Montana May Regulate 'Faceprints'

• by Wendy Davis , Staff Writer @wendyndavis, February 24, 2017

A proposed biometric privacy bill in Montana is drawing support from the digital rights group Electronic Frontier Foundation, which argues that new laws are needed to protect people from privacy threats posed by facial recognition technology.

"Cameras are increasingly accurate at long distances, and facial recognition algorithms are increasingly able to match images against each other," the organization writes in a letter to Montana lawmakers. "Once captured, it is easy for someone to use our biometrics against us."

The potential Montana law (HB 518) would require companies to obtain people's written permission before collecting, sharing or using biometric identifiers like faceprints, retinal scans and voice patterns. The measure excludes photos from the definition of biometric identifier, unless a company has collected the photos in order to use them as a source of biometric data.

The definition means that Facebook and other Web companies would be required to obtain consumers' consent before applying the kind of software that enables them to create faceprints, according to Electronic Frontier Foundation attorney Adam Schwartz.

"Social media companies would need to get consumer consent before they start scraping all the photographs that they get and applying facial recognition," Schwartz tells MediaPost.

The EFF notes in its letter to lawmakers that Carnegie Mellon University researchers recently reported that facial recognition software, combined with social media profiles, can be used to identify strangers. The digital rights group also draws attention to the Russian FindFace app, which lets people identify strangers by matching photos of them with the social media site VKontakte.

Montana isn't the only state considering new biometric privacy protections. Lawmakers in Alaska, Connecticut, New Hampshire and Washington also have introduced similar measures.

To date, only Illinois and Texas have passed laws specifically protecting biometric privacy. The Illinois law has been at the center of class-action privacy complaints against several companies, including Google, Shutterfly and Facebook. The case against Shutterfly has been resolved, but Google and Facebook are still fighting the lawsuits.