Facebook lost a federal appeal on Thursday in a lawsuit over facial-recognition data. That could lead to the company paying massive fines over its privacy practices.
The tech giant was sued in 2015 under the Illinois Biometric Information Privacy Act, which mandates that companies make a public policy before collecting and storing biometric data — including face scans — and explain how such data will be stored. CEO Mark Zuckerberg’s company has used that technology in its photo tagging feature, which can tell whether an image includes a user’s friends.
The suit contended that Facebook did not meet the law’s requirements. Facebook, in turn, said that the plaintiffs failed to show injury and that the lower court overstepped its power by certifying the case.
In the 3-0 decision, the appeals court did not agree with Facebook.
“We conclude that the development of a face template using facial-recognition technology without consent (as alleged here) invades an individual’s private affairs and concrete interests,” the court wrote in its decision, sending it back to the lower court for further proceedings.
The Biometric Privacy Act allows for payments of $1,000 to $5,000 per violation. According to Reuters, the class could include millions of Facebook users, meaning the social network might be forced to pay billions in damages if it ultimately loses the case.
“We plan to seek further review of the decision,” a Facebook spokesperson said in a statement to The Verge. “We have always disclosed our use of face-recognition technology and that people can turn it on or off at any time.”
The company will seek further review from the full court of appeals and could take the case to the Supreme Court, the technology news site reported.
Privacy advocates cheered the new ruling.
“This decision is a strong recognition of the dangers of unfettered use of face surveillance technology,” Nathan Freed Wessler, an attorney with the ACLU Speech, Privacy and Technology Project, said in a statement. “The capability to instantaneously identify and track people based on their faces raises chilling potential for privacy violations at an unprecedented scale.”
The use of facial-recognition technology has been criticized by activists and prompted a bipartisan backlash, with several cities, including Oakland and San Francisco, passing measures to ban its use completely.