In November 2021, Facebook agreed to pay $725 million to settle a class action lawsuit over its use of facial recognition technology in Illinois. The settlement marked one of the largest payouts over privacy concerns resulting from the use of biometric data. But is this settlement actually real and will Facebook users see any of this money? Let’s take a closer look.
Background on the Lawsuit
The lawsuit originated in 2015, when Illinois Facebook users accused the social media giant of violating the state’s Biometric Information Privacy Act (BIPA). The law requires companies to obtain consent before harvesting consumers’ data, including faceprints.
Plaintiffs alleged that Facebook’s “Tag Suggestions” tool, which uses facial recognition to match people in photos, exposes users to potential privacy violations without their consent. When the lawsuit was first filed, Tag Suggestions was an opt-out feature, meaning it was enabled by default. Users had to actively go into their settings to disable it.
The lawsuit sought financial damages for potentially millions of Illinois Facebook users under BIPA. In January 2020, a federal appeals court ruled that violations of the law allowed for monetary damages. This paved the way for a class action settlement.
Details of the Settlement
In 2021, Facebook agreed to pay $650 million to eligible Illinois users as compensation. Here are some key details about the settlement:
- It applies to Illinois Facebook users who appeared in photos on the platform between June 7, 2011 and November 17, 2021.
- Eligible users will receive between $200-400 each.
- An additional $100 million was set aside for administrative costs and legal fees.
- Facebook also had to turn “off” its Face Recognition feature and delete existing faceprints for settlement class members.
Who Qualifies for Payment?
To qualify for payment, class members had to meet all of the following criteria:
- Be an Illinois resident who appeared in at least one photo that was uploaded to Facebook from within the state between June 7, 2011 and November 17, 2021.
- Had their biometric identifiers (faceprints) created and stored by Facebook during that same timeframe.
- Were not Facebook employees or contractors involved in implementing the Tag Suggestions feature.
Based on available data from Facebook, it’s estimated around 1.5 million Illinois residents may be eligible for a slice of the settlement money.
Claim Filing Process
A settlement website and claim form was created for Illinois Facebook users to submit requests for payment. The deadline to file was initially set for November 23, 2022.
To file a claim, users had to provide their full name, current city/state, email or phone number associated with their Facebook account, and a declaration stating they appeared in at least one photo on Facebook between 2011-2021.
No proof or documentation was required beyond certifying via the claim form that the individual met the class criteria.
Settlement Payout Amounts
The settlement administrators will divide the $650 million among all eligible claimants. Payout amounts to individual class members will depend on how many claims are approved:
| Number of Valid Claims | Estimated Payment Amount |
| 1,400,000 | $300 |
| 1,200,000 | $340 |
| 1,100,000 | $377 |
| 1,000,000 | $425 |
| 900,000 | $472 |
Given that initial estimates were around 1.5 million potential class members, payments will likely fall in the $300-400 range for those who submitted valid claims.
Reactions to Settlement Amounts
Many reacted to the settlement amounts as being insufficient relative to the privacy violations in question. At a few hundred dollars per person, some saw it as a slap on the wrist for a company of Facebook’s size and profits.
But proponents argue the settlement is one of the largest ever for a privacy class action and will prompt companies to take biometric consent more seriously. The $650 million is over 10 times more than the previous highest BIPA settlement by a tech company (TikTok paid $92 million).
Important Dates
Here is a timeline of important events related to the case and when settlement payments may go out:
- May 2015 – Lawsuit originally filed
- January 2020 – Appeals court rules in favor of class action status
- February 2021 – Facebook agrees to settlement
- July 2021 – Settlement preliminarily approved
- November 2022 – Claim filing deadline
- January 2023 – Final approval hearing
- Mid-2023 – Payments expected to be issued if approved
The final approval hearing took place on January 31, 2023 before the U.S. District Court for the Northern District of California. This was one of the final steps before payments can go out.
Assuming the settlement gets final sign-off from the judge, payments are estimated to be mailed or electronically sent to class members sometime in mid-2023.
Why Facebook Agreed to Settle
For a company that earned over $118 billion in revenue in 2021, $650 million is miniscule in scale. So why did Facebook agree to this settlement?
There are a few key reasons the tech giant likely decided to settle:
- Avoid Further Litigation Costs – Experts estimated Facebook may have spent $10 million or more per month on its legal defense. Settling saved further expenses.
- Mitigate Financial Risks – If the case went to trial and Facebook lost, BIPA allows for civil penalties of $5,000 per violation. With millions of users impacted, penalties could have exceeded billions.
- Reduce Public Scrutiny – News coverage of the lawsuit kept Facebook’s data privacy practices under constant criticism. Settling helped turn the page.
- Silicon Valley Precedent – Other tech firms like Google, Snapchat and TikTok paid similar settlements over BIPA. Agreeing to a settlement became an industry norm.
Despite its public commitment to defending itself vigorously in court, Facebook likely saw an expensive, drawn-out legal battle as too risky compared to settling.
Settlement Allows Facebook to Avoid Admitting Wrongdoing
Importantly, the settlement resolves the lawsuit but allows Facebook to continue denying it violated BIPA or any privacy laws. Settling without admitting wrongdoing is common practice by corporations seeking to avoid damaging admissions. Facebook takes the position that it was transparent about its practices and complied with applicable laws.
