In a lawsuit filed last week in the U.S. District Court for the Southern District of New York, a lawyer for an 18-year-old New Yorker alleges he was misidentified in a string of Apple store thefts. The suit alleges, among other things, that Apple uses facial recognition technology in its stores.

That practice, while denied by Apple, isn’t widely regulated in the U.S. Still, the few state-level biometrics laws that do exist, especially Illinois, should be monitored closely by businesses because of the risks they could pose.