• by Wendy Davis  @wendyndavis, February 28, 2021

A federal judge has granted final approval to a class-action settlement requiring Facebook to pay $650 million for allegedly violating an Illinois biometric privacy law by compiling a database of faceprints.

The deal, finalized Friday, will result in payouts of $345 each to some Illinois residents whose faceprints were stored by Facebook.

“Overall, the settlement is a major win for consumers in the hotly contested area of digital privacy,” U.S. District Court Judge James Donato said Friday in a written ruling.

The settlement resolves a 2015 lawsuit alleging that Facebook's photo-tagging function violated an Illinois law prohibiting the collection or storage of people's biometric data -- including scans of facial geometry -- without their consent. That law provides for damages of up to $5,000 per violation.

Facebook's photo-tagging, rolled out in 2011, allegedly draws on the social networking platform's vast trove of photos to recognize users' faces, and suggest their names when they appear in photos uploaded by their friends.

In addition to monetary payments, Facebook will turn its face recognition settings to “off” for Illinois residents, and delete existing faceprints, unless people affirmatively opt in to the feature.

Facebook separately promised in 2019 to delete then-existing facial templates for U.S. users, unless they affirmatively agreed to allow their faceprints to remain in Facebook's database, as part of a $5 billion privacy settlement with the Federal Trade Commission.

Before agreeing to settle the case, Facebook urged Donato to dismiss the lawsuit on numerous grounds, including that Illinois users weren't injured by any alleged violations of the state law.

Donato rejected Facebook's argument and ruled that the case could proceed as a class-action on behalf of Illinois users who have had their faceprints stored by the company since 2011. That ruling was upheld by the 9th Circuit Court of Appeals.

Facebook attempted to appeal to the Supreme Court, but was turned away last year.

Donato approved the deal even though the total payout is less than the $5,000 per person that a jury could have awarded.

"All good trial lawyers and judges know that it is a fool’s errand to predict a jury verdict,” Donato wrote. “What matters is a realistic assessment of the overall risks and rewards of a trial in the context of each specific case. The record here leaves no doubt that the class would face substantial hurdles to prevailing at trial.”

He added that those risks included whether data gleaned from photos is covered by the Illinois law.

That law specifically excludes excludes photos, as well as data derived from photos, from the definitions of “biometric identifiers” and “biometric information.”

Facebook previously argued to Donato that those exemptions mean the Illinois law only covers "face geometry" when it's based on something other than photos, like in-person scans.

In 2016, Donato rejected that argument as inconsistent with the law's purpose. "The statute is an informed consent privacy law addressing the collection, retention and use of personal biometric identifiers and information at a time when biometric technology is just beginning to be broadly deployed," he wrote. "Trying to cabin this purpose within a specific in-person data collection technique has no support in the words and structure of the statute, and is antithetical to its broad purpose of protecting privacy in the face of emerging biometric technology."

Numerous tech companies have settled privacy lawsuits, but relatively few of those settlements have resulted in monetary payments to consumers. Instead, many of the agreements require the companies to make donations to nonprofits.

Even in cases where consumers have received payment, it's often been relatively nominal. For instance, some purchasers of Vizio televisions were expected to receive approximately $16 each after that company settled allegations that it unlawfully shared information about consumers with ad-tech companies and data brokers.