Lawsuit challenging Facebook's facial recognition system moves forward, as judge rules that Illinois' Biometric Information Privacy Act is applicable
Lawsuit challenging Facebook's facial recognition system moves forward — A lawsuit alleging that Facebook photo tagging violates user privacy has cleared a crucial early hurdle.
Context & Ripple Effects
In 2016, an Illinois judge ruled that the state's Biometric Information Privacy Act applies to Facebook's photo-tagging, keeping alive a lawsuit over facial recognition that could otherwise have died at the threshold question of whether web photo tagging even counts as biometric collection under the law. That ruling was the first domino in a multi-year litigation chain: class-action status followed in 2018, and Illinois' top court later confirmed companies can be sued for collecting biometrics without opt-in consent even absent tangible injury.
The stakes compounded as the case climbed: a federal appellate court forced Facebook to face the class action, the Supreme Court declined to intervene in January 2020, and within weeks Facebook paid $550M to settle — one of the largest privacy settlements ever, all rooted in this early applicability ruling.
First-order effects
- Facebook must litigate rather than dismiss: with BIPA held applicable to its tagging system, the company faces exposure for every Illinois user scanned without opt-in consent, and the path is open toward class certification.
Second-order effects
- A certified class converts individual complaints into mass liability, pressuring Facebook and other platforms running facial recognition on uploaded photos to add consent gates or geofence features out of states like Illinois.
Third-order effects
- If BIPA-style suits prove lucrative without proof of tangible harm, other states have a template for private-enforcement biometric statutes — shifting facial-recognition compliance from an ethics question to a per-state legal cost of doing business.
The trend: State-level biometric privacy laws are becoming privately enforceable litigation weapons that can force even the largest platforms to pay for scanning users' faces without consent.