Class Action Alleges Facebook Secretly Harvests Instagram Users’ Facial Scans [UPDATE]
Last Updated on April 19, 2022
Whalen v. Facebook, Inc.
Filed: August 10, 2020 ◆§ 20-CIV-03346
A class action claims Facebook has illegally harvested the facial scans of more than 100 million Instagram users, including those protected by an Illinois privacy law.
Case Updates
April 19, 2022 – Lawsuit Sent to Arbitration
The claims detailed on this page have been sent to arbitration after a federal judge found that the plaintiffs agreed to an arbitration clause in Instagram’s terms of use.
In a partially redacted March 21 order, U.S. District Judge Jon S. Tigar noted that the parties in the case do not dispute that Instagram’s terms of use have contained an arbitration agreement since 2013 that would cover the plaintiffs’ claims. Though the plaintiffs argued that they never agreed to the arbitration clause, Judge Tigar found that they assented to the agreement at least once in late 2020 by continuing to use the Instagram app after being notified that its terms had been revised.
According to the order, an in-app notification that appeared at the top of users’ activity feeds in November 2020 put users on notice that Instagram had updated its terms of use and allowed them to either click “Learn More” to be directed to a copy of the revised terms or click the “X” at the top-right corner to dismiss the message. Additionally, if the user did not interact with the message, it would be shown to them three times before being taken down, the order relayed.
Judge Tigar noted that the plaintiffs did not unequivocally deny seeing the notification and instead only stated that they do not recall seeing it. Moreover, Facebook’s records indicate that the plaintiffs both clicked the “X” to dismiss the notice, according to the order.
For these reasons, and the fact that the in-app notification was conspicuous and unambiguous, Judge Tigar concluded that Facebook has sufficiently demonstrated that the plaintiffs agreed to the arbitration agreement contained within Instagram’s terms of use.
The court has stayed the case pending the results of arbitration.
The order also notes that the plaintiff in the second case mentioned on this page, filed in August 2020, has voluntarily dismissed her claims.
Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.
September 4, 2020 – Facebook Hit with Another Case Alleging Illegal Facial Scanning on Instagram
Facebook faces another proposed class action in Illinois over its alleged practice of “collecting, storing, disclosing, profiting from, and otherwise using” the biometric information of more than 100 million Instagram users without consent.
The lawsuit, filed August 14, mirrors the suit detailed on this page in alleging Facebook has run afoul of the Illinois Biometric Information Privacy Act (BIPA) by illegally harvesting the facial geometries of Instagram users and others who appear in photos in an effort to bolster its facial recognition technology. Though the company has claimed users are in control over whether Facebook analyzes the details of an individual’s face to create a corresponding “face template,” this is not the case, according to the lawsuit.
“Facebook does all of this without providing any of the required notices or disclosures required by Illinois law,” the complaint reads.
Fresh off a whopping $650 million class action settlement over similar allegations, Facebook finds itself facing another privacy lawsuit claiming the embattled social media titan has illegally harvested Instagram users’ sensitive biometric information.
The 24-page proposed class action, filed in San Mateo County, California Superior Court, alleges Facebook is actively “collecting, storing, disclosing, profiting from, and otherwise using” the facial scans of more than 100 million Instagram users despite never providing written notice of or obtaining informed consent to engage in the practice.
According to the lawsuit, Facebook’s conduct violates the Illinois Biometric Information Privacy Act (BIPA), a novel state law that sets stringent requirements for private entities who deal with biometric identifiers such as facial and fingerprint scans.
Despite the defendant’s representations to the contrary, Instagram users are effectively powerless to stop Facebook from utilizing its facial recognition software to scan the faces that appear in photos, analyze the details of each individual face, create a corresponding template, and then store that template for later use and/or match it to an already existing template, the lawsuit alleges. Even if an Instagram user’s facial recognition setting is turned off, they cannot control Facebook’s collection of facial templates given the company scans the faces in photos and videos uploaded by other users, the suit says.
In all, Facebook, which acquired the photo- and video-sharing app in 2012, harvests Instagram users’ facial geometries without ever obtaining informed consent to do so or even informing them of the practice, the case claims. Facebook’s end goal in capturing, storing and using Instagram users’ biometric data is to bolster its facial recognition capabilities across its products, including the Facebook platform, the lawsuit says.
“Facebook does all of this without providing any of the required notices of disclosures required by Illinois law,” the plaintiff, an Illinois Instagram user, relays.
Under the Illinois BIPA, the suit says, a private entity must:
- Inform a subject in writing that their biometric identifier or biometric information is being collected or stored;
- Inform a subject in writing of the specific purpose and length of term for which the biometric identifier is being collected, stored and used; and
- Receive a written release from the subject authorizing the collection, storage and use of their biometric identifier.
Further, the law requires that a private entity in possession of biometric information develop a written, publicly available retention schedule and guidelines for the permanent destruction of the data once the initial purpose for collecting and obtaining such has been satisfied, or within three years of an individual’s last interaction with the company, the complaint adds.
Prior to January 1, 2020, Facebook never informed Instagram users that it would collect their biometric data, the case goes on. Instead, the Instagram Data Policy stated merely that Facebook collects information “you and others provide” to the app, including through posted content and anything a user may see through their camera, and that the defendant’s systems automatically process the content to analyze context and what appears in the posts, the lawsuit says. Facebook, in fact, “actively mislead [sic] Instagram users about whether it was collecting facial recognition data,” the case claims.
Per the suit, Facebook’s statements with regard to allowing Instagram users to “turn off” or opt out of facial recognition technology in the app are untrue. Further, while the defendant published for the first time on January 1, 2020 its California Privacy notice for users in the state in accordance with California law, the case argues this “after-the-fact notice” does not amount to compliance with the Illinois BIPA given proposed class members are allowed to opt out of facial scanning only after Facebook has already collected their biometric data.
Still further, the complaint says, a consumer can opt out “only if [they] knew to look for the opt-out option, which upon information and belief, is not even possible through a user’s Instagram account.”
In January, Facebook announced it would pay an unprecedented $550 million to settle a proposed class action over the company’s alleged habit of illegally capturing the facial scans of Illinois users once a class was certified, clearing a path to trial. After a federal judge railed against the settlement, characterizing the deal as “woefully inadequate,” Facebook upped the amount to $650 million. United States District Judge James Donato, of California, granted preliminary approval to the settlement in late July.
The suit looks to represent all Illinois residents who had their biometric identifiers, including facial scans, collected, captured, received or otherwise obtained by Facebook through photos uploaded to the Instagram app.
Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s newsletter here.
Before commenting, please review our comment policy.