Facebook is facing a $725 million lawsuit over allegations that the company illegally collected biometric data from millions of users without their consent. The class action lawsuit was originally filed in Illinois in 2015, but a federal judge recently ruled that the case can proceed as a class action which now makes Facebook liable for damages between $1,000 to $5,000 for each of the 7 million plaintiffs, totaling up to $35 billion. However, the plaintiffs are currently seeking $725 million in damages.
This case centers around Facebook’s “Tag Suggestions” feature which uses facial recognition technology to identify people in photos uploaded by users to tag them. The plaintiffs argue that this violates Illinois’ strict biometric privacy law which requires companies to obtain informed consent before collecting biometric data such as face scans and fingerprints. Facebook failed to obtain consent from users and instead covertly extracted their biometric data for Tag Suggestions starting in 2011.
What does Illinois’ biometric privacy law state?
Illinois has one of the toughest biometric privacy laws in the nation under the Biometric Information Privacy Act (BIPA) which imposes strict regulations on how companies can collect, store, and use biometric identifiers such as face prints and fingerprints. Under BIPA, companies must:
– Inform people in writing that biometric data is being collected and stored
– Detail the purpose of data collection and length of storage
– Obtain a written release from individuals consenting to the collection and storage of their biometric data
BIPA also outright bans the sale, lease, trade, or profit from a person’s biometric data. Violators face civil penalties up to $5,000 for each negligent violation and up to $25,000 for each reckless or intentional violation. The law provides individuals with the right to sue companies over violations.
How did Facebook allegedly violate Illinois law?
By rolling out the Tag Suggestions feature in 2011 without obtaining user consent, Facebook is accused of breaching both the notice and consent requirements under BIPA:
– **No notice** – Facebook allegedly did not adequately inform users that their faces were being scanned and converted into biometric face templates for the tagging feature. There was no explicit notice about biometric data collection and storage.
– **No consent** – Facebook did not get written consent from users agreeing to the collection and storage of their biometric data for Tag Suggestions. There was no option to opt-in or opt-out.
Essentially, the lawsuit alleges Facebook secretly extracted and stored biometric data from user photos without their permission or knowledge. This would be a clear violation of BIPA’s strict informed consent protocols for collecting biometric data such as face scans.
Who is covered under the class action lawsuit?
The class action was originally filed by Illinois Facebook users, but the federal judge certified a nationwide class that likely covers millions of additional Facebook users located outside Illinois.
The class covers:
– Facebook users located in Illinois who had their faces tagged in photos on Facebook from 2011 to 2015.
– Facebook users outside Illinois who had their faces tagged in photos on Facebook from 2011 to 2015 and were located in a state without a biometric privacy law.
The class seeks to include all affected American Facebook users, whether located in Illinois or not. The final size of the class will depend on how many users fit these parameters, but estimates range from 6 million to over 100 million users.
What are the key arguments on both sides?
**Plaintiff Arguments**
– Facebook violated BIPA by failing to provide notice or obtain consent before implementing facial recognition and collecting users’ biometric data.
– The alleged violations were egregious given the covert, non-consensual nature of Facebook’s biometric data collection through Tag Suggestions.
– Class members suffered harm due to the invasion of privacy, loss of control over their biometric data, and put at risk for identity theft.
– Class members are entitled to statutory damages of $1,000 to $5,000 under BIPA for Facebook’s negligent violations.
**Facebook’s Arguments**
– No violation occurred because Tag Suggestions did not collect or store “biometric identifiers” banned under BIPA, but rather extracted data from user photos into algorithmic face templates.
– Class members suffered no concrete injury and therefore have no standing to sue. The collection of face data did not harm users.
– Illinois law should not apply to Facebook users outside Illinois.
– Individual issues like whether users’ faces were actually scanned prevent the case from being adjudicated as a class action.
What evidence is being used in the case?
Key evidence in the case includes:
– **Facebook’s statements:** Public statements by Facebook executives indicating Tag Suggestions works by scanning faces in photos using facial recognition technology.
– **Facebook design documents:** Internal documents, design specifications, engineering notes that detail how Tag Suggestions was built and functions. Plaintiffs claim these indicate Facebook clandestinely extracted users’ biometric data.
