In the United States Court of Appeals For the Seventh Circuit ____________________ No. 25-1361 TANYA N. SVOBODA and ANTONELLA M. ORTIZ COLOSI, Plaintiffs-Appellees, v. AMAZON.COM INC. and AMAZON.COM SERVICES, LLC, Defendants-Appellants. ____________________ Appeal from the United States District Court for the Northern District of Illinois, Eastern Division. No. 1:21-cv-05336 — Jorge L. Alonso, Judge. ____________________ ARGUED SEPTEMBER 9, 2025 — DECIDED DECEMBER 17, 2025 ____________________ Before ROVNER, HAMILTON, and SCUDDER, Circuit Judges. SCUDDER, Circuit Judge. Tanya Svoboda and Antonella Ortiz Colosi used a Virtual Try-On feature through Amazon’s mobile site and app to virtually test facial products like lip- stick and eyewear. They later brought this class action against Amazon alleging that the VTO feature violates the Illinois Bi- ometric Information Privacy Act through its capture and use of their facial data. The district court certified a class of 2 No. 25-1361 Amazon VTO users within Illinois. Seeing no abuse of discre- tion, we affirm. I A Amazon’s mobile website and application offer the VTO feature to customers to virtually “try on” makeup and eye- wear products. The VTO software operates to render facial products over an image or video of a user’s face so they can see what a product will look like before making a purchase decision. Amazon used two VTO programs during the relevant pe- riod—one developed in-house and another developed by a company named ModiFace. Both programs function simi- larly. An Amazon customer shopping on a mobile device can preview a product by clicking a “try on” button on the prod- uct page. On the first VTO use, the application prompts the user to give Amazon permission to access the camera on their device. Once users grant access, they can opt to preview the product on a live video or actual photo of their face. They can also preview a product in “model mode,” which displays the product on a model’s face rather than the user’s. If users elect to preview on their own image, the VTO feature activates the camera on their device to capture their facial geometry from the live video or photo and then analyzes it to determine where to overlay the product. The VTO application sends in- formation about the product to the device, which then renders the product on the user’s image in the appropriate area. Svoboda and Colosi’s claims under the Illinois Biometric Information Privacy Act arise out of their use of Amazon’s VTO feature. Biometric identifiers such as facial data and No. 25-1361 3 fingerprints are unique to each person and unalterable. If compromised, the privacy harm cannot be mitigated by changing them. The Illinois General Assembly enacted BIPA to strengthen biometric data security. See 740 ILCS 14/5; see also Fox v. Dakkota Integrated Sys., LLC, 980 F.3d 1146, 1149–50 (7th Cir. 2020) (explaining BIPA’s history and purposes). To this end, the enactment regulates the “collection, use, safe- guarding, handling, storage, retention, and destruction of bi- ometric identifiers and information.” 740 ILCS 14/5(g). Two provisions of BIPA are relevant here. Section 15(a) re- quires private entities in possession of biometric data to de- velop, publish, and comply with a written policy that estab- lishes a data retention schedule and guidelines for destroying biometric identifiers and information. See 740 ILCS 14/15(a). Section 15(b), in turn, prohibits private entities from “col- lect[ing], captur[ing], purchas[ing], receiv[ing] through trade, or otherwise obtain[ing]” a person’s biometric data unless they first: (1) provide written notice that biometric data will be collected or stored, (2) inform the person of the length and reason for which the biometric data will be collected, stored, and used, and (3) receive a written release signed by the per- son. 740 ILCS 14/15(b). The parties agree that BIPA is not extraterritorial—any statutory violation must occur in Illinois to warrant relief. Il- linois Supreme Court precedent gives us no reason to ques- tion that proposition. See Avery v. State Farm Mut. Auto. Ins. Co., 835 N.E.2d 801, 852 (Ill. 2005) (observing that under Illi- nois law, a “statute is without extraterritorial effect unless a clear intent … appears from the express provisions of the stat- ute.” (quoting Dur-Ite Co. v. Indus. Comm’n, 68 N.E.2d 717, 722 (Ill. 1946))). 4 No. 25-1361 BIPA provides for statutory damages. “A prevailing party may recover” $1,000 for each negligent violation and $5,000 for each intentional or reckless violation. 740 ILCS 14/20(a)(1)–(2). A separate statutory violation generally ac- crues with “every scan” of biometric data. Cothron v. White Castle Sys., Inc., 216 N.E.3d 918, 929 (Ill. 2023), as modified on denial of reh’g (July 18, 2023). The statute also entitles success- ful plaintiffs to recover reasonable attorneys’ fees and costs. See 740 ILCS 14/20(a)(3). The Illinois General Assembly amended BIPA in 2024 to cap statutory damages in certain circumstances. See Act of Aug. 2, 2024, Pub. Act 103-0769, 2024 Ill. Laws 6757, 6759–60. Section 20(b) now specifies that an entity that collects the same biometric data from the same person using the same method of collection in violation of Section 15(b) only com- mits a single violation. See 740 ILCS 14/20(b). Whether this amendment ultimately may cap the damages that some class members can recover is not a question before us, as the an- swer does not affect our review of the district court’s class cer- tification decision. Tanya Svoboda alleges that she used Amazon’s VTO in Il- linois while shopping for lipstick on its mobile website in 2020. In September 2021, she filed a putative class action against Amazon in Illinois state court. Amazon removed the case to federal court under the Class Action Fairness Act. See 28 U.S.C. §§ 1332(d), 1453(b). Antonella Ortiz Colosi joined the action in an amended complaint in May 2022, alleging that she too used Amazon’s VTO for makeup products while in Illinois. Colosi testified that she used the VTO in 2019, 2020, 2021, and 2022. No. 25-1361 5 Together, Svoboda and Colosi allege that Amazon’s use of the VTO feature violated Sections 15(a) and (b) of BIPA. More specifically, Amazon allegedly collected, captured, stored, and used their own facial geometry and associated personal identifying information and that of “thousands if not mil- lions” of people who used the VTO feature in Illinois without providing notice and the required information, obtaining in- formed written consent, or creating written publicly available data retention and destruction guidelines. They seek statu- tory damages, injunctive relief, and fees and costs. B Svoboda and Colosi moved for class certification under Federal Rule of Civil Procedure 23(b)(3). The district court granted the motion and certified a class of “all individuals who used a [VTO] feature on Amazon’s mobile website or app while in Illinois on or after September 7, 2016.” The district court determined that the proposed class sat- isfied Rule 23(a)’s threshold requirements for certification. Only commonality is relevant to this appeal and, even then, only insofar as it relates to predominance under Rule 23(b)(3). The district court found that the same alleged course of con- duct unites the alleged BIPA violations: Amazon’s unlawful use of the VTO application. The court identified questions common to the class that, if answered, would resolve issues central to each claim “in one stroke.” Those questions gener- ally concern the functionality of the VTO software, Amazon’s use of the class members’ biometric data, and legal questions about whether that use violated Sections 15(a) and 15(b) of BIPA. 6 No. 25-1361 The district court also found that the class satisfied the pre- dominance and superiority requirements of Rule 23(b)(3). Af- ter identifying common questions, it acknowledged that indi- vidual inquiries might be needed to assess whether potential class members used the VTO in Illinois. But it determined that this issue was manageable enough to justify certification without violating Amazon’s due process right to challenge particular class members’ showing of a statutory violation or entitlement to a particular damages award. Nor did Ama- zon’s proposed affirmative defenses defeat predominance be- cause they either did not apply to BIPA claims or reflected common issues. The district court further determined that a class action was superior to individual litigation because individuals would be unlikely to sue on their own and common issues made class resolution efficient. The prospect of high aggre- gate or individual damages under BIPA did not alter this con- clusion because the district court observed that it retains eq- uitable discretion to reduce unconstitutionally excessive dam- ages. Amazon timely filed an interlocutory appeal challenging the district court’s class certification ruling. See 28 U.S.C. § 1292(e); Fed. R. Civ. P. 23(f). II Rule 23(a) imposes four requirements for class certifica- tion: numerosity, commonality, typicality, and adequacy of representation. See Fed. R. Civ. P. 23(a)(1)–(4). Once a class satisfies Rule 23(a), it must also fit into one of three types of class actions enumerated in Rule 23(b). The plaintiff bears the burden of showing that the proposed class satisfies Rule 23 by No. 25-1361 7 a preponderance of the evidence. See Eddlemon v. Bradley Univ., 65 F.4th 335, 338 (7th Cir. 2023). If the class meets all requirements, the district court must certify it. See id. Svoboda and Colosi sought class certification under Rule 23(b)(3), which requires that “questions of law or fact com- mon to class members predominate” over individual ques- tions and that “a class action is superior to other available methods for fairly and efficiently adjudicating the contro- versy.” Fed. R. Civ. P. 23(b)(3). Rule 23(b)(3)’s predominance requirement “builds on commonality.” Eddlemon, 65 F.4th at 338 (quoting Howard v. Cook County Sheriff's Off., 989 F.3d 587, 607 (7th Cir. 2021)); see also Amchem Prods., Inc. v. Windsor, 521 U.S. 591, 623–24 (1997) (“[T]he predominance criterion is far more demanding [than commonality].”). While commonality requires that common questions exist, predominance requires that they also pre- dominate. See Eddlemon, 65 F.4th at 338. Predominance tests whether the class is “sufficiently cohesive” to justify class ad- judication. Tyson Foods, Inc. v. Bouaphakeo, 577 U.S. 442, 453 (2016) (quoting Amchem, 521 U.S. at 623). Central to this in- quiry is whether the claims “arise from a common nucleus of operative facts and issues.” Scott v. Dart, 99 F.4th 1076, 1092 (7th Cir. 2024) (quoting Beaton v. SpeedyPC Software, 907 F.3d 1018, 1029 (7th Cir. 2018)). The Supreme Court has emphasized the rigor required in a proper predominance analysis. See Comcast Corp. v. Behrend, 569 U.S. 27, 33–34 (2013) (observing that class certification re- quires “rigorous analysis” and that “Rule 23(b)(3)’s predomi- nance criterion is even more demanding than Rule 23(a)”); see also Schroeder v. Progressive Paloverde Ins. Co., 146 F.4th 567, 573 (7th Cir. 2025) (emphasizing the same point); Eddlemon, 65 8 No. 25-1361 F.4th at 338 (same). Predominance does not entail a mechani- cal tallying of common questions against individual ques- tions. Instead, a district court must identify the elements of each claim, the proof necessary for each, the manageability of those issues at trial, and alternative procedural tools. See Schroeder, 146 F.4th at 574; Simer v. Rios, 661 F.2d 655, 672–75 (7th Cir. 1981). From there the court must scrutinize the rela- tionship between common and individual questions and as- sess their relative importance. See Tyson Foods, 577 U.S. at 453. Rule 23(b)(3) separately requires a showing of superiority. The plaintiff must demonstrate that a class action is “the most practical and efficient way to resolve the litigation.” Jacks v. DirectSat USA, LLC, 118 F.4th 888, 898 (7th Cir. 2024). The su- periority inquiry is comparative: instead of considering the cost of a class action “in a vacuum,” a court must consider its costs and benefits in light of other available methods. Mullins v. Direct Digital, LLC, 795 F.3d 654, 663–64 (7th Cir. 2015). To be sure, predominance and superiority analyses often overlap. Indeed, Rule 23(b)(3) provides a non-exhaustive list of considerations relevant to both: (A) the class members’ interests in individually controlling the prosecution or defense of sepa- rate