Facebook has agreed to pay an eye-popping $550 million to settle claims that it violated an Illinois privacy law by compiling a database of “faceprints,” the company said this week.
News of the settlement comes one week after the Supreme Court rejected Facebook's request to intervene in the lawsuit, a class-action alleging that it violated a 2008 Illinois privacy law.
That measure, which prohibits companies from collecting or storing people's biometric data without their consent, is considered one of the strongest in the country. It not only allows individual consumers to sue, but also provides for damages of up to $5,000 per violation.
The class-action dates to 2015, when a group of Illinois residents sued Facebook for allegedly violating the state privacy law with its photo-tagging function, which draws on a vast trove of photos to recognize users' faces and suggests their names when they appear in photos uploaded by their friends.
Facebook allegedly used facial recognition technology on photos uploaded by users in order to compile the faceprint database.
The social networking platform argued that the lawsuit should be dismissed for several reasons, including that its users weren't injured by any alleged violations of the state law.
U.S. District Court Judge James Donato in the Northern District of California rejected Facebook's stance. He ruled that the case could proceed as a class-action on behalf of Illinois users who had their faceprints stored by the company since 2011.
Last August, a three-judge panel of the 9th Circuit Court of Appeals upheld that decision. Those judges suggested in a written opinion that creating faceprints could have vast and far-reaching privacy implications.
"Taking into account the future development of such technology ... it seems likely that a face-mapped individual could be identified from a surveillance photo taken on the streets or in an office building,” the appellate judges wrote. “Or a biometric face template could be used to unlock the face recognition lock on that individual’s cell phone.”
Facebook then attempted to appeal to the Supreme Court, but was turned away last week.
Full details of the settlement haven't yet been revealed in court papers, but Illinois class members who submit claims are expected to receive more than $200 each. The settlement must still be approved by a judge.
While numerous tech companies have settled privacy lawsuits, few of those settlements have resulted in monetary payments to consumers. Instead, many of the settlements require the tech companies to donate to nonprofits -- a practice that has come under fire from activists who say class members should directly benefit from settlements.
Even in cases where consumers have received payment, it has been relatively nominal. For instance, some purchasers of Vizio televisions were expected to receive approximately $16 each after that company settled allegations that it shared information about consumers with ad-tech companies and data brokers.
News of the Facebook settlement comes as state lawmakers throughout the country are considering new privacy laws, including ones that would restrict the use of facial recognition technology.
While the technology is still nascent, its use is rapidly growing.
Just last week, it emerged that the startup Clearview AI sells faceprint databases to police departments. That company reportedly scraped billions of photos from Twitter, Facebook and other companies, used facial recognition technology to create its faceprint database, then sold the database to police departments across the country, according to an explosive report in The New York Times. (Clearview itself is now being sued in Illinois for allegedly violating the same biometric privacy law at the center of the Facebook case.)
Currently a number of states either regulate facial recognition technology or are considering doing so, but Illinois is the only one that allows residents to sue over biometric privacy violations.
Jay Edelson, one of the attorneys who represented the Illinois residents who sued Facebook, says the settlement doesn't just send a message to businesses, but also to lawmakers who are considering new privacy measures.
“As issues like the Clearview scandal keep happening, I expect that there will be more and more discussion in state houses throughout the country about whether residents from Maine to Alaska can similarly protect their biometric privacy,” he says.