Facebook users who live in Illinois can proceed with a class action accusing the company of violating a biometric privacy law by creating a database of “faceprints,” a federal appellate court ruled Thursday.
The decision, issued by a three-judge panel of the 9th Circuit Court of Appeals, upheld a 2018 order by U.S. District Court Judge James Donato in the Northern District of California.
"The development of a face template using facial-recognition technology without consent (as alleged here) invades an individual's private affairs and concrete interests," Circuit Judge Sandra Ikuta wrote in an opinion joined by Judges Ronald Gould and Benita Pearson.
Thursday's ruling stems from a lawsuit dating to 2015, when several Illinois residents sued the social networking platform for allegedly violating the Illinois Biometric Information Privacy Act by collecting "faceprints."
That 10-year-old statute -- considered one of the strongest privacy laws in the country -- requires companies to obtain written releases from people before collecting “face geometry” and other biometric data. The law provides for damage of up to $5,000 per violation.
The Illinois residents alleged Facebook violated the Illinois law with its photo-tagging function, which draws on a vast trove of photos to recognize users' faces and suggest their names when they appear in photos uploaded by their friends.
Last year, Donato allowed the lawsuit to proceed as a class-action on behalf of all Facebook users in Illinois who had their faceprints stored by the company since 2011.
Facebook appealed that decision to the 9th Circuit, where the company argued that consumers shouldn't be able to move forward because they weren't injured by the alleged practices, and that Illinois residents should be forced to individually litigate claims.
The appellate panel both of Facebook's arguments. Among other reasons, the judges suggested the creation of facial templates could have far-reaching consequences.
“Once a face template of an individual is created, Facebook can use it to identify that individual in any of the other hundreds of millions of photos uploaded to Facebook each day, as well as determine when the individual was present at a specific location,” the appellate judges said. “Taking into account the future development of such technology ... it seems likely that a face-mapped individual could be identified from a surveillance photo taken on the streets or in an office building. Or a biometric face template could be used to unlock the face recognition lock on that individual’s cell phone.”
A Facebook spokesperson says the company plans to seek further review. "We have always disclosed our use of face recognition technology and that people can turn it on or off at any time," the spokesperson said.
The court fight drew the attention of business groups like the Internet Association and Chamber of Commerce, which sided with Facebook, and advocacy groups including the ACLU and Electronic Privacy Information Center, which were aligned with the plaintiffs.
The Internet Association said in a friend-of-the-court brief that a ruling against Facebook could threaten the development of new technologies, while consumer advocates argued the Illinois law would help protect people against “pervasive invasions of privacy through surreptitious surveillance technologies.”
Facebook isn't the only tech company facing litigation over facial recognition software.
Google was also sued for allegedly violating the Illinois law by deploying facial recognition technology on photos uploaded by users. So far, that matter has had a different outcome than the lawsuit against Facebook.
Earlier this year, U.S. District Court Judge Edmond Chang in Illinois dismissed the case against Google, ruling that the plaintiffs didn't suffer any concrete injury from the company's alleged faceprint practices.
Chang said in his ruling that Google's alleged practices didn't cause an injury because people's faces are “public” information.
“Most people expose their faces to the general public every day, so one’s face is even more widely public than non-biometric information like a social security number,” Chang wrote in an opinion awarding Google summary judgment. “Indeed, we expose our faces to the public such that no additional intrusion into our privacy is required to obtain a likeness of it.”
The Illinois residents are appealing that ruling to the 7th Circuit Court of Appeals.