actions; (B) the extent and nature of any litigation con- cerning the controversy already begun by or against class members; (C) the desirability or undesirability of concen- trating the litigation of the claims in the partic- ular forum; and No. 25-1361 9 (D) the likely difficulties in managing a class ac- tion. Fed. R. Civ. P. 23(b)(3)(A)–(D); see Amchem, 521 U.S. at 615 (stating that the list of factors in Rule 23(b)(3) is non-exhaus- tive). III Our review of a district court’s class certification decision is deferential. We give the district court considerable leeway to exercise its discretion unless it commits legal error or makes clearly erroneous factual findings. See Jacks, 118 F.4th at 894–95. Amazon limits its challenge to the district court’s determi- nation on predominance and superiority under Rule 23(b)(3). We take each in turn and, in the end, see no abuse of discre- tion by the district court. We begin with predominance. The district court con- cluded that six common questions about Amazon’s liability predominate over three individual questions: the locational element of a BIPA claim, affirmative defenses, and damages. A Recall that the parties start from a common point of legal agreement: class members must show that they were in Illi- nois when they used Amazon’s VTO to establish a statutory violation of BIPA. The district court primarily analyzed this location requirement as an issue of class identification and manageability. This approach was incomplete. Location is rel- evant beyond just identifying class members. For the pur- poses of this appeal, we assume it is also a requirement of a BIPA claim. As a result, the district court needed to go a step 10 No. 25-1361 further and assess whether proof of location generates an in- dividualized question of fact that predominates over common questions. See Eddlemon, 65 F.4th at 339–40 (holding that the district court abused its discretion in finding that common is- sues predominated where it failed to identify and separately analyze the elements of the claims and conducted only a scant analysis); Santiago v. City of Chicago, 19 F.4th 1010, 1016–17 (7th Cir. 2021) (holding the same where the district court failed to identify the claims or discuss their elements and other clarity issues in the record complicated appellate re- view). But this shortcoming was not fatal because the substance of the district court’s reasoning touched sufficiently on all components required for a proper predominance analysis. Remand is therefore unnecessary, as it is clear from our own review that common questions predominate. See United States v. Nonahal, 338 F.3d 668, 671 (7th Cir. 2003) (“[R]emand is un- necessary because the district court’s reasons … are appar- ent.”). Location Presents an Individual Question Sections 15(a) and (b) of BIPA both require proof that Am- azon collected, captured, obtained, or possessed biometric data. As the district court recognized, this requirement, in turn, raises two common questions that may require expert discovery on the VTO software: (1) whether the facial data used by the operation of the VTO application constitutes bio- metric identifiers or information within the meaning of BIPA and (2) whether the use of the VTO means Amazon collected, captured, obtained, or possessed it. If the answer to both ques- tions is yes, Amazon violated Section 15(a) if it failed to de- velop and publish a policy for data retention and destruction, No. 25-1361 11 with the latter inquiry itself presenting a common question. Amazon separately violated Section 15(b) if it failed to dis- close information required by Sections 15(b)(1) and (b)(2) or failed to obtain signed written releases from VTO users per Section 15(b)(3). Those statutory requirements likewise pre- sent common questions. Location—the geographic place from which a class mem- ber used the VTO—is the countervailing individual question. That observation follows from the evidence that would be used to prove location at trial. See Tyson Foods, 577 U.S. at 453 (“An individual question is one where ‘members of a pro- posed class will need to present evidence that varies from member to member….’” (quoting 2 W. Rubenstein, Newberg on Class Actions § 4:50 (5th ed. 2012))). Svoboda and Colosi proposed proving location with three sources of information: VTO user billing addresses, IP ad- dresses and geolocation data, and personal affidavits from class members in which they attest to using the VTO applica- tion within Illinois. The record developed in the district court shows that Amazon maintains VTO usage data with accom- panying billing address information associated with the user’s account and, in certain circumstances, corresponding IP address and geolocation data. If a user is signed into an Amazon account or, in the case of the ModiFace VTO, the user adds the tested product to their virtual shopping cart, Ama- zon records the IP address associated with the VTO use. A cybersecurity expert testifying for Amazon in the dis- trict court explained how IP addresses reveal (or can be ana- lyzed to yield) geolocation information associated with VTO usage. IP addresses, the expert explained, contain indicators that roughly correlate with the location of the associated 12 No. 25-1361 device. It also appears that Amazon contracts with a third- party provider to generate geolocation information, which in- cludes an approximation of the state corresponding to the IP address and to the VTO usage data. It is not clear from the record at what level of completeness Amazon captures IP ad- dresses. That fact matters because it bears on how closely the captured IP address information correlates with the location of the device using the VTO application. Based on our review of the record, what stands out is the testimony offered by an Amazon witness during a deposition. The witness stated that Amazon captures and maintains VTO usage records with full IP address information. This leads us to believe that, at least in some circumstances, reasonable findings about location in- formation will follow. What all of this means as a practical matter is that common proof of location including billing address and geolocation in- formation will be available for some claimants. But, as the dis- trict court acknowledged, individualized inquiries will be necessary for others. For example, where billing address and geolocation data point to different states, or are unavailable for an alleged VTO use, individual affidavits or other proof will be necessary to show that the claimant used the VTO in Illinois. Location Does Not Predominate Over Common Questions The district court did not abuse its discretion in finding that individualized questions connected to proof of location will not predominate over common questions related to BIPA liability. But, if we accept that BIPA requires proof of location, not all elements of liability must be resolved on a classwide basis to satisfy Rule 23. Supreme Court precedent is clear on this point. See Amgen Inc. v. Conn. Ret. Plans & Tr. Funds, 568 No. 25-1361 13 U.S. 455, 469 (2013) (“Rule 23(b)(3) … does not require a plain- tiff seeking class certification to prove that each element of her claim is susceptible to classwide proof.” (cleaned up)). We have emphasized the same on many prior occasions. See, e.g., Beaton, 907 F.3d at 1029–30 (“[Defendant] misreads Supreme Court precedent in arguing that liability with regard to all class members must be resolved in a single stroke.” (citing Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338, 350 (2011))); Bell v. PNC Bank, Nat’l Ass’n, 800 F.3d 360, 380–81 (7th Cir. 2015) (ob- serving that Rule 23 does not require a class action to resolve all liability issues and discussing cases); Suchanek v. Sturm Foods, Inc., 764 F.3d 750, 759 (7th Cir. 2014) (holding that it was an “error of law” to conclude that the individual question of causation, “as required to establish liability” in a consumer action, predominated). To the contrary, it is not uncommon for class actions to have a “final phase” for class members to submit individual- ized proof of a claim. Suchanek, 764 F.3d at 756. After proving a defendant’s actions relevant to liability, each claimant must show that those actions harmed them. See id. at 757. A phase requiring individual presentations of proof on all (or part of) an element of a claim does not defeat predominance. Stated another way, an individual question does not predominate where common questions of law and fact relevant to liability otherwise generate significant efficiencies and the individual question is manageable. See Dukes, 564 U.S. at 350 (“What matters to class certification … [is] the capacity of a class-wide proceeding to generate common answers apt to drive the res- olution of the litigation.” (cleaned up)); see, e.g., Scott, 99 F.4th at 1092–93 (holding in a class action alleging inadequate den- tal care that common questions predominated even though individualized trials would be needed to prove causation and 14 No. 25-1361 seek damages and not every class member will have suffered a denial of adequate care); Bell, 800 F.3d at 378–80 (holding the same in a class action alleging failure to pay overtime wages where each class member would need to individually prove they worked overtime and were entitled to relief) (discussing cases); Pella Corp. v. Saltzman, 606 F.3d 391, 394 (7th Cir. 2010) (holding the same in a product liability class action where each class member would need to individually prove causa- tion and damages). The district court did not abuse its discretion in conclud- ing that the same reasoning applies here. One alleged course of conduct sufficiently unites the class’s claims—Amazon’s unlawful use of the VTO feature. And the entire class will “prevail or fail in unison” on common questions related to that conduct. Amgen, 568 U.S. at 460. Some common questions require expert discovery to analyze the VTO software. None will benefit from repeated adjudication. And the potential class is estimated to be over 100,000 people. These factors point to class resolution as an efficient method of adjudica- tion. See Suchanek, 764 F.3d at 760; Scott, 99 F.4th at 1092–93. If the common questions are all answered in favor of the class, it will have established a statutory injury. Even if location is necessary for individual recovery under BIPA, it is more char- acteristic of the individual questions permitted and often iso- lated in class actions than a core liability question based on Amazon’s alleged statutory violations. The district court’s manageability analysis, though only part of predominance, is also relevant. See Rule 23(b)(3)(D); Simer, 661 F.2d at 677 (“[A]ny discussion of predominance must incorporate the concept of manageability because the is- sues for individual adjudication may be adequately managed No. 25-1361 15 with certain procedural devices.”). Our view on manageabil- ity parallels much of our reasoning on how we see class mem- bers proving the locational element. In short, the district court did not abuse its discretion in finding that the combination of billing addresses, IP and geolocation data, and affidavits make the locational element manageable. No proxy alone may suffice or be perfect to prove location. Billing addresses may be out of date. Geolocation data has a margin of error, especially for cellular data, according to Am- azon’s cybersecurity expert. But the same expert reported that even the company’s vendor’s lowest estimate of geolocation accuracy correctly resolves a cellular IP address to a city 54% of the time within a 100-kilometer radius. On this record, we cannot say the district court abused its discretion in finding that this data, combined with billing addresses and affidavits, can prove a claimant was more likely than not in Illinois when they used the VTO. See Beaton, 907 F.3d at 1030 (observing that affidavits and auditing procedures can be used to handle individualized inquiries). Amazon’s challenge to predominance fares no better as a due process argument. The company will still have the oppor- tunity to challenge class members’ individual proof of loca- tion. It can choose to challenge the reliability of the location data on the merits, contest the credibility of subgroups—such as class members for whom there is no geolocation data—or present evidence challenging particular affidavits. See id. (ex- plaining that a defendant’s due process rights are not harmed by case management tools for individual