Facebook Lost the First Round in a Battle Over the Legality of its Automatic Photo-Tagging

A judge in California on May 6 cleared the way for the battle to proceed over a Facebook technology that allows the social media service to attach names to faces. The judge rejected Facebook’s request to dismiss a class-action lawsuit brought by three Chicago Facebook users.

The plaintiffs say that Facebook’s “Tag Suggestions” photo-tagging feature, launched in 2010, is collecting and storing users’ biometric information without their informed consent, breaking a law governing the use of biometric data. According to the plaintiffs’ complaint, they were filing suit “to put a stop to its surreptitious collection, use and storage of plaintiffs’ and the proposed class’ sensitive biometric data.”

The plaintiffs are seeking damages of $1,000 or $5,000 for each violation of the biometric data law for all Facebook users who uploaded photos to the service while residing in Illinois. The law they say Facebook has broken is the Illinois Biometric Information Privacy Act of 2008, known as BIPA.

There are over 7 million Facebook users in Illinois, according to Stuart Davidson, a lawyer acting for the plaintiffs, so Facebook’s bill could run into the billions if the judge ultimately rules against it.

Facebook users globally upload 300 million photos a day, according to the complaint, and the company scans those photos with an algorithm to suggest names to put to faces. Each user is assigned a unique “template” in this process, according to Facebook and the court order. The feature has a spotty history. It was turned on by default, then turned off, then turned on again by default for U.S. users. In Europe, the feature was suspended after a review by the Irish data protection authority.

» Get the best federal technology news and ideas delivered right to your inbox. Sign up here.

Today’s court order also settled the question of whether BIPA, an Illinois state law, could be applied in California, where the case is being heard. The judge, James Donato, ruled that Illinois law could be used, based on the notion of “greater impairment” to a state’s policies in choosing between two sets of laws.

“But if California law is applied, the Illinois policy of protecting its citizens’ privacy interests in their biometric data, especially in the context of dealing with 'major national corporations' like Facebook, would be written out of existence,” Donato wrote.

Facebook didn’t provide comment when contacted by Quartz. Jay Edelson, a well-known class-action lawyer (paywall) who is representing the plaintiffs, said: “The case is now proceeding to trial. They may attempt some other maneuvers to try to get out of a trial, but we’re expecting to try the case and we think it will happen.”

The case is far from resolved. The plaintiffs’ lawyers still have to convince the court to certify the case as a class action. Only about 20 percent of cases filed as class-actions are given a certified class, according to a 2010 study by California’s judicial branch, so the odds are not stacked in favor of the plaintiffs. The judge will meet Facebook and the plaintiffs in June; if a trial does happen it is likely to take place next year.