Facebook has agreed to settle a $550 million lawsuit brought on behalf of millions of Illinois users who claim the social network’s automated tagging feature powered by facial recognition technology violates their biometric privacy rights.
The lawsuit — one of more than 400 filed against tech companies big and small in the past five years — alleged that Facebook broke Illinois’ strict biometric privacy law that allowed people to sue companies that failed to get consent before harvesting consumers’ data.
Privacy advocates hailed the law as the nation’s strongest form of protection in the commercial use of such data, and it has survived ongoing efforts by the tech industry and other businesses to weaken it.
Attorneys focusing on privacy law have predicted that the Facebook settlement could shape debates over privacy protection in other states and in Congress.
Although the buying and selling of consumer data have become a multi-billion-dollar industry, Illinois’ law — the Biometric Information Privacy Act — predated even Facebook’s iconic “like” feature.
Illinois lawmakers passed the law in 2008 requiring companies to get consent before collecting biometric information and to create a policy specifying how that information will be retained and when it will be destroyed.
It also gave people living in Illinois the right to sue for $1,000 over negligent violations and $5,000 for intentional violations.
Chicago attorney Jay Edelson’s firm was among the first to accuse Facebook of failing to meet Illinois’ standard in multiple lawsuits filed in 2015. The three Illinois men fronting the class-action suit against Facebook said they were never told that the site’s photo-tagging system used facial recognition technology to analyze photos then create and store “face templates.”
A federal judge later grouped the cases together as a class-action on behalf of Illinois Facebook users who were among the stored face templates as of June 7, 2011.
Facing Illinois’ law, some companies have opted out of the state. But, backers of the law argued it’s not difficult to comply — they simply needed to tell consumers they planned to use biometric data and needed their consent.
The Facebook case wound through courtrooms in Illinois and California for nearly five years before last month’s announcement of a settlement, days after the U.S. Supreme Court declined to hear arguments.
The Associated Press contributed to this report.