inquiries); Mullins, 795 F.3d at 669 (determining that due process does not require a “cost-effective procedure for challenging every individual claim”). But at this stage, individual questions about location 16 No. 25-1361 neither predominate nor threaten the fundamental fairness due to Amazon. See Mullins, 795 F.3d at 669 (“[A] defendant has a due process right … to present individualized defenses if those defenses affect its liability.” (citing Dukes, 564 U.S. at 365–67)). B Amazon’s affirmative defenses also convince us that the district court did not commit any error at class certification. The company raised, and the district court rejected, four com- mon law defenses as challenges to predominance—consent, failure to mitigate, estoppel, and waiver. As we understand it, Amazon’s position is that these defenses require individu- alized inquiries to determine if they apply to each class mem- ber. For example, a class member who fully understood the VTO software but chose to use it anyway, so the company’s argument goes, should not be able to recover for BIPA viola- tions under a failure to mitigate theory or other defense. Indi- vidual application of these defenses may impact individual damages calculations. Assuming that common law defenses can operate to pre- clude BIPA liability, which the parties contest and we have not decided, we see no error. Consent presents a common question because class members uniformly opt into the VTO by clicking the “try on” button. It is therefore appropriate for classwide resolution. See Gorss Motels, Inc. v. Brigadoon Fitness, Inc., 29 F.4th 839, 844 (7th Cir. 2022) (observing that prior ex- press permission may be amenable to class-wide proof when given through uniform means). Even if individual questions about the remaining defenses and damages remain, they do not defeat class certification, No. 25-1361 17 particularly where other common questions predominate. See Tyson Foods, 577 U.S. at 453–54 (concluding that when one or more common issues predominate, class certification is proper even where individual questions about affirmative de- fenses and damages exist); Arandell Corp. v. Xcel Energy Inc., 149 F.4th 883, 887 (7th Cir. 2025) (same for damages); see also Riffey v. Rauner, 910 F.3d 314, 315, 317–19 (7th Cir. 2018) (hold- ing that the district court did not abuse its discretion in deny- ing class certification where the only issue remaining, dam- ages, would require highly individualized inquiries). Here, damages, and affirmative defenses bearing on measures of harm, are ancillary to the central question—lia- bility—and can be handled at a separate phase of litigation. See 7AA Charles Alan Wright & Arthur R. Miller, Federal Prac- tice and Procedure § 1778, Westlaw (database updated Sept. 2025) (“[I]f the main issues in a case require the separate adju- dication of each class member’s individual claim or defense, a Rule 23(b)(3) action would be inappropriate.” (emphasis added)); see, e.g., Gorss Motels, 29 F.4th at 844–45 (affirming denial of class certification where liability turned on an af- firmative defense requiring individual resolution). Remem- ber, too, that the district court has the flexibility to alter certi- fication or decertify should damages become unmanageable. See Fed. R. Civ. P. 23(c)(1); Carnegie v. Household Int’l, Inc., 376 F.3d 656, 661 (7th Cir. 2004). IV In closing, we turn to Rule 23(b)(3)’s superiority require- ment. Given that key common questions related to Amazon’s liability predominate and will streamline this litigation, supe- riority is less likely to present a barrier to class certification. See Messner v. Northshore Univ. HealthSystem, 669 F.3d 802, 814 18 No. 25-1361 n.5 (7th Cir. 2012) (“There are so many common issues of law and fact relating to the issue of Northshore’s liability … that the superiority requirement likely poses no serious obstacle to class certification here.”). And we agree with the district court that the possible size of aggregate and individual dam- ages does not alter that calculus. Svoboda and Colosi seek statutory damages for each vio- lation of BIPA. They tell us that this means that each time a class member used the VTO feature, Amazon could be liable for up to another $1,000 or $5,000 depending on the nature of the violation. See 740 ILCS 14/20(a)(1)–(2), (b). Even if we credit Amazon’s contention that the aggregate damages could extend into the tens of millions of dollars, that observation is not enough to defeat superiority. BIPA reflects a permissible judgment of the Illinois General Assembly that the misuse of biometric data amounts to a privacy violation warranting the imposition of money damages. See 740 ILCS 14/5. And sanc- tions may also deter future violations. To the extent that the total damages disproportionately outweigh any proven harm, the district court can reduce the award to ensure it is not unconstitutionally punitive. See Murray v. GMAC Mortg. Corp., 434 F.3d 948, 954 (7th Cir. 2006). We recognize that high individual damages cut against the primary aim of classwide adjudication—to facilitate relief where claimants cannot or will not sue individually. See Am- chem, 521 U.S. at 616–17; Nagel v. ADM Inv. Servs., Inc., 217 F.3d 436, 443 (7th Cir. 2000); see also Fed. R. Civ. P. 23(b)(3)(A)–(B). This often occurs when the collective injury is great but individual damages are too small to incentivize any person to act alone. See Murray, 434 F.3d at 953. But Rule 23 does not bar class certification where individual damages are No. 25-1361 19 high. See Amchem, 521 U.S. at 617 (observing that “the text of Rule 23(b)(3) does not exclude from certification cases in which individual damages run high”). Other factors, including the lack of awareness of a claim, inability to access an attorney, or complex, costly discovery, can also hamper individual action regardless of the potential award. In these circumstances, a class may be a superior ve- hicle to vindicate individual injuries. See Mace v. Van Ru Credit Corp., 109 F.3d 338, 344 (7th Cir. 1997) (explaining that a plain- tiff’s awareness of their right to sue, willingness to take on the burden of litigation, and ability to find an attorney are rele- vant to superiority analysis); Suchanek, 764 F.3d at 760 (ob- serving that the district court might find that “no rational in- dividual plaintiff would be willing to bear the costs of this lawsuit” due to costly discovery including survey evidence and expert testimony); see also In re Facebook Biometric Info. Priv. Litig., 326 F.R.D. 535, 548 (N.D. Cal. 2018) (“While not trivial, BIPA’s statutory damages are not enough to incentiv- ize individual plaintiffs given the high costs of pursuing dis- covery on Facebook’s software and code base and Facebook’s willingness to litigate the case.”), aff’d sub nom. Patel v. Face- book, Inc., 932 F.3d 1264 (9th Cir. 2019). The district court did not abuse its discretion in finding that Amazon VTO users lack sufficient incentive to bring in- dividual suits. The plaintiffs reported having spent over $100,000 on expert discovery related to the VTO software. See Suchanek, 764 F.3d at 760 (observing that “[common] class is- sues often will be the most complex and costly to prove”). And the absence of any meaningful individual VTO-related BIPA litigation against Amazon to date is also telling. See Fed. R. Civ. P. 23(b)(3)(B). We see no infirmity in the district court’s 20 No. 25-1361 conclusion based on these observations that affected users may be unable or unwilling to undertake this costly litigation alone without any guarantee of recovery. Even if some individuals eventually sue, a class action may still proceed. The superiority requirement entails a bal- ancing analysis. See Mullins, 795 F.3d at 663–64. And as the district court observed, this class action will resolve virtually identical claims for potentially thousands of people. It will en- sure uniform resolution of complex issues about the operation of the VTO software, preserve judicial resources, and promote efficiency. We agree with the district court that this suffices to show superiority. Finally, it warrants emphasis that class certification does not carry any permanency. The district court should remain vigilant in monitoring the propriety of certification as the case develops. For these reasons, we AFFIRM.

In the United States Court of Appeals For the Seventh Circuit ____________________ No. 25-1361 TANYA N. SVOBODA and ANTONELLA M. ORTIZ COLOSI, Plaintiffs-Appellees, v. AMAZON.COM INC. and AMAZON.COM SERVICES, LLC, Defendants-Appellants. ____________________ Appeal from the United States District Court for the Northern District of Illinois, Eastern Division. No. 1:21-cv-05336 — Jorge L. Alonso, Judge. ____________________ ARGUED SEPTEMBER 9, 2025 — DECIDED DECEMBER 17, 2025 ____________________ Before ROVNER, HAMILTON, and SCUDDER, Circuit Judges. SCUDDER, Circuit Judge. Tanya Svoboda and Antonella Ortiz Colosi used a Virtual Try-On feature through Amazon’s mobile site and app to virtually test facial products like lip- stick and eyewear. They later brought this class action against Amazon alleging that the VTO feature violates the Illinois Bi- ometric Information Privacy Act through its capture and use of their facial data. The district court certified a class of 2 No. 25-1361 Amazon VTO users within Illinois. Seeing no abuse of discre- tion, we affirm. I A Amazon’s mobile website and application offer the VTO feature to customers to virtually “try on” makeup and eye- wear products. The VTO software operates to render facial products over an image or video of a user’s face so they can see what a product will look like before making a purchase decision. Amazon used two VTO programs during the relevant pe- riod—one developed in-house and another developed by a company named ModiFace. Both programs function simi- larly. An Amazon customer shopping on a mobile device can preview a product by clicking a “try on” button on the prod- uct page. On the first VTO use, the application prompts the user to give Amazon permission to access the camera on their device. Once users grant access, they can opt to preview the product on a live video or actual photo of their face. They can also preview a product in “model mode,” which displays the product on a model’s face rather than the user’s. If users elect to preview on their own image, the VTO feature activates the camera on their device to capture their facial geometry from the live video or photo and then analyzes it to determine where to overlay the product. The VTO application sends in- formation about the product to the device, which then renders the product on the user’s image in the appropriate area. Svoboda and Colosi’s claims under the Illinois Biometric Information Privacy Act arise out of their use of Amazon’s VTO feature. Biometric identifiers such as facial data and No. 25-1361 3 fingerprints are unique to each person and unalterable. If compromised, the privacy harm cannot be mitigated by changing them. The Illinois General Assembly enacted BIPA to strengthen biometric data security. See 740 ILCS 14/5; see also Fox v. Dakkota Integrated Sys., LLC, 980 F.3d 1146, 1149–50 (7th Cir. 2020) (explaining BIPA’s history and purposes). To this end, the enactment regulates the “collection, use, safe- guarding, handling, storage, retention, and destruction of bi- ometric identifiers and information.” 740 ILCS 14/5(g). Two provisions of BIPA are relevant here. Section 15(a) re- quires private entities in possession of biometric data to de- velop, publish, and comply with a written policy that estab- lishes a data retention schedule and guidelines for destroying biometric identifiers and information. See 740 ILCS 14/15(a). Section 15(b), in turn, prohibits private entities from “col- lect[ing], captur[ing], purchas[ing], receiv[ing] through trade, or otherwise obtain[ing]” a person’s biometric data unless they first: (1) provide written notice that biometric data will be collected or stored, (2) inform the person of the length and reason for which the biometric data will be collected, stored, and used, and (3) receive a written release signed by the per- son. 740 ILCS 14/15(b). The parties agree that BIPA is not extraterritorial—any statutory violation must occur in Illinois to warrant relief. Il- linois Supreme Court precedent gives us no reason to ques- tion that proposition. See Avery v. State Farm Mut. Auto. Ins. Co., 835 N.E.2d 801, 852 (Ill. 2005) (observing that under Illi- nois law, a “statute is without extraterritorial effect unless a clear intent … appears from the express provisions of the stat- ute.” (quoting Dur-Ite Co. v. Indus. Comm’n, 68 N.E.2d 717, 722 (Ill. 1946))). 