Facebook could face billions of dollars in fines after a federal judge ruled that the company must face a class action lawsuit. The lawsuit alleges that Facebook’s facial recognition features violate Illinois law by storing biometric data without user consent.
The lawsuit involves Facebook’s Tag Suggestions tool, which identifies users in uploaded photos and suggests automatic tagging of your friends. The feature was launched on June 7th, 2011. According to the suit, the complainants allege that Facebook “collects and stores their biometric data without prior notice or consent in violation of their privacy rights.” Illinois’ Biometric Information Privacy Act (BIPA) requires explicit consent before companies can collect biometric data like fingerprints or facial recognition profiles.
It should be noted that Facebook has since also added a more direct notification alerting users to its facial recognition features, but this lawsuit is based on the earlier collection of user data. With the order, millions of the social network’s users could collectively sue the company, with violations of BIPA incurring a fine of between $1,000 to $5,000 each time someone’s image is used without permission.
In the court order, Judge James Donato wrote:
“A class action is clearly superior to individual proceedings here. While not trivial, BIPA’s statutory damages are not enough to incentivize individual plaintiffs given the high costs of pursuing discovery on Facebook’s software and code base and Facebook’s willingness to litigate the case...Facebook seems to believe that a class action is not superior because statutory damages could amount to billions of dollars.”
The Tag Suggestion feature works in four steps: software tries to detect the faces in uploaded photos. Once detected, Facebook computes a “face signature” — a series of numbers that “represents a particular image of a face” based on your photo — and a “face template” database that the system uses to search face signatures for a match. If the face signature matches, Facebook then suggests the tag. Facebook doesn’t store face signatures and only keeps face templates.
Facebook says its automatic tagging feature detects 90 percent of faces in photos. The lawsuit claims about 76 percent of faces in the photos have face signatures computed. Tag suggestions are available in limited markets. It is primarily offered for users in the US with the option to turn the feature off.
A lawyer for Facebook users, Shawn Williams, told Bloomberg:
“As more people become aware of the scope of Facebook’s data collection and as consequences begin to attach to that data collection, whether economic or regulatory, Facebook will have to take a long look at its privacy practices and make changes consistent with user expectations and regulatory requirements,” he said.
Facebook also launched a new feature back in December that notifies users when someone uploads a photo of them, even if they’re not tagged. In a statement to Reuters, Facebook said, “We continue to believe the case has no merit and will defend ourselves vigorously.”
The Verge has reached out to Facebook for further comment.