Fortune: “The Supreme Court of Illinois on Friday ruled that an amusement park, Six Flags Great America, must pay damages to a boy for collecting his thumbprint without proper consent. The decision in the closely-watched case opens the door for the possibility of huge payouts in related cases against technology companies whose face-scanning policies breached a state law known as the Biometric Information Privacy Act.

In the Six Flags case, a mother named Stacey Rosenbach filed a lawsuit upon learning the amusement park scanned and stored her son’s thumbprint as part of its annual pass program. The case soon became a key test of the law, known as BIPA. The crucial issue is whether a person must show they suffered actual harm when a company collects biometrics without permission, or if it’s enough just to show that the act took place. In a 7-0 ruling, the Illinois court agreed with Rosenbach that the purpose of the law, which provides for a $1,000 to $5,000 penalty, is to deter companies misusing consumers’ biometrics. This meant that Rosenbach’s son counts as an “aggrieved person” in the language of BIPA. This ruling comes as a blow for Google and Facebook, both of which are ensnared in BIPA lawsuits of their own…”