4 No. 25-1361 BIPA provides for statutory damages. “A prevailing party may recover” $1,000 for each negligent violation and $5,000 for each intentional or reckless violation. 740 ILCS 14/20(a)(1)–(2). A separate statutory violation generally ac- crues with “every scan” of biometric data. Cothron v. White Castle Sys., Inc., 216 N.E.3d 918, 929 (Ill. 2023), as modified on denial of reh’g (July 18, 2023). The statute also entitles success- ful plaintiffs to recover reasonable attorneys’ fees and costs. See 740 ILCS 14/20(a)(3). The Illinois General Assembly amended BIPA in 2024 to cap statutory damages in certain circumstances. See Act of Aug. 2, 2024, Pub. Act 103-0769, 2024 Ill. Laws 6757, 6759–60. Section 20(b) now specifies that an entity that collects the same biometric data from the same person using the same method of collection in violation of Section 15(b) only com- mits a single violation. See 740 ILCS 14/20(b). Whether this amendment ultimately may cap the damages that some class members can recover is not a question before us, as the an- swer does not affect our review of the district court’s class cer- tification decision. Tanya Svoboda alleges that she used Amazon’s VTO in Il- linois while shopping for lipstick on its mobile website in 2020. In September 2021, she filed a putative class action against Amazon in Illinois state court. Amazon removed the case to federal court under the Class Action Fairness Act. See 28 U.S.C. §§ 1332(d), 1453(b). Antonella Ortiz Colosi joined the action in an amended complaint in May 2022, alleging that she too used Amazon’s VTO for makeup products while in Illinois. Colosi testified that she used the VTO in 2019, 2020, 2021, and 2022. No. 25-1361 5 Together, Svoboda and Colosi allege that Amazon’s use of the VTO feature violated Sections 15(a) and (b) of BIPA. More specifically, Amazon allegedly collected, captured, stored, and used their own facial geometry and associated personal identifying information and that of “thousands if not mil- lions” of people who used the VTO feature in Illinois without providing notice and the required information, obtaining in- formed written consent, or creating written publicly available data retention and destruction guidelines. They seek statu- tory damages, injunctive relief, and fees and costs. B Svoboda and Colosi moved for class certification under Federal Rule of Civil Procedure 23(b)(3). The district court granted the motion and certified a class of “all individuals who used a [VTO] feature on Amazon’s mobile website or app while in Illinois on or after September 7, 2016.” The district court determined that the proposed class sat- isfied Rule 23(a)’s threshold requirements for certification. Only commonality is relevant to this appeal and, even then, only insofar as it relates to predominance under Rule 23(b)(3). The district court found that the same alleged course of con- duct unites the alleged BIPA violations: Amazon’s unlawful use of the VTO application. The court identified questions common to the class that, if answered, would resolve issues central to each claim “in one stroke.” Those questions gener- ally concern the functionality of the VTO software, Amazon’s use of the class members’ biometric data, and legal questions about whether that use violated Sections 15(a) and 15(b) of BIPA. 6 No. 25-1361 The district court also found that the class satisfied the pre- dominance and superiority requirements of Rule 23(b)(3). Af- ter identifying common questions, it acknowledged that indi- vidual inquiries might be needed to assess whether potential class members used the VTO in Illinois. But it determined that this issue was manageable enough to justify certification without violating Amazon’s due process right to challenge particular class members’ showing of a statutory violation or entitlement to a particular damages award. Nor did Ama- zon’s proposed affirmative defenses defeat predominance be- cause they either did not apply to BIPA claims or reflected common issues. The district court further determined that a class action was superior to individual litigation because individuals would be unlikely to sue on their own and common issues made class resolution efficient. The prospect of high aggre- gate or individual damages under BIPA did not alter this con- clusion because the district court observed that it retains eq- uitable discretion to reduce unconstitutionally excessive dam- ages. Amazon timely filed an interlocutory appeal challenging the district court’s class certification ruling. See 28 U.S.C. § 1292(e); Fed. R. Civ. P. 23(f). II Rule 23(a) imposes four requirements for class certifica- tion: numerosity, commonality, typicality, and adequacy of representation. See Fed. R. Civ. P. 23(a)(1)–(4). Once a class satisfies Rule 23(a), it must also fit into one of three types of class actions enumerated in Rule 23(b). The plaintiff bears the burden of showing that the proposed class satisfies Rule 23 by No. 25-1361 7 a preponderance of the evidence. See Eddlemon v. Bradley Univ., 65 F.4th 335, 338 (7th Cir. 2023). If the class meets all requirements, the district court must certify it. See id. Svoboda and Colosi sought class certification under Rule 23(b)(3), which requires that “questions of law or fact com- mon to class members predominate” over individual ques- tions and that “a class action is superior to other available methods for fairly and efficiently adjudicating the contro- versy.” Fed. R. Civ. P. 23(b)(3). Rule 23(b)(3)’s predominance requirement “builds on commonality.” Eddlemon, 65 F.4th at 338 (quoting Howard v. Cook County Sheriff's Off., 989 F.3d 587, 607 (7th Cir. 2021)); see also Amchem Prods., Inc. v. Windsor, 521 U.S. 591, 623–24 (1997) (“[T]he predominance criterion is far more demanding [than commonality].”). While commonality requires that common questions exist, predominance requires that they also pre- dominate. See Eddlemon, 65 F.4th at 338. Predominance tests whether the class is “sufficiently cohesive” to justify class ad- judication. Tyson Foods, Inc. v. Bouaphakeo, 577 U.S. 442, 453 (2016) (quoting Amchem, 521 U.S. at 623). Central to this in- quiry is whether the claims “arise from a common nucleus of operative facts and issues.” Scott v. Dart, 99 F.4th 1076, 1092 (7th Cir. 2024) (quoting Beaton v. SpeedyPC Software, 907 F.3d 1018, 1029 (7th Cir. 2018)). The Supreme Court has emphasized the rigor required in a proper predominance analysis. See Comcast Corp. v. Behrend, 569 U.S. 27, 33–34 (2013) (observing that class certification re- quires “rigorous analysis” and that “Rule 23(b)(3)’s predomi- nance criterion is even more demanding than Rule 23(a)”); see also Schroeder v. Progressive Paloverde Ins. Co., 146 F.4th 567, 573 (7th Cir. 2025) (emphasizing the same point); Eddlemon, 65 8 No. 25-1361 F.4th at 338 (same). Predominance does not entail a mechani- cal tallying of common questions against individual ques- tions. Instead, a district court must identify the elements of each claim, the proof necessary for each, the manageability of those issues at trial, and alternative procedural tools. See Schroeder, 146 F.4th at 574; Simer v. Rios, 661 F.2d 655, 672–75 (7th Cir. 1981). From there the court must scrutinize the rela- tionship between common and individual questions and as- sess their relative importance. See Tyson Foods, 577 U.S. at 453. Rule 23(b)(3) separately requires a showing of superiority. The plaintiff must demonstrate that a class action is “the most practical and efficient way to resolve the litigation.” Jacks v. DirectSat USA, LLC, 118 F.4th 888, 898 (7th Cir. 2024). The su- periority inquiry is comparative: instead of considering the cost of a class action “in a vacuum,” a court must consider its costs and benefits in light of other available methods. Mullins v. Direct Digital, LLC, 795 F.3d 654, 663–64 (7th Cir. 2015). To be sure, predominance and superiority analyses often overlap. Indeed, Rule 23(b)(3) provides a non-exhaustive list of considerations relevant to both: (A) the class members’ interests in individually controlling the prosecution or defense of sepa- rate actions; (B) the extent and nature of any litigation con- cerning the controversy already begun by or against class members; (C) the desirability or undesirability of concen- trating the litigation of the claims in the partic- ular forum; and No. 25-1361 9 (D) the likely difficulties in managing a class ac- tion. Fed. R. Civ. P. 23(b)(3)(A)–(D); see Amchem, 521 U.S. at 615 (stating that the list of factors in Rule 23(b)(3) is non-exhaus- tive). III Our review of a district court’s class certification decision is deferential. We give the district court considerable leeway to exercise its discretion unless it commits legal error or makes clearly erroneous factual findings. See Jacks, 118 F.4th at 894–95. Amazon limits its challenge to the district court’s determi- nation on predominance and superiority under Rule 23(b)(3). We take each in turn and, in the end, see no abuse of discre- tion by the district court. We begin with predominance. The district court con- cluded that six common questions about Amazon’s liability predominate over three individual questions: the locational element of a BIPA claim, affirmative defenses, and damages. A Recall that the parties start from a common point of legal agreement: class members must show that they were in Illi- nois when they used Amazon’s VTO to establish a statutory violation of BIPA. The district court primarily analyzed this location requirement as an issue of class identification and manageability. This approach was incomplete. Location is rel- evant beyond just identifying class members. For the pur- poses of this appeal, we assume it is also a requirement of a BIPA claim. As a result, the district court needed to go a step 10 No. 25-1361 further and assess whether proof of location generates an in- dividualized question of fact that predominates over common questions. See Eddlemon, 65 F.4th at 339–40 (holding that the district court abused its discretion in finding that common is- sues predominated where it failed to identify and separately analyze the elements of the claims and conducted only a scant analysis); Santiago v. City of Chicago, 19 F.4th 1010, 1016–17 (7th Cir. 2021) (holding the same where the district court failed to identify the claims or discuss their elements and other clarity issues in the record complicated appellate re- view). But this shortcoming was not fatal because the substance of the district court’s reasoning touched sufficiently on all components required for a proper predominance analysis. Remand is therefore unnecessary, as it is clear from our own review that common questions predominate. See United States v. Nonahal, 338 F.3d 668, 671 (7th Cir. 2003) (“[R]emand is un- necessary because the district court’s reasons … are appar- ent.”). Location Presents an Individual Question Sections 15(a) and (b) of BIPA both require proof that Am- azon collected, captured, obtained, or possessed biometric data. As the district court recognized, this requirement, in turn, raises two common questions that may require expert discovery on the VTO software: (1) whether the facial data used by the operation of the VTO application constitutes bio- metric identifiers or information within the meaning of BIPA and (2) whether the use of the VTO means Amazon collected, captured, obtained, or possessed it. If the answer to both ques- tions is yes, Amazon violated Section 15(a) if it failed to de- velop and publish a policy for data retention and destruction, No. 25-1361 11 with the latter inquiry itself presenting a common question. Amazon separately violated Section 15(b) if it failed to dis- close information required by Sections 15(b)(1) and (b)(2) or failed to obtain signed written releases from VTO users per Section 15(b)(3). Those statutory requirements likewise pre- sent common questions. Location—the geographic place from which a class mem- ber used the VTO—is the countervailing individual question. That observation follows from the evidence that would be used to prove location at trial. See Tyson Foods, 577 U.S. at 453 (“An individual question is one where ‘members of a pro- posed class will need to present evidence that varies from member to member….’” (quoting 