Theme park operator Six Flags has agreed to pay a $36 million settlement over a class-action lawsuit in which the Illinois Supreme Court ultimately ruled against the company’s practice of scanning fingerprints when customers enter amusement parks. The theme park operator has allegedly been collecting the biometric data, violating the Biometric Information Privacy Act (BIPA). The BIPA was passed in 2008 and regulated how companies are able to collect and use individual’s biometric data. The BIPA mandates that a company must obtain written consent before acquiring and storing this type of sensitive data, including fingerprints, voiceprints, face scans, retina or iris scans, and hand geometry.

The case involved Stacy Rosenbach, a mother who sued Six Flags Entertainment Corporation in 2016 after visiting the Gurnee, Illinois, branch of the theme park and finding that the establishment scanned the fingerprint of her 14-year-old son without obtaining written consent and disclosing the company’s business practices as to how they would utilize the data. After the case passed through lower courts, it eventually reached the Illinois Supreme Court, where the body determined the settlement amount and that the company was in violation of the BIPA, despite its assertion that Rosenbach was not an aggrieved party due to the fact that there were no injuries involved as a result of the biometric data collection process.

Read More: Six Flags to Pay $36M Over Collection of Fingerprints