Privacy Advocates Celebrate Court Ruling on Class-Action Suit Targeting Facebook's Facial Recognition Tech

Civil liberties advocates celebrated after a federal court in San Francisco ruled Thursday that Facebook users in Illinois can sue the social media giant on the grounds that its facial recognition technology violates a strict state privacy law.

"This decision is a strong recognition of the dangers of unfettered use of face surveillance technology."
--Nathan Freed Wessler, ACLU

"This decision is a strong recognition of the dangers of unfettered use of face surveillance technology," Nathan Freed Wessler, staff attorney with the ACLU Speech, Privacy, and Technology Project, said in a statement after the ruling.

"The capability to instantaneously identify and track people based on their faces raises chilling potential for privacy violations at an unprecedented scale," he said. "Both corporations and the government are now on notice that this technology poses unique risks to people's privacy and safety."

Last year, the ACLU--along with its Ilinois as well as Northern and Southern California chapters, Illinois PIRG, the Center for Democracy and Technology, and the Electronic Frontier Foundation--filed an amicus brief in support of the class-action suit, Patel v. Facebook. According to the ACLU, the ruling Thursday was the first time a U.S. appellate court has "directly address[ed] the unique privacy harms posed by the face recognition technology."

Freed Wessler took to Twitter Thursday to highlight portions of the ruling that explain why the technology poses significant threats to privacy:

A three-judge panel from the 9th Circuit U.S. Court of Appeals concluded Thursday that "the development of a face template using facial recognition technology without consent (as alleged here) invades an individual's private affairs and concrete interests." The ruling stated that the "technology at issue here can obtain information that is 'detailed, encyclopedic, and effortlessly compiled,' which would be almost impossible without such technology."

Facebook had sought to quash the lawsuit--which, Reuters noted, "exposes the company to billions of dollars in potential damages to the Illinois users who brought the case." The suit, initially launched in 2015, charges that Facebook's use of facial recognition technology to suggest users "tag" in photos based on previously uploaded images violates the state's Biometric Information Privacy Act (BIPA).

Enacted in 2008, BIPA is considered by many privacy experts and advocates the nation's toughest state standard on the consent, notice, and disclosure required for private entities to collect, store, or use biometric identifiers--defined by the law as "a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry."

With Thursday's ruling, "BIPA's innovative protections for biometric information are now enforceable in federal court," said Rebecca Glenberg, senior staff attorney at the ACLU of Illinois. "If a corporation violates a statute by taking your personal information without your consent, you do not have to wait until your data is stolen or misused to go to court."

"If a corporation violates a statute by taking your personal information without your consent, you do not have to wait until your data is stolen or misused to go to court."
--Rebecca Glenberg, ACLU of Illinois

"As our General Assembly understood when it enacted BIPA, a strong enforcement mechanism is crucial to hold companies accountable when they violate our privacy laws," she added. "Corporations that misuse Illinoisans' sensitive biometric data now do so at their own peril."

NPR reported Thursday that Facebook plans to request a full circuit court review of the panel's decision. Facebook spokesperson Joe Osborne told the outlet that "we have always disclosed our use of face recognition technology and that people can turn it on or off at any time."

New York Times technology reporter Natasha Singer explained in a series of tweets why the court's "landmark" ruling "must be sending shivers down the spine of Silicon Valley."

Singer wrote that "this is a huge deal not only because it exposes Facebook to potential damages of several billion dollars," but also because "the court found that Americans'--or at least Illinoisans'--right to privacy can be violated even without a concrete physical or economic harm--like stalking, identity theft, or financial loss."