September 4, 2020 – Facebook Hit with Another Case Alleging Illegal Facial Scanning on Instagram
Facebook faces another proposed class action in Illinois over its alleged practice of “collecting, storing, disclosing, profiting from, and otherwise using” the biometric information of more than 100 million Instagram users without consent.
The lawsuit, filed August 14, mirrors the suit detailed on this page in alleging Facebook has run afoul of the Illinois Biometric Information Privacy Act (BIPA) by illegally harvesting the facial geometries of Instagram users and others who appear in photos in an effort to bolster its facial recognition technology. Though the company has claimed users are in control over whether Facebook analyzes the details of an individual’s face to create a corresponding “face template,” this is not the case, according to the lawsuit.
“Facebook does all of this without providing any of the required notices or disclosures required by Illinois law,” the complaint reads.
Fresh off a whopping $650 million class action settlement over similar allegations, Facebook finds itself facing another privacy lawsuit claiming the embattled social media titan has illegally harvested Instagram users’ sensitive biometric information.
The 24-page proposed class action, filed in San Mateo County, California Superior Court, alleges Facebook is actively “collecting, storing, disclosing, profiting from, and otherwise using” the facial scans of more than 100 million Instagram users despite never providing written notice of or obtaining informed consent to engage in the practice.
According to the lawsuit, Facebook’s conduct violates the Illinois Biometric Information Privacy Act (BIPA), a novel state law that sets stringent requirements for private entities who deal with biometric identifiers such as facial and fingerprint scans.
Despite the defendant’s representations to the contrary, Instagram users are effectively powerless to stop Facebook from utilizing its facial recognition software to scan the faces that appear in photos, analyze the details of each individual face, create a corresponding template, and then store that template for later use and/or match it to an already existing template, the lawsuit alleges. Even if an Instagram user’s facial recognition setting is turned off, they cannot control Facebook’s collection of facial templates given the company scans the faces in photos and videos uploaded by other users, the suit says.
In all, Facebook, which acquired the photo- and video-sharing app in 2012, harvests Instagram users’ facial geometries without ever obtaining informed consent to do so or even informing them of the practice, the case claims. Facebook’s end goal in capturing, storing and using Instagram users’ biometric data is to bolster its facial recognition capabilities across its products, including the Facebook platform, the lawsuit says.
“Facebook does all of this without providing any of the required notices of disclosures required by Illinois law,” the plaintiff, an Illinois Instagram user, relays.
Under the Illinois BIPA, the suit says, a private entity must:
Inform a subject in writing that their biometric identifier or biometric information is being collected or stored;
Inform a subject in writing of the specific purpose and length of term for which the biometric identifier is being collected, stored and used; and
Receive a written release from the subject authorizing the collection, storage and use of their biometric identifier.
Further, the law requires that a private entity in possession of biometric information develop a written, publicly available retention schedule and guidelines for the permanent destruction of the data once the initial purpose for collecting and obtaining such has been satisfied, or within three years of an individual’s last interaction with the company, the complaint adds.
Prior to January 1, 2020, Facebook never informed Instagram users that it would collect their biometric data, the case goes on. Instead, the Instagram Data Policy stated merely that Facebook collects information “you and others provide” to the app, including through posted content and anything a user may see through their camera, and that the defendant’s systems automatically process the content to analyze context and what appears in the posts, the lawsuit says. Facebook, in fact, “actively mislead [sic] Instagram users about whether it was collecting facial recognition data,” the case claims.
Per the suit, Facebook’s statements with regard to allowing Instagram users to “turn off” or opt out of facial recognition technology in the app are untrue. Further, while the defendant published for the first time on January 1, 2020 its California Privacy notice for users in the state in accordance with California law, the case argues this “after-the-fact notice” does not amount to compliance with the Illinois BIPA given proposed class members are allowed to opt out of facial scanning only after Facebook has already collected their biometric data.
Still further, the complaint says, a consumer can opt out “only if [they] knew to look for the opt-out option, which upon information and belief, is not even possible through a user’s Instagram account.”
In January, Facebook announced it would pay an unprecedented $550 million to settle a proposed class action over the company’s alleged habit of illegally capturing the facial scans of Illinois users once a class was certified, clearing a path to trial. After a federal judge railed against the settlement, characterizing the deal as “woefully inadequate,” Facebook upped the amount to $650 million. United States District Judge James Donato, of California, granted preliminary approval to the settlement in late July.
The suit looks to represent all Illinois residents who had their biometric identifiers, including facial scans, collected, captured, received or otherwise obtained by Facebook through photos uploaded to the Instagram app.
Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s newsletter here.