A proposed class action lawsuit filed in Illinois alleges Google violated the state’s biometric privacy law by actively collecting, storing and using without authorization the facial templates of “millions of unwitting individuals” who appear in pictures uploaded to Google Photos.
Under the Illinois Biometric Privacy Act (BIPA), the 15-page complaint says, private entities such as Google cannot obtain and/or possess an individual’s unique biometric information—such as fingerprints, voiceprints or facial scans—without adhering to clear guidelines governing how such data is to be handled.
“Each and every” photo scanned, lawsuit says
According to the lawsuit, the cloud-based Google Photos app comes pre-installed on all Android devices and is set by default to automatically upload every photo taken by a device user. The case claims, however, that Android users are unaware that Google scans “each and every photo” uploaded to Google Photos to extract the facial geometries of the individuals in the pictures, including data relating to the unique points and contours of each face.
With this information, Google, the complaint continues, creates and stores a template of each face in a database. Google Photos utilizes the facial templates to organize and group together photos based on the particular individuals who appear in each picture, according to the suit. This technology works, the case says, by cross-referencing facial templates that already appear in Google’s database with newly uploaded photos.
The case alleges the unique facial templates collected and stored by Google photos are used not only to “identify individuals by name, but also to recognize their gender, age, and location.”
Illinois’ biometric privacy law
Enacted by the state in 2008, the Illinois BIPA makes it unlawful for a company to “collect, capture, purchase, receive through trade or otherwise obtain” an individual’s biometric information – such as a face print – without first making certain disclosures. A company dealing in consumers’ biometric identifiers must first:
Inform a subject in writing that a biometric identifier or biometric information is being collected or stored;
Inform a subject in writing of the “specific purpose and length of term” for which their biometric information will be collected, stored and used;
Receive a written release from the individual authorizing the collection of biometric information; and
Develop and make publicly available a written policy establishing a retention schedule and outlining guidelines for the permanent destruction of an individual’s biometric identifiers when the initial purpose for collecting such has been satisfied or within three years of a person’s last interaction with the company.
As the case tells it, Google, “in direct violation” of the Illinois BIPA, never satisfied any of the above-listed requirements before capturing, storing and using state residents’ facial templates derived from Google Photos.
Who does this case look to cover?
The lawsuit aims to cover a class of individuals who had their biometric identifiers, namely scans of their facial geometry, collected, captured, received or otherwise obtained by Google from photos uploaded to Google Photos in Illinois.
In most cases, it can takemonths or yearsfor a lawsuit to move from just-filed to either a settlement or dismissal. In the event that a case is settled, covered individuals should be notified with instructions on how to file a claim orobjectoropt outof the deal.
Want to learn about the latest class action filings and settlements? Sign up for our newsletter here.
What if I don’t live in Illinois?
Because the Illinois BIPA is relatively new as far as consumer privacy laws go, the statute covers only individuals who live in the state. However, it’s entirely possible that the recentwave of litigation, centered on alleged violations of the Illinois BIPA, may eventually signal to other states that more has to be done to protect citizens from having their sensitive identifying information captured, stored and shared by companies without their say-so. The trend is still relatively new, but it’s not too far of a stretch to envision more and more states enacting similar laws in the coming years.