2 W. Rubenstein, Newberg on Class Actions § 4:50 (5th ed. 2012))). Svoboda and Colosi proposed proving location with three sources of information: VTO user billing addresses, IP ad- dresses and geolocation data, and personal affidavits from class members in which they attest to using the VTO applica- tion within Illinois. The record developed in the district court shows that Amazon maintains VTO usage data with accom- panying billing address information associated with the user’s account and, in certain circumstances, corresponding IP address and geolocation data. If a user is signed into an Amazon account or, in the case of the ModiFace VTO, the user adds the tested product to their virtual shopping cart, Ama- zon records the IP address associated with the VTO use. A cybersecurity expert testifying for Amazon in the dis- trict court explained how IP addresses reveal (or can be ana- lyzed to yield) geolocation information associated with VTO usage. IP addresses, the expert explained, contain indicators that roughly correlate with the location of the associated 12 No. 25-1361 device. It also appears that Amazon contracts with a third- party provider to generate geolocation information, which in- cludes an approximation of the state corresponding to the IP address and to the VTO usage data. It is not clear from the record at what level of completeness Amazon captures IP ad- dresses. That fact matters because it bears on how closely the captured IP address information correlates with the location of the device using the VTO application. Based on our review of the record, what stands out is the testimony offered by an Amazon witness during a deposition. The witness stated that Amazon captures and maintains VTO usage records with full IP address information. This leads us to believe that, at least in some circumstances, reasonable findings about location in- formation will follow. What all of this means as a practical matter is that common proof of location including billing address and geolocation in- formation will be available for some claimants. But, as the dis- trict court acknowledged, individualized inquiries will be necessary for others. For example, where billing address and geolocation data point to different states, or are unavailable for an alleged VTO use, individual affidavits or other proof will be necessary to show that the claimant used the VTO in Illinois. Location Does Not Predominate Over Common Questions The district court did not abuse its discretion in finding that individualized questions connected to proof of location will not predominate over common questions related to BIPA liability. But, if we accept that BIPA requires proof of location, not all elements of liability must be resolved on a classwide basis to satisfy Rule 23. Supreme Court precedent is clear on this point. See Amgen Inc. v. Conn. Ret. Plans & Tr. Funds, 568 No. 25-1361 13 U.S. 455, 469 (2013) (“Rule 23(b)(3) … does not require a plain- tiff seeking class certification to prove that each element of her claim is susceptible to classwide proof.” (cleaned up)). We have emphasized the same on many prior occasions. See, e.g., Beaton, 907 F.3d at 1029–30 (“[Defendant] misreads Supreme Court precedent in arguing that liability with regard to all class members must be resolved in a single stroke.” (citing Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338, 350 (2011))); Bell v. PNC Bank, Nat’l Ass’n, 800 F.3d 360, 380–81 (7th Cir. 2015) (ob- serving that Rule 23 does not require a class action to resolve all liability issues and discussing cases); Suchanek v. Sturm Foods, Inc., 764 F.3d 750, 759 (7th Cir. 2014) (holding that it was an “error of law” to conclude that the individual question of causation, “as required to establish liability” in a consumer action, predominated). To the contrary, it is not uncommon for class actions to have a “final phase” for class members to submit individual- ized proof of a claim. Suchanek, 764 F.3d at 756. After proving a defendant’s actions relevant to liability, each claimant must show that those actions harmed them. See id. at 757. A phase requiring individual presentations of proof on all (or part of) an element of a claim does not defeat predominance. Stated another way, an individual question does not predominate where common questions of law and fact relevant to liability otherwise generate significant efficiencies and the individual question is manageable. See Dukes, 564 U.S. at 350 (“What matters to class certification … [is] the capacity of a class-wide proceeding to generate common answers apt to drive the res- olution of the litigation.” (cleaned up)); see, e.g., Scott, 99 F.4th at 1092–93 (holding in a class action alleging inadequate den- tal care that common questions predominated even though individualized trials would be needed to prove causation and 14 No. 25-1361 seek damages and not every class member will have suffered a denial of adequate care); Bell, 800 F.3d at 378–80 (holding the same in a class action alleging failure to pay overtime wages where each class member would need to individually prove they worked overtime and were entitled to relief) (discussing cases); Pella Corp. v. Saltzman, 606 F.3d 391, 394 (7th Cir. 2010) (holding the same in a product liability class action where each class member would need to individually prove causa- tion and damages). The district court did not abuse its discretion in conclud- ing that the same reasoning applies here. One alleged course of conduct sufficiently unites the class’s claims—Amazon’s unlawful use of the VTO feature. And the entire class will “prevail or fail in unison” on common questions related to that conduct. Amgen, 568 U.S. at 460. Some common questions require expert discovery to analyze the VTO software. None will benefit from repeated adjudication. And the potential class is estimated to be over 100,000 people. These factors point to class resolution as an efficient method of adjudica- tion. See Suchanek, 764 F.3d at 760; Scott, 99 F.4th at 1092–93. If the common questions are all answered in favor of the class, it will have established a statutory injury. Even if location is necessary for individual recovery under BIPA, it is more char- acteristic of the individual questions permitted and often iso- lated in class actions than a core liability question based on Amazon’s alleged statutory violations. The district court’s manageability analysis, though only part of predominance, is also relevant. See Rule 23(b)(3)(D); Simer, 661 F.2d at 677 (“[A]ny discussion of predominance must incorporate the concept of manageability because the is- sues for individual adjudication may be adequately managed No. 25-1361 15 with certain procedural devices.”). Our view on manageabil- ity parallels much of our reasoning on how we see class mem- bers proving the locational element. In short, the district court did not abuse its discretion in finding that the combination of billing addresses, IP and geolocation data, and affidavits make the locational element manageable. No proxy alone may suffice or be perfect to prove location. Billing addresses may be out of date. Geolocation data has a margin of error, especially for cellular data, according to Am- azon’s cybersecurity expert. But the same expert reported that even the company’s vendor’s lowest estimate of geolocation accuracy correctly resolves a cellular IP address to a city 54% of the time within a 100-kilometer radius. On this record, we cannot say the district court abused its discretion in finding that this data, combined with billing addresses and affidavits, can prove a claimant was more likely than not in Illinois when they used the VTO. See Beaton, 907 F.3d at 1030 (observing that affidavits and auditing procedures can be used to handle individualized inquiries). Amazon’s challenge to predominance fares no better as a due process argument. The company will still have the oppor- tunity to challenge class members’ individual proof of loca- tion. It can choose to challenge the reliability of the location data on the merits, contest the credibility of subgroups—such as class members for whom there is no geolocation data—or present evidence challenging particular affidavits. See id. (ex- plaining that a defendant’s due process rights are not harmed by case management tools for individual inquiries); Mullins, 795 F.3d at 669 (determining that due process does not require a “cost-effective procedure for challenging every individual claim”). But at this stage, individual questions about location 16 No. 25-1361 neither predominate nor threaten the fundamental fairness due to Amazon. See Mullins, 795 F.3d at 669 (“[A] defendant has a due process right … to present individualized defenses if those defenses affect its liability.” (citing Dukes, 564 U.S. at 365–67)). B Amazon’s affirmative defenses also convince us that the district court did not commit any error at class certification. The company raised, and the district court rejected, four com- mon law defenses as challenges to predominance—consent, failure to mitigate, estoppel, and waiver. As we understand it, Amazon’s position is that these defenses require individu- alized inquiries to determine if they apply to each class mem- ber. For example, a class member who fully understood the VTO software but chose to use it anyway, so the company’s argument goes, should not be able to recover for BIPA viola- tions under a failure to mitigate theory or other defense. Indi- vidual application of these defenses may impact individual damages calculations. Assuming that common law defenses can operate to pre- clude BIPA liability, which the parties contest and we have not decided, we see no error. Consent presents a common question because class members uniformly opt into the VTO by clicking the “try on” button. It is therefore appropriate for classwide resolution. See Gorss Motels, Inc. v. Brigadoon Fitness, Inc., 29 F.4th 839, 844 (7th Cir. 2022) (observing that prior ex- press permission may be amenable to class-wide proof when given through uniform means). Even if individual questions about the remaining defenses and damages remain, they do not defeat class certification, No. 25-1361 17 particularly where other common questions predominate. See Tyson Foods, 577 U.S. at 453–54 (concluding that when one or more common issues predominate, class certification is proper even where individual questions about affirmative de- fenses and damages exist); Arandell Corp. v. Xcel Energy Inc., 149 F.4th 883, 887 (7th Cir. 2025) (same for damages); see also Riffey v. Rauner, 910 F.3d 314, 315, 317–19 (7th Cir. 2018) (hold- ing that the district court did not abuse its discretion in deny- ing class certification where the only issue remaining, dam- ages, would require highly individualized inquiries). Here, damages, and affirmative defenses bearing on measures of harm, are ancillary to the central question—lia- bility—and can be handled at a separate phase of litigation. See 7AA Charles Alan Wright & Arthur R. Miller, Federal Prac- tice and Procedure § 1778, Westlaw (database updated Sept. 2025) (“[I]f the main issues in a case require the separate adju- dication of each class member’s individual claim or defense, a Rule 23(b)(3) action would be inappropriate.” (emphasis added)); see, e.g., Gorss Motels, 29 F.4th at 844–45 (affirming denial of class certification where liability turned on an af- firmative defense requiring individual resolution). Remem- ber, too, that the district court has the flexibility to alter certi- fication or decertify should damages become unmanageable. See Fed. R. Civ. P. 23(c)(1); Carnegie v. Household Int’l, Inc., 376 F.3d 656, 661 (7th Cir. 2004). IV In closing, we turn to Rule 23(b)(3)’s superiority require- ment. Given that key common questions related to Amazon’s liability predominate and will streamline this litigation, supe- riority is less likely to present a barrier to class certification. See Messner v. Northshore Univ. HealthSystem, 669 F.3d 802, 814 18 No. 25-1361 n.5 (7th Cir. 2012) (“There are so many common issues of law and fact relating to the issue of Northshore’s liability … that the superiority requirement likely poses no serious obstacle to class certification here.”). And we agree with the district court that the possible size of aggregate and individual dam- ages does not alter that calculus. Svoboda and Colosi seek statutory damages for each vio- lation of BIPA. They tell us that this means that each time a class