Facebook has lost a bid to escape a class action lawsuit over its photo tagging technology as a judge ruled it can be sued under an Illinois law that protects biometric privacy.
The technology uses facial recognition software to scan photographs that have been uploaded onto Facebook, creating “faceprints” of those depicted in the photos that it then uses to automatically tag them when they appear in other uploaded photos.
Three Facebook users sued for class-action damages, alleging the technology violates Illinois’ Biometric Information Privacy Act (BIPA) in a case that, according to Fortune, is “one of the first to test the boundaries of how companies use facial recognition software.” The law bars the collection and storage of an individual’s biometric identifiers, including “face geometry,” without the person’s explicit consent.
In a ruling Thursday, U.S. District Judge James Donato in San Francisco denied Facebook’s motion to dismiss the case, rejecting the social media giant’s argument that BIPA does not apply to the collection of biometric data from photos.
“Plaintiffs allege that Facebook scans user-uploaded photographs to create a ‘unique digital representation of the face … based on geometric relationship of their facial features,” he said. “That allegation falls within the scan of face geometry stated in the statute.”
While the case is still at an early stage, The Verge said it could have “major implications for both Facebook and the [social media] industry at large. Facebook’s photo-tagging system is one of its core products, and one that has already been copied by competitors like Twitter and Google Photos.”
Google is facing a similar lawsuit alleging the photo-tagging system in Google Photos violates the same Illinois law.
Facebook discloses its photo-tagging system in its data policy and users can opt out of it but the class-action plaintiffs alleged the company did not “properly inform [them] in writing that their biometric identifiers (face geometry) were being generated, collected or stored.”
“The Court accepts as true plaintiffs’ allegations that Facebook’s face recognition technology involves a scan of face geometry that was done without plaintiffs’ consent,” Judge Donato concluded.