Users can sue Facebook over facial recognition software, court rules

A U.S. court has ruled that Facebook users in Illinois can sue the company over face recognition technology, meaning a class action can move forward.

The 9th Circuit U.S. Court of Appeals issued its ruling on Thursday. According to the American Civil Liberties Union, it’s the first decision by a U.S. appellate court to directly address privacy concerns posed by facial recognition technology.

“This decision is a strong recognition of the dangers of unfettered use of face surveillance technology,” Nathan Freed Wessler, an attorney with the ACLU Speech, Privacy and Technology Project, said in a statement. “The capability to instantaneously identify and track people based on their faces raises chilling potential for privacy violations at an unprecedented scale.”

Facebook told NPR that the company plans to ask the full circuit court to review the decision of the three-judge panel. “We have always disclosed our use of face recognition technology and that people can turn it on or off at any time,” said Joe Osborne, a Facebook spokesman. Information about its facial recognition technology is available in the company policy online.

The case concerns Facebook users in Illinois who accused the social media giant of violating the state’s Biometric Information Privacy Act.

Facebook argued that the users had experienced no concrete harm. But the 9th Circuit panel noted that intangible injuries can still be concrete, and it noted the Supreme Court has said advances in technology can lead to more personal privacy intrusions.

The appeals panel decided that Facebook’s technology “invades an individual’s private affairs and concrete interests.”

In 2011, Facebook launched a feature called “tag suggestions.” It allowed technology to analyze the details of people’s faces in uploaded photos — the distance between their eyes, their nose and other features. Users could choose to opt out of the feature. Facebook said it only builds face templates of Facebook users who have the feature turned on.

“Once a face template of an individual is created,” the judges wrote, “Facebook can use it to identify that individual in any of the other hundreds of millions of photos uploaded to Facebook each day, as well as determine when the individual was present at a specific location.”

They noted that Facebook keeps a database of users’ face templates, which are stored on servers in states that include Oregon, Iowa, Texas and California.

Facebook argued before the judges that its collection of biometric data happened outside of Illinois, and outside of the privacy law’s purview.

The panel disagreed, saying it was reasonable to conclude that the law was meant to protect people in Illinois, “even if some relevant activities occur outside the state.”

Privacy advocates have long expressed concern that face recognition technology can be used for mass surveillance and to target protesters, setting a dangerous environment in countries where democracy is failing or never existed at all.

Note: Facebook is one of NPR’s financial sponsors.

Copyright 2019 NPR. To see more, visit https://www.npr.org.