member used the VTO feature, Amazon could be liable for up to another $1,000 or $5,000 depending on the nature of the violation. See 740 ILCS 14/20(a)(1)–(2), (b). Even if we credit Amazon’s contention that the aggregate damages could extend into the tens of millions of dollars, that observation is not enough to defeat superiority. BIPA reflects a permissible judgment of the Illinois General Assembly that the misuse of biometric data amounts to a privacy violation warranting the imposition of money damages. See 740 ILCS 14/5. And sanc- tions may also deter future violations. To the extent that the total damages disproportionately outweigh any proven harm, the district court can reduce the award to ensure it is not unconstitutionally punitive. See Murray v. GMAC Mortg. Corp., 434 F.3d 948, 954 (7th Cir. 2006). We recognize that high individual damages cut against the primary aim of classwide adjudication—to facilitate relief where claimants cannot or will not sue individually. See Am- chem, 521 U.S. at 616–17; Nagel v. ADM Inv. Servs., Inc., 217 F.3d 436, 443 (7th Cir. 2000); see also Fed. R. Civ. P. 23(b)(3)(A)–(B). This often occurs when the collective injury is great but individual damages are too small to incentivize any person to act alone. See Murray, 434 F.3d at 953. But Rule 23 does not bar class certification where individual damages are No. 25-1361 19 high. See Amchem, 521 U.S. at 617 (observing that “the text of Rule 23(b)(3) does not exclude from certification cases in which individual damages run high”). Other factors, including the lack of awareness of a claim, inability to access an attorney, or complex, costly discovery, can also hamper individual action regardless of the potential award. In these circumstances, a class may be a superior ve- hicle to vindicate individual injuries. See Mace v. Van Ru Credit Corp., 109 F.3d 338, 344 (7th Cir. 1997) (explaining that a plain- tiff’s awareness of their right to sue, willingness to take on the burden of litigation, and ability to find an attorney are rele- vant to superiority analysis); Suchanek, 764 F.3d at 760 (ob- serving that the district court might find that “no rational in- dividual plaintiff would be willing to bear the costs of this lawsuit” due to costly discovery including survey evidence and expert testimony); see also In re Facebook Biometric Info. Priv. Litig., 326 F.R.D. 535, 548 (N.D. Cal. 2018) (“While not trivial, BIPA’s statutory damages are not enough to incentiv- ize individual plaintiffs given the high costs of pursuing dis- covery on Facebook’s software and code base and Facebook’s willingness to litigate the case.”), aff’d sub nom. Patel v. Face- book, Inc., 932 F.3d 1264 (9th Cir. 2019). The district court did not abuse its discretion in finding that Amazon VTO users lack sufficient incentive to bring in- dividual suits. The plaintiffs reported having spent over $100,000 on expert discovery related to the VTO software. See Suchanek, 764 F.3d at 760 (observing that “[common] class is- sues often will be the most complex and costly to prove”). And the absence of any meaningful individual VTO-related BIPA litigation against Amazon to date is also telling. See Fed. R. Civ. P. 23(b)(3)(B). We see no infirmity in the district court’s 20 No. 25-1361 conclusion based on these observations that affected users may be unable or unwilling to undertake this costly litigation alone without any guarantee of recovery. Even if some individuals eventually sue, a class action may still proceed. The superiority requirement entails a bal- ancing analysis. See Mullins, 795 F.3d at 663–64. And as the district court observed, this class action will resolve virtually identical claims for potentially thousands of people. It will en- sure uniform resolution of complex issues about the operation of the VTO software, preserve judicial resources, and promote efficiency. We agree with the district court that this suffices to show superiority. Finally, it warrants emphasis that class certification does not carry any permanency. The district court should remain vigilant in monitoring the propriety of certification as the case develops. For these reasons, we AFFIRM.

In the United States Court of Appeals For the Seventh Circuit ____________________ No. 25-1361 TANYA N. SVOBODA and ANTONELLA M. ORTIZ COLOSI, Plaintiffs-Appellees, v. AMAZON.COM INC. and AMAZON.COM SERVICES, LLC, Defendants-Appellants. ____________________ Appeal from the United States District Court for the Northern District of Illinois, Eastern Division. No. 1:21-cv-05336 — Jorge L. Alonso, Judge. ____________________ ARGUED SEPTEMBER 9, 2025 — DECIDED DECEMBER 17, 2025 ____________________ Before ROVNER, HAMILTON, and SCUDDER, Circuit Judges. SCUDDER, Circuit Judge. Tanya Svoboda and Antonella Ortiz Colosi used a Virtual Try-On feature through Amazon’s mobile site and app to virtually test facial products like lip- stick and eyewear. They later brought this class action against Amazon alleging that the VTO feature violates the Illinois Bi- ometric Information Privacy Act through its capture and use of their facial data. The district court certified a class of 2 No. 25-1361 Amazon VTO users within Illinois. Seeing no abuse of discre- tion, we affirm. I A Amazon’s mobile website and application offer the VTO feature to customers to virtually “try on” makeup and eye- wear products. The VTO software operates to render facial products over an image or video of a user’s face so they can see what a product will look like before making a purchase decision. Amazon used two VTO programs during the relevant pe- riod—one developed in-house and another developed by a company named ModiFace. Both programs function simi- larly. An Amazon customer shopping on a mobile device can preview a product by clicking a “try on” button on the prod- uct page. On the first VTO use, the application prompts the user to give Amazon permission to access the camera on their device. Once users grant access, they can opt to preview the product on a live video or actual photo of their face. They can also preview a product in “model mode,” which displays the product on a model’s face rather than the user’s. If users elect to preview on their own image, the VTO feature activates the camera on their device to capture their facial geometry from the live video or photo and then analyzes it to determine where to overlay the product. The VTO application sends in- formation about the product to the device, which then renders the product on the user’s image in the appropriate area. Svoboda and Colosi’s claims under the Illinois Biometric Information Privacy Act arise out of their use of Amazon’s VTO feature. Biometric identifiers such as facial data and No. 25-1361 3 fingerprints are unique to each person and unalterable. If compromised, the privacy harm cannot be mitigated by changing them. The Illinois General Assembly enacted BIPA to strengthen biometric data security. See 740 ILCS 14/5; see also Fox v. Dakkota Integrated Sys., LLC, 980 F.3d 1146, 1149–50 (7th Cir. 2020) (explaining BIPA’s history and purposes). To this end, the enactment regulates the “collection, use, safe- guarding, handling, storage, retention, and destruction of bi- ometric identifiers and information.” 740 ILCS 14/5(g). Two provisions of BIPA are relevant here. Section 15(a) re- quires private entities in possession of biometric data to de- velop, publish, and comply with a written policy that estab- lishes a data retention schedule and guidelines for destroying biometric identifiers and information. See 740 ILCS 14/15(a). Section 15(b), in turn, prohibits private entities from “col- lect[ing], captur[ing], purchas[ing], receiv[ing] through trade, or otherwise obtain[ing]” a person’s biometric data unless they first: (1) provide written notice that biometric data will be collected or stored, (2) inform the person of the length and reason for which the biometric data will be collected, stored, and used, and (3) receive a written release signed by the per- son. 740 ILCS 14/15(b). The parties agree that BIPA is not extraterritorial—any statutory violation must occur in Illinois to warrant relief. Il- linois Supreme Court precedent gives us no reason to ques- tion that proposition. See Avery v. State Farm Mut. Auto. Ins. Co., 835 N.E.2d 801, 852 (Ill. 2005) (observing that under Illi- nois law, a “statute is without extraterritorial effect unless a clear intent … appears from the express provisions of the stat- ute.” (quoting Dur-Ite Co. v. Indus. Comm’n, 68 N.E.2d 717, 722 (Ill. 1946))). 4 No. 25-1361 BIPA provides for statutory damages. “A prevailing party may recover” $1,000 for each negligent violation and $5,000 for each intentional or reckless violation. 740 ILCS 14/20(a)(1)–(2). A separate statutory violation generally ac- crues with “every scan” of biometric data. Cothron v. White Castle Sys., Inc., 216 N.E.3d 918, 929 (Ill. 2023), as modified on denial of reh’g (July 18, 2023). The statute also entitles success- ful plaintiffs to recover reasonable attorneys’ fees and costs. See 740 ILCS 14/20(a)(3). The Illinois General Assembly amended BIPA in 2024 to cap statutory damages in certain circumstances. See Act of Aug. 2, 2024, Pub. Act 103-0769, 2024 Ill. Laws 6757, 6759–60. Section 20(b) now specifies that an entity that collects the same biometric data from the same person using the same method of collection in violation of Section 15(b) only com- mits a single violation. See 740 ILCS 14/20(b). Whether this amendment ultimately may cap the damages that some class members can recover is not a question before us, as the an- swer does not affect our review of the district court’s class cer- tification decision. Tanya Svoboda alleges that she used Amazon’s VTO in Il- linois while shopping for lipstick on its mobile website in 2020. In September 2021, she filed a putative class action against Amazon in Illinois state court. Amazon removed the case to federal court under the Class Action Fairness Act. See 28 U.S.C. §§ 1332(d), 1453(b). Antonella Ortiz Colosi joined the action in an amended complaint in May 2022, alleging that she too used Amazon’s VTO for makeup products while in Illinois. Colosi testified that she used the VTO in 2019, 2020, 2021, and 2022. No. 25-1361 5 Together, Svoboda and Colosi allege that Amazon’s use of the VTO feature violated Sections 15(a) and (b) of BIPA. More specifically, Amazon allegedly collected, captured, stored, and used their own facial geometry and associated personal identifying information and that of “thousands if not mil- lions” of people who used the VTO feature in Illinois without providing notice and the required information, obtaining in- formed written consent, or creating written publicly available data retention and destruction guidelines. They seek statu- tory damages, injunctive relief, and fees and costs. B Svoboda and Colosi moved for class certification under Federal Rule of Civil Procedure 23(b)(3). The district court granted the motion and certified a class of “all individuals who used a [VTO] feature on Amazon’s mobile website or app while in Illinois on or after September 7, 2016.” The district court determined that the proposed class sat- isfied Rule 23(a)’s threshold requirements for certification. Only commonality is relevant to this appeal and, even then, only insofar as it relates to predominance under Rule 23(b)(3). The district court found that the same alleged course of con- duct unites the alleged BIPA violations: Amazon’s unlawful use of the VTO application. The court identified questions common to the class that, if answered, would resolve issues central to each claim “in one stroke.” Those questions gener- ally concern the functionality of the VTO software, Amazon’s use of the class members’ biometric data, and legal questions about whether that use violated Sections 15(a) and 15(b) of BIPA. 6 No. 25-1361 The district court also found that the class satisfied the pre- dominance and superiority requirements of Rule 23(b)(3). Af- ter identifying common questions, it acknowledged that indi- vidual inquiries might be needed to assess whether potential class members used the VTO in Illinois. But it determined that this issue was manageable enough to justify certification without violating Amazon’s due process right to challenge particular class members’ showing of a statutory violation or entitlement to a particular damages award. Nor did Ama- zon’s proposed affirmative defenses defeat predominance be- cause they either did