Facebook To Face Lawsuit Over Facial Recognition Software

A U.S. court has rejected Facebook Inc.’s (NASDAQ: FB) effort to undo a class action lawsuit over the company’s face recognition technology. Facebook users in Illinois have accused the social media company of violating the state’s Biometric Information Privacy Act, passed in 2008, by illegally collecting and storing biometric data for millions of users without their consent. The 9th Circuit U.S. Court of Appeals has now returned the case to U.S. District Judge James Donato in San Francisco, who had certified a class action in April 2018, for a possible trial.

In 2011, Facebook launched a feature called “tag suggestions” to analyze the details of people’s faces in uploaded photos. The technology was used to identify people by their specific facial features, such as the distance between their eyes, their nose, and the shape of their chin. Illinois users launched the lawsuit against the company in 2015 over the use of the technology.

In a 3-0 decision, the 9th U.S. Circuit Court of Appeals ruled that Facebook’s technology “invades an individual’s private affairs and concrete interests.” Writing for the appeals court, Circuit Judge Sandra Ikuta said, “Once a face template of an individual is created, Facebook can use it to identify that individual in any of the other hundreds of millions of photos uploaded to Facebook each day, as well as determine when the individual was present at a specific location.”

Facebook had argued that its collection of biometric data, which are stored on servers in states that include Oregon, Iowa, Texas, and California, happened outside of Illinois and outside of the privacy law’s purview. The appeals panel rejected that argument. Facebook now plans to ask the full circuit court to review the decision.

The decision exposes the company to billions of dollars in potential damages to the Illinois users who brought the case. Illinois’ biometric privacy law provides for damages of $1,000 for each negligent violation and $5,000 for each intentional or reckless violation. The class action case could include as many as 7 million Facebook users.