of people pass through entrances on a single day, the scale of collection is enormous. Most of those people have no awareness it is happening.

There is also a deeper concern about what this data reveals over time. When facial recognition is combined with ticketing records, concession purchases, location tracking within a venue, and marketing databases, a company can build a detailed behavioral profile of each attendee. That profile has real commercial value, and the people it is built on never agreed to be profiled.

The Legal Landscape Right Now

The United States does not have a single federal law governing the collection of biometric data by private companies. That gap has produced an inconsistent patchwork of state laws, leaving most Americans with protections that vary significantly depending on where they live.

Illinois remains the strongest model. The Biometric Information Privacy Act requires companies to provide written notice before collecting biometric data, obtain written consent, and publish a public policy explaining how long data will be kept and how it will be destroyed. BIPA has generated significant litigation, and while a 2024 amendment limited per-scan damages, the right to sue remains intact and class actions continue to be filed.

California has moved in a stronger direction in recent years as well. Businesses operating in California must disclose biometric collection and give consumers the ability to limit how their data is used and shared. The California Consumer Privacy Act has broadened those protections further, and state courts have shown a willingness to scrutinize companies that treat consent as a formality rather than a genuine choice.

Other states including Washington, New Jersey, and Texas have enacted their own biometric privacy statutes, though with varying standards and enforcement mechanisms. The result is that a sports fan attending a game in Chicago has very different legal protections than a fan attending a game in a state with no biometric privacy law at all.

For venues operating across multiple states, this creates both a compliance challenge and a legal risk. For visitors, it means the level of protection you have may depend entirely on where you bought your ticket.

The Opt-In vs. Opt-Out Problem

One of the central legal debates in facial recognition cases is the difference between opt-in and opt-out consent. Many venues take the position that posting signage or burying language in a terms of service agreement satisfies their disclosure obligations. Privacy advocates and plaintiffs’ attorneys argue that passive disclosure is not genuine consent, particularly when the alternative requires guests to actively seek out a different entrance lane in a crowded, fast-moving environment.

This distinction matters even more when children are involved. Parents making a family trip to a theme park are not typically thinking about data collection as they move through the entrance. The Disney lawsuit specifically calls out that children are among those whose biometric data is being collected without their parents having received any meaningful opportunity to decline.

When You May Have a Legal Claim

If you attended a sporting event, a concert, a theme park, or another large public venue and were subjected to facial recognition scanning without your clear knowledge and informed consent, you may have a viable legal claim depending on the state where the venue is located and the specific circumstances of how the technology was deployed. Potential claims in these cases can include:

• Violations of state biometric privacy statutes such as BIPA
• Negligence in the collection and storage of sensitive personal data
• Unjust enrichment from profiting off biometric data without consent
• Unfair or deceptive business practices under consumer protection laws

Class action litigation is a particularly effective mechanism in this space because the same conduct is typically applied to thousands or millions of people in the same way, making collective legal action far more efficient than individual claims.

Why Hire The Lyon Firm?

Biometric privacy litigation requires a thorough understanding of both the technology involved and the legal framework that governs it. At The Lyon Firm, our attorneys have pursued facial recognition and biometric privacy cases on behalf of individuals whose data was collected without proper consent. We understand how these systems work, what disclosure and consent standards apply across different states, and how to build a compelling class action case when a company has treated privacy obligations as an afterthought.

We take biometric privacy cases on a contingency fee basis, which means you owe nothing unless we recover on your behalf. If you attended a venue where facial recognition was used and you were not clearly informed or given a genuine choice, contact The Lyon Firm today for a free and confidential consultation. These cases are time-sensitive, and statutes of limitations vary by state.

Your face is yours. No company should be scanning it, storing it, and profiting from it without your consent. Contact The Lyon Firm to discuss your rights. We represent clients in all fifty states.