not apply to BIPA claims or reflected common issues. The district court further determined that a class action was superior to individual litigation because individuals would be unlikely to sue on their own and common issues made class resolution efficient. The prospect of high aggre- gate or individual damages under BIPA did not alter this con- clusion because the district court observed that it retains eq- uitable discretion to reduce unconstitutionally excessive dam- ages. Amazon timely filed an interlocutory appeal challenging the district court’s class certification ruling. See 28 U.S.C. § 1292(e); Fed. R. Civ. P. 23(f). II Rule 23(a) imposes four requirements for class certifica- tion: numerosity, commonality, typicality, and adequacy of representation. See Fed. R. Civ. P. 23(a)(1)–(4). Once a class satisfies Rule 23(a), it must also fit into one of three types of class actions enumerated in Rule 23(b). The plaintiff bears the burden of showing that the proposed class satisfies Rule 23 by No. 25-1361 7 a preponderance of the evidence. See Eddlemon v. Bradley Univ., 65 F.4th 335, 338 (7th Cir. 2023). If the class meets all requirements, the district court must certify it. See id. Svoboda and Colosi sought class certification under Rule 23(b)(3), which requires that “questions of law or fact com- mon to class members predominate” over individual ques- tions and that “a class action is superior to other available methods for fairly and efficiently adjudicating the contro- versy.” Fed. R. Civ. P. 23(b)(3). Rule 23(b)(3)’s predominance requirement “builds on commonality.” Eddlemon, 65 F.4th at 338 (quoting Howard v. Cook County Sheriff's Off., 989 F.3d 587, 607 (7th Cir. 2021)); see also Amchem Prods., Inc. v. Windsor, 521 U.S. 591, 623–24 (1997) (“[T]he predominance criterion is far more demanding [than commonality].”). While commonality requires that common questions exist, predominance requires that they also pre- dominate. See Eddlemon, 65 F.4th at 338. Predominance tests whether the class is “sufficiently cohesive” to justify class ad- judication. Tyson Foods, Inc. v. Bouaphakeo, 577 U.S. 442, 453 (2016) (quoting Amchem, 521 U.S. at 623). Central to this in- quiry is whether the claims “arise from a common nucleus of operative facts and issues.” Scott v. Dart, 99 F.4th 1076, 1092 (7th Cir. 2024) (quoting Beaton v. SpeedyPC Software, 907 F.3d 1018, 1029 (7th Cir. 2018)). The Supreme Court has emphasized the rigor required in a proper predominance analysis. See Comcast Corp. v. Behrend, 569 U.S. 27, 33–34 (2013) (observing that class certification re- quires “rigorous analysis” and that “Rule 23(b)(3)’s predomi- nance criterion is even more demanding than Rule 23(a)”); see also Schroeder v. Progressive Paloverde Ins. Co., 146 F.4th 567, 573 (7th Cir. 2025) (emphasizing the same point); Eddlemon, 65 8 No. 25-1361 F.4th at 338 (same). Predominance does not entail a mechani- cal tallying of common questions against individual ques- tions. Instead, a district court must identify the elements of each claim, the proof necessary for each, the manageability of those issues at trial, and alternative procedural tools. See Schroeder, 146 F.4th at 574; Simer v. Rios, 661 F.2d 655, 672–75 (7th Cir. 1981). From there the court must scrutinize the rela- tionship between common and individual questions and as- sess their relative importance. See Tyson Foods, 577 U.S. at 453. Rule 23(b)(3) separately requires a showing of superiority. The plaintiff must demonstrate that a class action is “the most practical and efficient way to resolve the litigation.” Jacks v. DirectSat USA, LLC, 118 F.4th 888, 898 (7th Cir. 2024). The su- periority inquiry is comparative: instead of considering the cost of a class action “in a vacuum,” a court must consider its costs and benefits in light of other available methods. Mullins v. Direct Digital, LLC, 795 F.3d 654, 663–64 (7th Cir. 2015). To be sure, predominance and superiority analyses often overlap. Indeed, Rule 23(b)(3) provides a non-exhaustive list of considerations relevant to both: (A) the class members’ interests in individually controlling the prosecution or defense of sepa- rate actions; (B) the extent and nature of any litigation con- cerning the controversy already begun by or against class members; (C) the desirability or undesirability of concen- trating the litigation of the claims in the partic- ular forum; and No. 25-1361 9 (D) the likely difficulties in managing a class ac- tion. Fed. R. Civ. P. 23(b)(3)(A)–(D); see Amchem, 521 U.S. at 615 (stating that the list of factors in Rule 23(b)(3) is non-exhaus- tive). III Our review of a district court’s class certification decision is deferential. We give the district court considerable leeway to exercise its discretion unless it commits legal error or makes clearly erroneous factual findings. See Jacks, 118 F.4th at 894–95. Amazon limits its challenge to the district court’s determi- nation on predominance and superiority under Rule 23(b)(3). We take each in turn and, in the end, see no abuse of discre- tion by the district court. We begin with predominance. The district court con- cluded that six common questions about Amazon’s liability predominate over three individual questions: the locational element of a BIPA claim, affirmative defenses, and damages. A Recall that the parties start from a common point of legal agreement: class members must show that they were in Illi- nois when they used Amazon’s VTO to establish a statutory violation of BIPA. The district court primarily analyzed this location requirement as an issue of class identification and manageability. This approach was incomplete. Location is rel- evant beyond just identifying class members. For the pur- poses of this appeal, we assume it is also a requirement of a BIPA claim. As a result, the district court needed to go a step 10 No. 25-1361 further and assess whether proof of location generates an in- dividualized question of fact that predominates over common questions. See Eddlemon, 65 F.4th at 339–40 (holding that the district court abused its discretion in finding that common is- sues predominated where it failed to identify and separately analyze the elements of the claims and conducted only a scant analysis); Santiago v. City of Chicago, 19 F.4th 1010, 1016–17 (7th Cir. 2021) (holding the same where the district court failed to identify the claims or discuss their elements and other clarity issues in the record complicated appellate re- view). But this shortcoming was not fatal because the substance of the district court’s reasoning touched sufficiently on all components required for a proper predominance analysis. Remand is therefore unnecessary, as it is clear from our own review that common questions predominate. See United States v. Nonahal, 338 F.3d 668, 671 (7th Cir. 2003) (“[R]emand is un- necessary because the district court’s reasons … are appar- ent.”). Location Presents an Individual Question Sections 15(a) and (b) of BIPA both require proof that Am- azon collected, captured, obtained, or possessed biometric data. As the district court recognized, this requirement, in turn, raises two common questions that may require expert discovery on the VTO software: (1) whether the facial data used by the operation of the VTO application constitutes bio- metric identifiers or information within the meaning of BIPA and (2) whether the use of the VTO means Amazon collected, captured, obtained, or possessed it. If the answer to both ques- tions is yes, Amazon violated Section 15(a) if it failed to de- velop and publish a policy for data retention and destruction, No. 25-1361 11 with the latter inquiry itself presenting a common question. Amazon separately violated Section 15(b) if it failed to dis- close information required by Sections 15(b)(1) and (b)(2) or failed to obtain signed written releases from VTO users per Section 15(b)(3). Those statutory requirements likewise pre- sent common questions. Location—the geographic place from which a class mem- ber used the VTO—is the countervailing individual question. That observation follows from the evidence that would be used to prove location at trial. See Tyson Foods, 577 U.S. at 453 (“An individual question is one where ‘members of a pro- posed class will need to present evidence that varies from member to member….’” (quoting 2 W. Rubenstein, Newberg on Class Actions § 4:50 (5th ed. 2012))). Svoboda and Colosi proposed proving location with three sources of information: VTO user billing addresses, IP ad- dresses and geolocation data, and personal affidavits from class members in which they attest to using the VTO applica- tion within Illinois. The record developed in the district court shows that Amazon maintains VTO usage data with accom- panying billing address information associated with the user’s account and, in certain circumstances, corresponding IP address and geolocation data. If a user is signed into an Amazon account or, in the case of the ModiFace VTO, the user adds the tested product to their virtual shopping cart, Ama- zon records the IP address associated with the VTO use. A cybersecurity expert testifying for Amazon in the dis- trict court explained how IP addresses reveal (or can be ana- lyzed to yield) geolocation information associated with VTO usage. IP addresses, the expert explained, contain indicators that roughly correlate with the location of the associated 12 No. 25-1361 device. It also appears that Amazon contracts with a third- party provider to generate geolocation information, which in- cludes an approximation of the state corresponding to the IP address and to the VTO usage data. It is not clear from the record at what level of completeness Amazon captures IP ad- dresses. That fact matters because it bears on how closely the captured IP address information correlates with the location of the device using the VTO application. Based on our review of the record, what stands out is the testimony offered by an Amazon witness during a deposition. The witness stated that Amazon captures and maintains VTO usage records with full IP address information. This leads us to believe that, at least in some circumstances, reasonable findings about location in- formation will follow. What all of this means as a practical matter is that common proof of location including billing address and geolocation in- formation will be available for some claimants. But, as the dis- trict court acknowledged, individualized inquiries will be necessary for others. For example, where billing address and geolocation data point to different states, or are unavailable for an alleged VTO use, individual affidavits or other proof will be necessary to show that the claimant used the VTO in Illinois. Location Does Not Predominate Over Common Questions The district court did not abuse its discretion in finding that individualized questions connected to proof of location will not predominate over common questions related to BIPA liability. But, if we accept that BIPA requires proof of location, not all elements of liability must be resolved on a classwide basis to satisfy Rule 23. Supreme Court precedent is clear on this point. See Amgen Inc. v. Conn. Ret. Plans & Tr. Funds, 568 No. 25-1361 13 U.S. 455, 469 (2013) (“Rule 23(b)(3) … does not require a plain- tiff seeking class certification to prove that each element of her claim is susceptible to classwide proof.” (cleaned up)). We have emphasized the same on many prior occasions. See, e.g., Beaton, 907 F.3d at 1029–30 (“[Defendant] misreads Supreme Court precedent in arguing that liability with regard to all class members must be resolved in a single stroke.” (citing Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338, 350 (2011))); Bell v. PNC Bank, Nat’l Ass’n, 800 F.3d 360, 380–81 (7th Cir. 2015) (ob- serving that Rule 23 does not require a class action to resolve all liability issues and discussing cases); Suchanek v. Sturm Foods, Inc., 764 F.3d 750, 759 (7th Cir. 2014) (holding that it was an “error of law” to conclude that the individual question of causation, “as required to establish liability” in a consumer action, predominated). To the contrary, it is not uncommon for class actions to have a “final phase” for class members to submit individual- ized proof of a claim. Suchanek, 764 F.3d at 756. After proving a defendant’s actions relevant to liability, each claimant must show that those actions harmed them. See id. at 757. A phase requiring individual presentations of proof on all (or part of) an element of a claim does not defeat predominance. Stated another way, an individual question does not predominate where common questions of law and fact relevant to liability otherwise generate significant efficiencies and the individual question is manageable. See Dukes, 564 U.S. at 350 (“What matters to class certification … [is] the capacity of a class-wide proceeding to generate common answers apt to drive the res- olution of the litigation.” (cleaned up)); see, e.g., Scott, 99 F.4th at 1092–93 (holding in a class action alleging inadequate den- tal care that common questions predominated even though individualized trials would be needed to prove causation and 14 No. 25-1361 seek damages and not every class member will have suffered a denial of adequate care); Bell, 800 F.3d at 378–80 (holding the same in a class action alleging failure to pay overtime wages where each class member would need to individually prove they worked overtime and were entitled to relief) (discussing cases); Pella Corp. v. Saltzman, 606 F.3d 391, 394 (7th Cir. 2010) (holding the same in a product liability class action where each class member would need to individually prove causa- tion and damages). The district court did not abuse its discretion in conclud- ing that the same reasoning applies here. One alleged course of conduct sufficiently unites the class’s claims—Amazon’s unlawful use of the VTO feature. And the entire class will “prevail or fail in unison” on common questions related to that conduct. Amgen, 568 U.S. at 460. Some common questions require expert discovery to analyze the VTO software. None will benefit from repeated adjudication. And the potential class is estimated to be over 100,000 people. These factors point to class resolution as an efficient method of adjudica- tion. See Suchanek, 764 F.3d at 760; Scott, 99 F.4th at 1092–93. If the common questions are all answered in favor of the class, it will have established a statutory injury. Even if location is necessary for individual recovery under BIPA, it is more char- acteristic of the individual questions permitted and often iso- lated in class actions than a core liability question based on Amazon’s alleged statutory violations. The district court’s manageability analysis, though only part of predominance, is also relevant. See Rule 23(b)(3)(D); Simer, 661 F.2d at 677 (“[A]ny discussion of predominance must incorporate the concept of manageability because the is- sues for individual adjudication may be adequately managed No. 25-1361 15 with certain procedural devices.”). Our view on manageabil- ity parallels much of our reasoning on how we see class mem- bers proving the locational element. In short, the district court did not abuse its discretion in finding that the combination of billing addresses, IP and geolocation data, and affidavits make the locational element manageable. No proxy alone may suffice or be perfect to prove location. Billing addresses may be out of date. Geolocation data has a margin of error, especially for cellular data, according to Am- azon’s cybersecurity expert. But the same expert reported that even the company’s vendor’s lowest estimate of geolocation accuracy correctly resolves a cellular IP address to a city 54% of the time within a 100-kilometer radius. On this record, we cannot say the district court abused its discretion in finding that this data, combined with billing addresses and affidavits, can prove a claimant was more likely than not in Illinois when they used the VTO. See Beaton, 907 F.3d at 1030 (observing that affidavits and auditing procedures can be used to handle individualized inquiries). Amazon’s challenge to predominance fares no better as a due process argument. The company will still have the oppor- tunity to challenge class members’ individual proof of loca- tion. It can choose to challenge the reliability of the location data on the merits, contest the credibility of subgroups—such as class members for whom there is no geolocation data—or present evidence challenging particular affidavits. See id. (ex- plaining that a defendant’s due process rights are not harmed by case management tools for individual inquiries); Mullins, 795 F.3d at 669 (determining that due process does not require a “cost-effective procedure for challenging every individual claim”). But at this stage, individual questions about location 16 No. 25-1361 neither predominate nor threaten the fundamental fairness due to Amazon. See Mullins, 795 F.3d at 669 (“[A] defendant has a due process right … to present individualized defenses if those defenses affect its liability.” (citing Dukes, 564 U.S. at 365–67)). B Amazon’s affirmative defenses also convince us that the district court did not commit any error at class certification. The company raised, and the district court rejected, four com- mon law defenses as challenges to predominance—consent, failure to mitigate, estoppel, and waiver. As we understand it, Amazon’s position is that these defenses require individu- alized inquiries to determine if they apply to each class mem- ber. For example, a class member who fully understood the VTO software but chose to use it anyway, so the company’s argument goes, should not be able to recover for BIPA viola- tions under a failure to mitigate theory or other defense. Indi- vidual application of these defenses may impact individual damages calculations. Assuming that common law defenses can operate to pre- clude BIPA liability, which the parties contest and we have not decided, we see no error. Consent presents a common question because class members uniformly opt into the VTO by clicking the “try on” button. It is therefore appropriate for classwide resolution. See Gorss Motels, Inc. v. Brigadoon Fitness, Inc., 29 F.4th 839, 844 (7th Cir. 2022) (observing that prior ex- press permission may be amenable to class-wide proof when given through uniform means). Even if individual questions about the remaining defenses and damages remain, they do not defeat class certification, No. 25-1361 17 particularly where other common questions predominate. See Tyson Foods, 577 U.S. at 453–54 (concluding that when one or more common issues predominate, class certification is proper even where individual questions about affirmative de- fenses and damages exist); Arandell Corp. v. Xcel Energy Inc., 149 F.4th 883, 887 (7th Cir. 2025) (same for damages); see also Riffey v. Rauner, 910 F.3d 314, 315, 317–19 (7th Cir. 2018) (hold- ing that the district court did not abuse its discretion in deny- ing class certification where the only issue remaining, dam- ages, would require highly individualized inquiries). Here, damages, and affirmative defenses bearing on measures of harm, are ancillary to the central question—lia- bility—and can be handled at a separate phase of litigation. See 7AA Charles Alan Wright & Arthur R. Miller, Federal Prac- tice and Procedure § 1778, Westlaw (database updated Sept. 2025) (“[I]f the main issues in a case require the separate adju- dication of each class member’s individual claim or defense, a Rule 23(b)(3) action would be inappropriate.” (emphasis added)); see, e.g., Gorss Motels, 29 F.4th at 844–45 (affirming denial of class certification where liability turned on an af- firmative defense requiring individual resolution). Remem- ber, too, that the district court has the flexibility to alter certi- fication or decertify should damages become unmanageable. See Fed. R. Civ. P. 23(c)(1); Carnegie v. Household Int’l, Inc., 376 F.3d 656, 661 (7th Cir. 2004). IV In closing, we turn to Rule 23(b)(3)’s superiority require- ment. Given that key common questions related to Amazon’s liability predominate and will streamline this litigation, supe- riority is less likely to present a barrier to class certification. See Messner v. Northshore Univ. HealthSystem, 669 F.3d 802, 814 18 No. 25-1361 n.5 (7th Cir. 2012) (“There are so many common issues of law and fact relating to the issue of Northshore’s liability … that the superiority requirement likely poses no serious obstacle to class certification here.”). And we agree with the district court that the possible size of aggregate and individual dam- ages does not alter that calculus. Svoboda and Colosi seek statutory damages for each vio- lation of BIPA. They tell us that this means that each time a class member used the VTO feature, Amazon could be liable for up to another $1,000 or $5,000 depending on the nature of the violation. See 740 ILCS 14/20(a)(1)–(2), (b). Even if we credit Amazon’s contention that the aggregate damages could extend into the tens of millions of dollars, that observation is not enough to defeat superiority. BIPA reflects a permissible judgment of the Illinois General Assembly that the misuse of biometric data amounts to a privacy violation warranting the imposition of money damages. See 740 ILCS 14/5. And sanc- tions may also deter future violations. To the extent that the total damages disproportionately outweigh any proven harm, the district court can reduce the award to ensure it is not unconstitutionally punitive. See Murray v. GMAC Mortg. Corp., 434 F.3d 948, 954 (7th Cir. 2006). We recognize that high individual damages cut against the primary aim of classwide adjudication—to facilitate relief where claimants cannot or will not sue individually. See Am- chem, 521 U.S. at 616–17; Nagel v. ADM Inv. Servs., Inc., 217 F.3d 436, 443 (7th Cir. 2000); see also Fed. R. Civ. P. 23(b)(3)(A)–(B). This often occurs when the collective injury is great but individual damages are too small to incentivize any person to act alone. See Murray, 434 F.3d at 953. But Rule 23 does not bar class certification where individual damages are No. 25-1361 19 high. See Amchem, 521 U.S. at 617 (observing that “the text of Rule 23(b)(3) does not exclude from certification cases in which individual damages run high”). Other factors, including the lack of awareness of a claim, inability to access an attorney, or complex, costly discovery, can also hamper individual action regardless of the potential award. In these circumstances, a class may be a superior ve- hicle to vindicate individual injuries. See Mace v. Van Ru Credit Corp., 109 F.3d 338, 344 (7th Cir. 1997) (explaining that a plain- tiff’s awareness of their right to sue, willingness to take on the burden of litigation, and ability to find an attorney are rele- vant to superiority analysis); Suchanek, 764 F.3d at 760 (ob- serving that the district court might find that “no rational in- dividual plaintiff would be willing to bear the costs of this lawsuit” due to costly discovery including survey evidence and expert testimony); see also In re Facebook Biometric Info. Priv. Litig., 326 F.R.D. 535, 548 (N.D. Cal. 2018) (“While not trivial, BIPA’s statutory damages are not enough to incentiv- ize individual plaintiffs given the high costs of pursuing dis- covery on Facebook’s software and code base and Facebook’s willingness to litigate the case.”), aff’d sub nom. Patel v. Face- book, Inc., 932 F.3d 1264 (9th Cir. 2019). The district court did not abuse its discretion in finding that Amazon VTO users lack sufficient incentive to bring in- dividual suits. The plaintiffs reported having spent over $100,000 on expert discovery related to the VTO software. See Suchanek, 764 F.3d at 760 (observing that “[common] class is- sues often will be the most complex and costly to prove”). And the absence of any meaningful individual VTO-related BIPA litigation against Amazon to date is also telling. See Fed. R. Civ. P. 23(b)(3)(B). We see no infirmity in the district court’s 20 No. 25-1361 conclusion based on these observations that affected users may be unable or unwilling to undertake this costly litigation alone without any guarantee of recovery. Even if some individuals eventually sue, a class action may still proceed. The superiority requirement entails a bal- ancing analysis. See Mullins, 795 F.3d at 663–64. And as the district court observed, this class action will resolve virtually identical claims for potentially thousands of people. It will en- sure uniform resolution of complex issues about the operation of the VTO software, preserve judicial resources, and promote efficiency. We agree with the district court that this suffices to show superiority. Finally, it warrants emphasis that class certification does not carry any permanency. The district court should remain vigilant in monitoring the propriety of certification as the case develops. For these reasons, we AFFIRM.