• by Wendy Davis  @wendyndavis, December 6, 2024

Google must face claims that it violated an Illinois biometric privacy law requiring companies to obtain consumers' written consent before collecting or storing scans of face geometry, a federal judge ruled Thursday.

The ruling, issued by U.S. District Court Judge Beth Labson Freeman in the Northern District of California, comes in a lawsuit brought in 2020 by Illinois residents Steven Vance and Tim Janecyk. They alleged in a class-action complaint that Google acquired a database of faces from IBM, which itself reportedly obtained 100 million pictures from the photo-sharing service Flickr. Google allegedly obtained the database in order to improve its own facial recognition service.

Vance and Janecyk claimed that Google ran afoul of the Illinois Biometric Information Privacy Act, which regulates the collection and storage of faceprints and provides for damages of up to $5,000 per violation.

In March, Freeman dismissed the claims on the grounds that the allegations in the complaint, even if proven true, wouldn't show that any violations of the Illinois privacy law occurred in that state. That dismissal was without prejudice, meaning that Vance and Janecyk could revise their allegations and bring them again.

The Illinois residents did so in April, alleging in an amended complaint that in 2019, Google employed around 1,200 people in Chicago, and that it engineered the Pixel smartphone in that city.

“Defendant Google specifically sought to improve the functionality of the Pixel’s face unlock technology through the use of diverse data, which is exactly what was included in the Diversity in Faces Dataset,” the amended complaint alleged.

The amended complaint also included allegations that Vance and Janecyk uploaded photos to Flickr that were tagged with data showing they were taken in Illinois.

Freeman ruled Thursday that the allegations in the amended complaint, if proven true, could show that the potential violations of the privacy law occurred in Illinois.

“The court finds plaintiffs have pled sufficient facts from which a reasonable inference could be drawn that the alleged ... violations occurred 'primarily and substantially' in Illinois,” she wrote.

Vance and Janecyk separately brought similar claims against Amazon and Microsoft. Those lawsuits were dismissed on the grounds that the companies' alleged conduct didn't occur in Illinois.