Federal appeals court rules Facebook must face a class action suit claiming that its facial recognition practices violated an Illinois biometric privacy law
(Reuters) - A federal appeals court on Thursday rejected Facebook Inc's (FB.O) effort to undo a class action lawsuit claiming …
Context & Ripple Effects
This ruling is the appellate checkpoint in a four-year legal march: after a judge found in 2016 that Illinois' Biometric Information Privacy Act applies to Facebook's photo-tagging system the lawsuit moved forward on BIPA grounds, and in 2018 the case won class status for Illinois residents the class was certified. By rejecting Facebook's bid to undo the suit, the appeals court keeps the company exposed to statutory damages that accrue per scan of a user's face.
What makes the stakes unusual is BIPA itself: unlike most US privacy statutes, it lets individuals sue directly, so a certified class converts a tagging feature into quantifiable liability rather than a regulatory slap on the wrist.
First-order effects
- Facebook must now litigate the merits of the class action instead of escaping at the procedural stage, facing potential per-violation damages for every Illinois user whose face was scanned by its tagging feature.
Second-order effects
- Any consumer platform deploying facial recognition on users in Illinois inherits the same exposure, pushing companies toward opt-in consent flows or geofencing biometric features out of the state.
Third-order effects
- If the pattern holds through appeal — the case later drew a Supreme Court refusal to intervene and ended in a $550M settlement — BIPA's private right of action becomes the de facto national standard for biometric data, enforced by class-action lawyers rather than regulators.
The trend: State biometric privacy laws with private rights of action are becoming the primary enforcement mechanism against facial recognition in the US, with litigation costs doing the work federal privacy law does not.