Class Action Proceeds Against Facebook for Violation of Illinois Biometric Information Privacy Act (“BIPA”)

Written by: Richard Sheinis, Esq.

The Ninth Circuit has ruled that a case against Facebook for violating the Illinois Biometric Information Privacy Act can proceed as a class action.  The lawsuit stems out of Facebook’s “Tag Suggestions” feature.  When a Facebook user enables the Tag Suggestions feature, Facebook uses facial recognition technology to analyze whether the user’s Facebook friends are in photos uploaded by the user.

The technology scans the photo and extracts data points that make a face unique, such as the distance between the eyes, nose and ears to create a face signature or map.  The technology then compares face signatures to Facebook’s database of face signatures.  If there is a match, Facebook may suggest to the user that they tag the person in the photo.

The crux of the lawsuit is the allegation that Facebook has violated BIPA by not having a retention schedule for permanently destroying the biometric information, and not obtaining written consent from users before obtaining biometric identifiers and creating face signatures.  Part of Facebook’s defense is that users can turn the face recognition technology on or off at any time.

Damages can be huge because each time a person’s image is used without consent can be considered a separate violation.  Each violation can result in a fine of $1,000 to $5,000.  Facebook says it plans to appeal.