patrick.net

The U.S. Court of Appeals for the Ninth Circuit ruled today that Facebook users can sue the company over its use of face recognition technology. The ruling is the first decision of an American appellate court directly addressing the unique privacy harms posed by the face recognition technology being increasingly pushed on members of the public without their knowledge and consent.

The ruling in Patel v. Facebook affirms the district court's certification of a class of Facebook users in Illinois who have alleged that the company violated their rights under their state’s Biometric Information Privacy Act (BIPA). The Illinois statute imposes protections against companies collecting and storing biometric information, including using face recognition technology, without the user’s knowledge and consent. The suit alleges that Facebook’s practice of using face recognition technology to identify users in digital images uploaded to the site without disclosing its use of face recognition or obtaining consent violates state law. ...

Today’s ruling allows the case to move forward as a class action in district court. In an opinion by Judge Ikuta, the court “concludes that the development of a face template using facial-recognition technology without consent (as alleged here) invades an individual’s private affairs and concrete interests.” As the court explained, “the facial-recognition technology at issue here can obtain information that is ‘detailed, encyclopedic, and effortlessly compiled,’ which would be almost impossible without such technology.” In light of these harms, the court found that the plaintiffs had alleged sufficient privacy injuries to have standing to sue.