If you sell online and you are thinking about adding a virtual try-on plugin to your site this fall, pay attention to what just happened to two of the biggest names in fast fashion. Zalando and Zara have both rolled out AI-powered virtual try-on tools designed to cut down on returns, letting shoppers upload photos to generate a digital body double before they buy. It sounds like a pure win: fewer wrong-size returns, less waste, happier customers. But the legal history of this exact technology tells a more complicated story, and it is one every independent designer using or considering similar tools needs to understand before they flip the switch.
The claim
Bloomberg's reporting describes the mechanics plainly. A reporter testing the tool for a major retailer uploaded a series of photos to a retailer's mobile app to create a digital version of her body and try on jeans without leaving her apartment, though the resulting figure looked bigger than expected, prompting a second attempt in only underwear that produced a more familiar silhouette. The underlying business problem is real: shoppers who are unsure which size to order often choose two pairs or more and send back what doesn't fit, a habit that costs the apparel industry billions of dollars each year in logistics fees and waste. That is the pitch. What the coverage does not dwell on is what happens to the biometric data those photos generate, and that is where the legal exposure starts.
Why it matters
Virtual try-on technology has already produced a steady stream of litigation, almost all of it under state biometric privacy statutes, chiefly the Illinois Biometric Information Privacy Act. The pattern is consistent across brands. A recent complaint against M.A.C. Cosmetics, filed in Cook County under the name Javid v. M.A.C. Cosmetics, claims the brand failed to comply with requirements under Illinois' Biometric Information Privacy Act, after a customer's facial geometry was scanned without written consent and without being informed of how her data would be collected, used, or retained. That case is not an outlier. The lawsuit adds to a growing wave of BIPA litigation targeting beauty and retail brands that use virtual try-on technology, and in February 2025 Charlotte Tilbury agreed to a $2.925 million settlement to resolve similar claims, while Estée Lauder, L'Oréal, and Decorté have also faced challenges in Illinois courts. Courts have shown little appetite for letting these cases die on procedural grounds. In December 2025, the Seventh Circuit Court of Appeals ruled that consumers can move forward with a class action lawsuit over claims that Amazon violated the Illinois biometric privacy law by allegedly collecting and storing facial recognition data of people who used virtual try-on technology. For an independent designer, the takeaway is not that virtual try-on is illegal. It is that the moment you collect a customer's face or body image through a plugin, an app, or an embedded widget, you may be a data collector under a state statute you have never read, regardless of whether you built the technology yourself or licensed it from a vendor. Vendor contracts rarely make you whole if the vendor's tool turns out to be non-compliant. You can still be named.
What to watch
Watch whether Zalando and Zara disclose, anywhere in their onboarding flow, what happens to the photos customers upload and how long that data is retained. That disclosure, or its absence, will likely become Exhibit A the next time a plaintiff's firm goes looking for a target. If you run a small label and you're evaluating a try-on tool from a Shopify app store or a similar third-party vendor, ask directly whether the vendor is BIPA-compliant, where the images are processed and stored, and whether you retain any liability as the merchant of record. Illinois is not the only state with a biometric privacy statute, and more are likely to follow now that appellate courts are affirming that these claims can proceed to trial. None of this is settled law, and I would not tell you otherwise. But the direction of travel is clear: convenience features that touch a customer's face or body are being treated by courts as biometric data collection, full stop, and the industry has not caught up.