On Monday, the Federal Trade Commission (FTC) announced a settlement with Everalbum, Inc., the California-based developer of a photo app called “Ever,” with regard to allegations that the company deceived consumers about the use of its facial recognition technology and its data retention practices.

The Ever app allowed users to store and organize photos and videos uploaded from their mobile devices, computers, and social media accounts. In February 2017, the app launched a new “Friends” feature that used facial recognition technology, which allowed users to “tag” individuals appearing in the photos and group together similarly tagged photos. However, although Everalbum represented that it would not apply this facial recognition technology without users’ express consent, the FTC found that this feature was automatically activated for most Ever app users, and could not be turned off. Those users residing in Illinois, Texas, Washington, and the EU– currently, the only jurisdictions with laws related to biometric identifiers– could choose to turn on the facial recognition feature.

Moreover, unbeknownst to users, the facial images extracted from the app were combined with facial images obtained from publicly available sources to create datasets used to develop facial recognition services sold to Paravision, a company specializing in security and AI technology. The FTC also alleged that while Everalbum had promised to delete the stored photos and videos of users who had deactivated their accounts, that it failed to do so, and instead retained the content indefinitely.

The settlement requires Everalbum (who shutdown the Ever app back in August 2020) to: (i) delete the photos and videos of deactivated accounts; (ii) destroy any facial recognition data, models, or algorithms derived from the users’ photos or videos; and (iii) obtain affirmative consent for any use of the biometric data collected from its facial recognition technology. Everalbum is also prohibited from misrepresenting how it collects, uses, discloses, maintains, or deletes personal information. In response to the settlement, Paravision has stated that it is committed to utilizing its facial recognition services in an ethical manner and that the most recent model does not use any of the Ever app’s user data.

Commissioner Rohit Chopra issued a statement along with the settlement, reiterating the notion that facial recognition technology is “fundamentally flawed and reinforces harmful biases” and highlighting the importance of policing its use. He also calls the FTC’s inability to seek a monetary penalty in a first egregious offense “unfortunate” and makes a plea for the FTC, the states, and regulators around the globe to enact laws restricting the use of facial recognition and biometric identifier technologies, and to vigorously pursue enforcement actions against transgressors.