Criticisms of the Settlement
While hailed by plaintiffs as a major privacy win, the settlement has been criticized on a number of fronts:
Amount per Person Too Low
The approximately $400 per person recovery is seen by many as inadequate given the egregiousness of the privacy violations alleged. It essentially boiled down to pennies per violation for Facebook. Some lawyers criticized the plaintiffs’ counsel for not holding out for a larger amount.
Too Few Class Members Will Actually File Claims
Despite around 1.5 million Illinois Facebook users being eligible, some estimates predict only around 25% will end up submitting valid claims. Limited class member participation drastically reduces Facebook’s total payout. Reasons for not filing include not knowing about the settlement, apathy, or not wanting to provide personal information.
Settlement Didn’t Require Facebook to Admit Misconduct
Facebook was able to settle the lawsuit without admitting it violated privacy laws. It simply had to pay the settlement funds and tweak its practices going forward. Critics argue these “empty settlements” don’t adequately hold corporations accountable.
Lawyers Reaped the Biggest Rewards
Approximately $110 million of the settlement went to attorney fees. Big class action settlements attract criticism when the lawyers seem to benefit far more than individual plaintiffs do.
Broader Impacts of the Settlement
Beyond the direct payout to Illinois users, the settlement could have broader ramifications:
- Makes companies more cautious about using biometric data and facial recognition technologies without robust consent procedures.
- Encourages adoption of strict biometric data privacy regulations by other states beyond Illinois.
- Forces technology firms to be much more transparent around how facial recognition tools work and what they’re used for.
- Opens the door to additional lawsuits related to undisclosed harvesting of user biometrics and privacy violations.
- Puts tech firms on notice that they can’t simply pay fines as the cost of doing business when it comes to violating privacy laws.
The lawsuit also highlighted how most users are unaware of how their biometric information is being collected, used or stored. It underscored the power imbalance between users and tech companies.
Ultimately, more needs to be done to educate the public on privacy rights and reform data practices in the industry. But the settlement represented an important milestone in holding tech giants accountable.
Facebook’s Changes After the Settlement
As part of its requirements under the settlement, Facebook made two key changes to its facial recognition practices:
1. Turning Off Face Recognition Setting
In November 2021, Facebook disabled its “Face Recognition” tagging suggestion feature for all users by default. Users now have to opt into facial recognition after being provided an explanation of how it works.
Previously, it was turned on automatically for new users. They had to proactively disable it under their account settings.
2. Deleting Existing Faceprint Data
For users who were part of the settlement class, Facebook had to destroy existing faceprint data used for the Face Recognition feature.
Moving forward under the revised practices, users have to consent each time to a new faceprint being created. Faceprints are deleted after a short period if the user does not engage with the tagging suggestion.
These changes addressed two of the main complaints in the lawsuit – enabling facial recognition by default without consent and storing biometric data permanently without permission.
Status of the Settlement
In January 2023, the federal court overseeing the case gave final approval for the settlement after holding a fairness hearing. This cleared the way for payments to be distributed to eligible class members who filed valid claims.
Now that the settlement is approved, here is the current status:
- Claims processing is underway – the settlement administrator is reviewing and validating all claims.
- Class members who filed claims will likely receive their payments sometime in mid-2023 via check or electronic deposit.
- Attorney fees and expenses have been paid out per the settlement terms.
- Facebook paid $650 million into a settlement fund to cover class member payments and attorney fees.
- Facebook has disabled facial recognition for all users by default and deleted existing faceprints of class members.
Barring any last-minute appeals, Illinois Facebook users included in the class can expect to receive their checks later this year. For many, it will be the only compensation they ever see from the lawsuit.
The settlement resolves all claims related to Facebook’s alleged BIPA violations. Class members give up their right to sue the company further on issues specifically raised in this case.
Individuals could still potentially sue Facebook over other forms of biometric data collection not covered by this settlement. For example, the use of voice recognition technologies.
Future Outlook
Looking ahead, the Facebook settlement will likely influence other companies’ biometric data practices and privacy policies around facial recognition.
We will probably see other class action lawsuits follow targeting tech firms’ unauthorized or nonconsensual use of biometrics. The Facebook case laid the legal groundwork and monetary precedent for additional claims.
On the regulatory front, more states may enact biometric privacy laws now that there is a clear financial downside for companies skirting consent requirements.
From Facebook’s perspective, the settlement removed a major legal liability. But it still faces public concerns around its privacy practices. Rebuilding user trust remains an ongoing challenge.
For members of the settlement class, the saga is nearly over. For the plaintiffs’ attorneys, the case was a huge payday. For the tech industry overall, the multi-million dollar settlement was a warning that biometric privacy matters.
Conclusion
The nearly $650 million Facebook settlement over its facial recognition practices was unprecedented in scale for a privacy class action. But serious questions remain about whether it adequately compensated Illinois users and imposed sufficient accountability on Facebook.
Ultimately, the settlement’s impact will be measured by how much it changes Facebook’s and Silicon Valley’s data collection practices moving forward. If companies become far more cautious about biometric data usage, then it achieved something meaningful.
But if Big Tech simply views a few hundred million dollars as the cost of doing business when it comes to trampling privacy rights, then more stringent deterrence may be needed. The Facebook case highlighted that we cannot rely solely on private class action litigation to reform the industry’s behavior.
Stronger biometric data regulations, informed consumers, and tech companies willing to put privacy ahead of profits are also essential ingredients. Only time will tell if the Facebook settlement was a transformational moment or a slap on the wrist. For the company’s part, it has heralded the settlement as a major demonstration of its commitment to privacy protections. But its critics remain skeptical.