The U.S. District Court for the Northern District of California recently ruled that a certified class action on behalf of Illinois Facebook users alleging that the social network unlawfully collects biometric data from photo tagging will go forward, denying both parties’ summary judgment motions. This case is one of the first major tests of the scope of Illinois’s Biometric Information Privacy Act (BIPA).1 The litigation was originally filed in 2015, in response to Facebook’s launch of its “Tag Suggestions” feature, which used facial recognition algorithms to deliver suggested names for individuals in photos. Specifically, Facebook’s Tag Suggestions feature matched photos of an individual against other photos the individual was tagged in to suggest the name of the individual in the photo.
Illinois’s BIPA is one of only three state biometric privacy statutes on the books in the U.S., and the only one that allows for a private right of action.2 BIPA, generally speaking, prohibits an entity from collecting, capturing, purchasing, or otherwise obtaining a person’s biometric information unless it satisfies certain notice, consent, and data retention requirements. For example, entities must notify the person that their biometric information is being collected and stored; state the purpose for collecting, storing, and using the biometric information; and state the length of time the biometric information will be retained. The entity must also obtain written consent from the individual before it obtains the biometric information. Biometric information is defined as a retina or iris scan, fingerprint, voiceprint, or scan of face geometry. BIPA authorizes damages of $1,000 per violation for negligent violations of the law, and $5,000 per violation for intentional or reckless violations. Damages in the Facebook case could amount to billions.
In his ruling, District Judge James Donato noted that there are a number of factual disputes that bar judgment as a matter of law for either side, particularly with regard to Facebook’s actual face-scanning practices. BIPA defines “face geometry” as a type of biometric information, and the case will turn on whether Facebook is indeed collecting and storing scans of “face geometry” of its users. The plaintiffs allege that the technology collects scans of face geometry because it uses human facial regions to recognize images of faces. Facebook contends to the contrary that its technology does not use human facial regions to deliver suggested names.
Facebook also argued that BIPA only applies to “live” scans of people’s faces, while Facebook created scans only from photographs. The court dismissed this argument, stating that three other federal courts have considered and rejected this same conclusion. The court also expressly rejected the notion that the plaintiffs must prove actual injury, beyond the invasion of the privacy rights afforded by BIPA. He emphasized that BIPA requires only a demonstration of a violation of the act itself, such as failing to provide notice and obtain consent before collecting and storing biometric information, to establish an invasion of privacy that is actionable.
The case will not yet proceed to trial, however. The U.S. Court of Appeals for the Ninth Circuit has agreed to hear an appeal of Judge Donato’s April 2018 decision to certify a class of Illinois users for whom Facebook created and stored facial recognition algorithms. Meanwhile, Facebook continues to push its facial recognition features, rolling out new tools in the European Union after deactivating the technology there six years ago. Facebook also continues to apply for various patents which demonstrate how the social network could use facial recognition in the real world. This persistent commitment to developing facial recognition technologies underscores the importance of this feature to the company’s business—and indeed to the advance of commercial technology writ large. It remains to be seen how the regulatory landscape adapts to this changing industry.
1 740 Ill. Comp. Stat. 14/1.
2 The other two states are Texas (Tex. Bus. & Comm. Code Ann. §503.001) and Washington (Wash. Rev. Code § 19.001).
