• by Wendy Davis  @wendyndavis, September 27, 2019

An Illinois resident has sued video company Vimeo for allegedly violating the state's biometric privacy law by collecting faceprints from users.

The lawsuit centers on Magisto, an app that allows users to create and edit videos. Vimeo purchased Magisto in April for a reported $200 million.

“Unbeknownst to the average consumer ... Magisto’s facial recognition technology scans each and every video and photo uploaded to Magisto for faces, extracts geometric data relating to the unique points and contours (i.e., biometric identifiers) of each face, and then uses that data to create and store a template of each face -- all without ever informing anyone of this practice,” Bradley Acaley alleges in a class-action complaint filed last week in state court in Cook County, Illinois.

The lawsuit claims Vimeo violated the Illinois Biometric Information Privacy Act, a 10-year-old law that requires companies to obtain written releases from people before collecting “face geometry” and other biometric data. The law provides for damage of up to $5,000 per violation.

Vimeo denies the allegations and says the lawsuit is “based upon a fundamental misunderstanding” of Magistro.

Acaley says he downloaded Magisto in December of 2017, and purchased a one-year subscription for $120. He uploaded photos and videos of himself and his family to Magisto, and then used the service to edit the material, according to his complaint.

“Immediately after upload to the Magisto app, Vimeo analyzed plaintiff’s videos and photos by automatically locating and scanning plaintiff’s face and by extracting geometric data,” the complaint alleges. “The resulting unique face template was used by Vimeo to locate and group together all videos and/or photos depicting plaintiff for organizational purposes.”

Vimeo states that Magisto uses "machine learning technology to help identify objects within video frames,” but does not collect facial-recognition data.

“Determining whether an area represents a human face or a volleyball does not equate to 'facial recognition,' and Magisto neither collects nor retains any facial information capable of recognizing an individual,” the company states.

Other tech companies, including Facebook and Google, have also been sued for allegedly violating the Illinois biometric privacy law.

Last month, the 9th Circuit Court of Appeals in California cleared the way for Illinois residents to proceed with a class-action accusing Facebook of creating a database of faceprints. The judges in that matter rejected Facebook's argument that people weren't injured by the alleged practices, and therefore shouldn't be allowed to move forward in court.

But a federal district court judge in Illinois came to a different decision in a similar lawsuit against Google. The judge in that matter dismissed the lawsuit earlier this year, ruling that Google's alleged practices didn't cause an injury because people's faces are “public” information.