Facebook faces foe formation in facial fingering fight

A US federal judge on Monday ruled that a lawsuit filed over Facebook's use of facial recognition technology can proceed as a class action, raising the possibility the social network could face billions in damages.

The sueball was filed in May 2015 under Illinois' 2008 Biometric Information Privacy Act (BIPA) by three residents of state, Nimesh Patel, Adam Pezen and Carlo Licata, who were upset by the social network's collection of biometric data without adequate notice or consent.

A separate lawsuit, filed in September 2015, makes a similar claim. Google is also facing claims under BIPA in a Chicago court (Rivera v. Google, 16-cv-02714, and Weiss v. Google, 16-cv-02870).

In 2011, Facebook launched Tag Suggestions, a service that uses facial recognition technology to analyze uploaded images. If it matches a face in an image to Facebook user, it then suggests the uploader tag the flagged person as a means of encouraging engagement (which leads to exposure to ads).

Facebook, according to court documents, does not store facial recognition signatures, the number generated by applying its facial recognition algorithms to an image. Rather, it stores face templates, a numerical representation of the boundary between a user's face signature and the face signature of others.

When a face signature falls within the boundary range for a given entry in the template database, then Facebook suggests tagging the matched user.

It is this database of face templates – numbers derived from a facial signature, but not the signature itself – that will form the basis of the eligible class members.

This could get expensive

US District Judge James Donato, from the Northern California District Court in San Francisco, where the case was moved at Facebook's request, brushed aside Zuck & Co's concerns that allowing the case to proceed as a class action could expose the company to liabilities amounting to billions of dollars.

BIPA allows statutory damages of up to $5,000 for each intentional or reckless violation and $1,000 for each negligent violation and potentially millions of Illinois residents could claim such compensation.

Judge Donato observed that the Illinois legislature could have eliminated the possibility of class actions if it had wanted to limit financial exposure of defendants. He also said that the court can adjust damages if they turn out to be unreasonable.

To justify his decision to allow the claim to proceed as a class action, he suggested Facebook's data gathering will make class action logistics much easier.

"The class will be manageable because members can be identified in a straightforward way," he wrote in his order. "Facebook has collected a wealth of data on its users, including self-reported residency and IP addresses."

In a statement emailed to The Register, a Facebook spokesperson said, "We are reviewing the ruling. We continue to believe the case has no merit and will defend ourselves vigorously."

Coincidentally, an amendment to BIPA is currently being considered by the Illinois State Assembly to limit the scope of the privacy law.

Facebook has said it's not lobbying for the change, though the Illinois Chamber of Commerce's Tech Council, which counts Facebook as a member, is doing so.

The social ad network has also made campaign contributions to sponsors of the amendment, like Illinois General Assembly member André Thapedi.

If BIPA does get gutted by legislators worried there's too much privacy, Facebook isn't likely to complain. ®