– **Expert witness testimony:** Testimony from experts in facial recognition and computer vision regarding how Facebook’s technology works to collect biometric data.
– **User experiences:** Testimony from named plaintiffs detailing how Facebook tagged them in photos without consent. Serves as evidence that notice and consent did not occur.
– **BIPA itself:** The language of Illinois’ BIPA forms the basis of the claims and whether Facebook’s practices were prohibited under the law.
What are the broader implications beyond Facebook?
While the lawsuit centers around Facebook, it has major implications for other technology companies and the use of biometric data overall:
– **Consent requirements** – Makes clear that companies must properly inform users and obtain consent before collecting biometric data, even if serving a useful feature.
– **Applicability beyond Illinois** – Signals that tech companies may be liable under BIPA even if users are located outside Illinois when biometric collection occurred.
– **Class action risk** – Highlights potential class action risk over biometric data collection. Damages under BIPA could add up quickly with thousands or millions of class members.
– **Privacy expectations** – Underlines that users expect transparency and consent when it comes to collection of sensitive biometric data. Tech companies cannot bypass privacy expectations.
The case underscores the risks involved with biometric data for Big Tech companies. It serves as a warning to properly disclose biometric collection and respect user privacy.
Facebook’s potential damages and liability
If the class action succeeds, Facebook faces up to $5 billion in potential damages under BIPA’s statutory damages:
– Between $1,000 to $5,000 owed per class member
– Estimated 7 million class members from Illinois alone
– Damages could reach $35 billion if all 100+ million U.S. users affected qualified
However, the plaintiffs are currently only seeking $725 million in damages. The final amount Facebook pays could land anywhere between the two amounts depending on the court’s judgement.
Beyond the monetary payout, the case could establish legal precedent that tech companies must follow BIPA even outside Illinois when handling biometric data of state residents. This would seriously expand BIPA’s applicability.
Status of the lawsuit
In January 2022, a federal judge rejected Facebook’s bid to dismiss the lawsuit and ruled it can proceed as a nationwide class action. This dramatically raised the stakes for Facebook.
Some key events in the case timeline:
– **2015** – Lawsuit originally filed in Illinois state court
– **2018** – Case removed to federal court
– **2019** – Plaintiffs seek nationwide class certification
– **2022** – Nationwide class approved. Facebook’s dismissal attempt rejected.
The class action status puts intense pressure on Facebook to settle. However, settlement talks have stalled over how to notify potentially millions of class members. The case is headed to trial in 2023 if no settlement is reached.
Facebook’s legal and PR troubles
The Illinois lawsuit adds to a myriad of legal and public relations troubles currently facing Facebook:
– Lawsuits by the FTC and state attorneys general alleging anti-competitive practices
– Whistleblower leaks accusing Facebook of putting profits over safety
– Ongoing criticism of Facebook’s policies and effects on privacy, hate speech, election integrity
– Declining user growth and engagement among young people
The negative headlines appear to be taking a toll. Based on internal documents, Facebook found its reputation declined by 15% between 2019 and 2021. Surveys found its trustworthiness rating plummeted over the past 5 years.
With the long-running Illinois biometric privacy lawsuit coming to a head, Facebook’s reputation may take another hit in 2023. The case is poised to keep Facebook’s legal and ethical issues under scrutiny.
Conclusion
Facebook is gearing up for a potentially massive class action lawsuit over its facial recognition technology and alleged violations of Illinois’ biometric privacy law. While the plaintiffs are currently only seeking $725 million in damages, Facebook’s liability could ultimately reach billions under BIPA’s statutory damages.
The lawsuit centers on Facebook’s failure to properly notify and obtain user consent for its Tag Suggestions feature, which covertly extracted biometric data from user photos. But the implications reach further, serving as a warning to technology companies to respect biometric privacy expectations.
As the case heads to a 2023 trial, all eyes will be on whether it establishes new legal precedents around biometric data collection and enforcement of state privacy laws against Big Tech companies. The lawsuit represents a major threat to Facebook’s finances and an additional black mark for its already battered public reputation.