• by Wendy Davis  @wendyndavis, April 17, 2018

In a blow to Facebook, a federal judge has ruled that the company must face a class-action lawsuit for allegedly violating Illinois privacy law by compiling a database of faceprints.

U.S. District Court Judge James Donato rejected Facebook's arguments that the allegations didn't lend themselves to class-action treatment. He wrote that the claims were "sufficiently cohesive to allow for a fair and efficient resolution on a class basis."

The ruling, issued Monday, authorizes a class of "Facebook users located in Illinois for whom Facebook created and stored a face template after June 7, 2011."

Donato's decision marks the latest development in a battle that dates to 2015, when Illinois residents alleged in a lawsuit that Facebook's photo-tagging feature violates the Illinois Biometric Privacy Act. Facebook's photo-tagging function recognizes users' faces and suggests their names when they appear in photos uploaded by their friends. To accomplish this, the social networking service draws on its vast trove of users' photos.

The Illinois Biometric Information Privacy Act requires companies to obtain written releases from people before collecting certain biometric data, including scans of face geometry. That measure, passed in 2008, also requires companies that gather biometric data to notify people about the practice, and to publish a schedule for destroying the information. The law provides for fines of up to $5,000.

Facebook has argued that the lawsuit should be dismissed for several reasons. Among others, the company says its photo-tagging feature isn't covered by the Illinois law, because Facebook doesn't have servers in Illinois.

Donato rejected that argument, ruling that Facebook's reasoning "would effectively gut the ability of states without server sites to apply their consumer protection laws to residents for online activity that occurred substantially within their borders."

Facebook also unsuccessfully contended that the consumers shouldn't be able to proceed as a class for numerous reasons, including that any injuries to consumers require individual determinations. "Many ... class members will not claim an injury beyond the collection of their alleged biometric data, and if others do make such a claim, the form of alleged injury will vary tremendously," Facebook argued in papers filed with Donato in January.

Facebook says it's reviewing the ruling. "We continue to believe the case has no merit and will defend ourselves vigorously," a spokesperson says.

Facebook isn't the only company accused of unlawfully compiling faceprints. Google and Shutterfly are also battling lawsuits accusing them of violating the Illinois privacy law. Judges in those cases have so far rejected the companies' attempts to have the lawsuits dismissed.