The New York Times reported that an Illinois judge approved Facebook users' $550M settlement in their class-action lawsuit against the social media giant for secretly gathering biometric data from its Tag Suggestions or Face Recognition tool, a systematic violation of an Illinois consumer privacy law.
The social media company collected biometric information from users who upload photos and labeled, or "tagged," the faces of people in the picture. Once tagged, a link from the photo is created to the person's account or profile. Over time, the more a user was tagged, the better and more refined Facebook's Tag Suggestion and Face Recognition tools operated. This practice was done without user consent.
The disbursement of the settlement ranges between $150 to $300 for each class member, or between 15% and 30% of the possible recovery on an individual claim. As part of the settlement, Facebook agreed to turn off the face-matching feature and delete existing biometric data for the class members. A Facebook spokesperson said, "We decided to pursue a settlement as it was in the best interest of our community and our shareholders to move past this matter." The deal is the largest of its kind in a U.S. consumer privacy class-action suit.
Facebook paid one of the largest penalties ever assessed by the U.S. government for violating privacy laws. In July 2019 the Federal Trade Commission (FTC) ordered a $5B penalty for encouraging and collecting user information on its platform, while promising users control the privacy of their information through Facebook’s privacy settings, and then selling the personal information to third-party apps and for targeted advertising. The FTC claims that "many users were unaware that Facebook was sharing such information, and therefore did not take the steps needed to opt-out of sharing." In addition to the penalty, the FTC also mandated the company "submit to new restrictions and a modified corporate structure that will hold the company accountable for the decisions it makes about its users’ privacy."
The NY Times highlighted the importance of a privacy case and where it is filed. The recent Facebook settlement with its customers "illustrates the protections that strong state laws may offer consumers. Of the three states that have stand-alone biometric privacy laws, Illinois has the most comprehensive one." The Biometric Information Privacy Act (BIPA) was passed by the Illinois General Assembly in 2008. BIPA guards against the unlawful collection and storing of biometric information. It also requires companies to obtain consumers' explicit consent before collecting or sharing biometric information, such as facial recognition or fingerprint scans. The law also gives residents the right to sue companies for up to $5,000 per violation, which increases exponentially for tech companies that face large member class litigation.
A controversial issue that stems from biometrics is its use in surveillance to help law enforcement agencies. Tech company, Clearview AI is currently facing a lawsuit in Illinois for "allegedly violating...people’s privacy by scraping photos from sites and apps like Facebook, Instagram, YouTube, and Venmo to train its facial recognition algorithm." It used its biometric data to create an application and sold it for commercial and government use. Recently, it voluntarily ended non-government contracts but is still focused on its mission "to assist law enforcement agencies around the nation in identifying perpetrators and victims of crime, including horrific crimes such as trafficking and child abuse,” Lee Wolosky, the lawyer representing Clearview AI told BuzzFeed. Some view Clearview's, and other companies like Amazon, use of facial recognition technology to identify criminals as a benefit to ultimately protect public safety. Others see it as an infringement on an individual's ability to choose and keep a person's physical identity private. With the growing databases of Americans' biometrics, the American Civil Liberties Union and similar groups caution that this technology could "end of anonymity as we know it."