Facebook may face billions in fines over its Tag Suggestions feature

Illustration by Alex Castro / The Verge

Facebook could face billions of dollars in fines after a federal judge ruled that the company must face a class action lawsuit. The lawsuit alleges that Facebook’s facial recognition features violate Illinois law by storing biometric data without user consent.

The lawsuit involves Facebook’s Tag Suggestions tool, which identifies users in uploaded photos and suggests automatic tagging of your friends. The feature was launched on June 7th, 2011. According to the suit, the complainants allege that Facebook “collects and stores their biometric data without prior notice or consent in violation of their privacy rights.” Illinois’ Biometric Information Privacy Act (BIPA) requires explicit consent before companies can collect biometric data like fingerprints or facial recognition profiles.

It should be noted that Facebook has since also added a more direct notification alerting users to its facial recognition features, but this lawsuit is based on the earlier collection of user data. With the order, millions of the social network’s users could collectively sue the company, with violations of BIPA incurring a fine of between $1,000 to $5,000 each time someone’s image is used without permission.

In the court order, Judge James Donato wrote:

“A class action is clearly superior to individual proceedings here. While not trivial, BIPA’s statutory damages are not enough to incentivize individual plaintiffs given the high costs of pursuing discovery on Facebook’s software and code base and Facebook’s willingness to litigate the case...Facebook seems to believe that a class action is not superior because statutory damages could amount to billions of dollars.”

The Tag Suggestion feature works in four steps: software tries to detect the faces in uploaded photos. Once detected, Facebook computes a “face signature” — a series of numbers that “represents a particular image of a face” based on your photo — and a “face template” database that the system uses to search face signatures for a match. If the face signature matches, Facebook then suggests the tag. Facebook doesn’t store face signatures and only keeps face templates.

Facebook says its automatic tagging feature detects 90 percent of faces in photos. The lawsuit claims about 76 percent of faces in the photos have face signatures computed. Tag suggestions are available in limited markets. It is primarily offered for users in the US with the option to turn the feature off.

A lawyer for Facebook users, Shawn Williams, told Bloomberg:

“As more people become aware of the scope of Facebook’s data collection and as consequences begin to attach to that data collection, whether economic or regulatory, Facebook will have to take a long look at its privacy practices and make changes consistent with user expectations and regulatory requirements,” he said.

Facebook also launched a new feature back in December that notifies users when someone uploads a photo of them, even if they’re not tagged. In a statement to The Verge, Facebook said, “We are reviewing the ruling. We continue to believe the case has no merit and will defend ourselves vigorously.” Facebook also says it has always been upfront about how the tag function works, and users can easily turn it off if they wish.

Updated April 17th, 1:10pm ET: Added statement and extra info from Facebook

Comments

Great news. Let’s bleed Facebook !

I don’t know…I feel like people who complain about this are no better than those congress man who questioned Mark without understanding how tech works.

fb is storing a vectorized feature of your face at best (a series of numbers), to me it’s no different then storing your username and password. The other part that confuses me the most is that why use the service when you don’t trust it or agree to it.

If you don’t agree to it, and your friend uploads a picture with you in it, what happens to the data Facebook calculates for the facial recognition feature…? Does Facebook get to "own" "your face" in order to make sure you are not tagged, if you opt out? Can they do that? And moreover, this could extend to "shadow profiles" and faces of people who are not Facebook users. I guess they are not part of the class action but you see where this is going.

Except that they violated a state law saying they needed consent collect that information. They willingly violated a law they were fully aware of was on the books.

And I can get a new password and email address if that info is stolen. I can even get a new SSN number if necessary. If someone steals that bio-metric data and its associated with my name, I can’t get a new face. So maybe don’t collect the data on my body that I cannot change, especially with all the creepy software out there that is now allowing for faces to be super imposed on other people’s bodies.

Class Action Lawsuit = Welfare For Lawyers

But doesn’t almost every social media perform this face tagging?

View All Comments
Back to top ↑