Privacy Law

Facebook must face class action over facial recognition, judge rules

  • Print.

1 Hacker Way

Facebook’s headquarters in Menlo Park, California. Nick Fox /

Illinois Facebook users may sue the social media giant for collecting their facial recognition information, a federal judge ruled this week.

The lawsuit challenges Facebook under the Illinois Biometric Information Privacy Act, which was passed in 2008 to prohibit private companies from collecting some kinds of biometric identifiers, including scans of facial geometry, without obtaining people’s written consent.

U.S. District Judge James Donato of the Northern District of California certified a class in the privacy lawsuit. Donato also rejected Facebook’s concerns that class certification would enable the plaintiffs to seek an unreasonable amount of damages. According to an article in The Recorder, BIPA sets statutory damages of $1,000 for each negligent violation, and $5,000 for those that are “intentional and reckless.” Courthouse News Service also has a story on the ruling.

According to the suit, the plaintiffs allege Facebook “collects and stores their biometric data without prior notice or consent” through its Tag Suggestions tool—a feature launched in 2011 that allows users to identify friends in pictures uploaded to the social media site.

In Monday’s decision, Donato found that not all photos uploaded to Facebook resulted in the collection of biometric data. The judge rejected a proposed class of all Illinois residents with an uploaded photo during the class period as “too amorphous and potentially over-inclusive to be certified.”

Donato certified a more narrowly defined class: Facebook users in Illinois who had their facial data analyzed and collected by Facebook after June 7, 2011.

The judge noted that Facebook’s lawyers at Mayer Brown placed “greatest emphasis on their argument that about the meaning of ‘aggrieved,’ ” citing Rosenbach v. Six Flags Entertainment, a decision last December from the Second District Appellate Court of Illinois that said plaintiffs must contend “actual harm” to get the Illinois Biometric Information Privacy Act claims to stick. But Donato ruled “Rosenbach does not bear the heavy weight Facebook seeks to place on it.”

Donato previously rejected Facebook’s motion to dismiss the suit, finding BIPA left “little question that the Illinois legislature codified a right of privacy in personal biometric information.”

The Illinois law has led to other lawsuits, including would-be class actions against Google and Shutterfly. The Facebook suit is set to go to trial in July.

Give us feedback, share a story tip or update, or report an error.