Facebook faces billions in fines over biometric data

Facebook users in Illinois whose faces were scanned without their knowledge can sue the social media company for damages that could amount to billions of dollars.

A judge in San Francisco ruled on Monday that Facebook must face potentially millions of users from the state who claim the company has gathered and stored their biometric data without their agreement.

US District Judge James Donato’s decision to let the lawsuit proceed as a class action is a significant step for users seeking to put Facebook on the hook for fines of $1,000 to $5,000 for each time a person’s image is used without permission under a unique Illinois law. The ruling could also help advance restrictions on Facebook’s use of biometrics in the US, similar to those in Europe and Canada.

Facebook is reviewing the ruling, according to a company representative. “We continue to believe the case has no merit and will defend ourselves vigorously,” the person said.

The company “seems to believe” that the lawsuit should be pursued by individuals, not as a group, because “damages could amount to billions of dollars”, Judge Donato wrote in the ruling.

The company argued each plaintiff could be “aggrieved” differently, and must prove that they suffered an actual injury beyond a privacy right.

Nonetheless, the judge said “substantial damages are not a reason to decline class certification”.

The Illinois residents who sued under the Biometric Information Privacy Act have argued the 2008 state law gives them a “property interest” in the algorithms that constitute their digital identities.