Facebook to face class action lawsuit over its facial recognition technology

In a blow to Facebook, a federal judge has ruled that the company must face a class-action lawsuit for allegedly violating IL privacy law by compiling a database of faceprints.

The decision by a United States district judge means the company could be sued by millions of US users.

The suit-first filed in 2015-alleges that Facebook's photo-tagging feature violates Illinois' Biometric Information Privacy Act (BIPA), which forbids collection of identifiable biometric data without a person's explicit consent.

According to the judge's order, damages could rack up to billions of dollars if Facebook loses.

U.S. District Court Judge James Donato rejected Facebook's arguments that the allegations didn't lend themselves to class-action treatment.

This same judge has now certified a class of Facebook users who can be represented in the lawsuit, asserting that any IL users on whom Facebook's facial recognition technology was used since the "tag suggestions" feature was introduced in 2011 will be entitled to compensation if Facebook loses the class action suit.

Data hubs play a role in managing GDPR consents
Data hubs play a role in managing GDPR consents

It involves the "tag suggestions" technology, which spots users' friends in uploaded photos.

In the case before Donato, he has ruled that the IL law is clear: Facebook has collected a "wealth of data on its users, including self-reported residency and IP addresses". Judge Donato put the extent of the damages into perspective, "Facebook seems to believe statutory damages could amount to billions of dollars".

Facebook could face fines of $1,000 to $5,000 for each time it used a person's biometrics without permission.

A class action is clearly superior to individual proceedings here. Facebook switched the feature off in Europe in 2012 after an audit by Ireland's data watchdog. A company spokesperson said it is "reviewing the ruling", adding that "we continue to believe the case has no merit and will defend ourselves vigorously".

The company is now trying to roll out facial recognition technology inside the European Union again, according to the Irish Times, but on an opt-in basis.