Facebook Sued Over Facial Recognition Software

Facebook, Inc. – a company that needs no introduction – has faced its fair share of lawsuits. Like other social media sites, the company routinely finds itself in uncharted waters, caught between consumer privacy laws ill-equipped to deal with the digital age and the company’s desire to innovate and expand. Questions that have never needed an answer, such as “Who owns Facebook posts?” “Can the police access private accounts?” and “Does Facebook have to delete photos if you request it?” are suddenly being asked by consumers and courts across the country.

In the most recent lawsuit to take aim at Facebook, plaintiffs are questioning the company’s use of facial recognition software – and whether it complies with biometric privacy laws. The social media site has long been able to scan photos uploaded by any user and, using the software, identify and tag the photograph’s subjects. For one Illinois man, though, the feature is unwelcome and, potentially, violates state law.

Frederick Gullen filed a lawsuit in the U.S. District Court for the Northern District of Illinois after a photograph of him, uploaded by a Facebook user, was scanned for facial features, which Facebook is able to identify and break down by gender, face, age and location. The catch? Gullen is not a Facebook user and argues that the site’s policy of scanning and storing “billions” of faces – without providing clear public guidelines on what it does with the information – violates the state’s Biometric Information Privacy Act. This isn’t even the first time Facebook’s faced such allegations: two Illinois-based Facebook users filed similar class action lawsuits earlier this year, accusing the company of “secretly amass[ing] the world’s largest privately held database of consumer biometrics data.”

The newest complaint expands on this, pointing out that:

“The use of facial recognition technology in the commercial context presents numerous consumer privacy concerns. During a 2012 hearing before the United States Senate Subcommittee on Privacy, Technology, and the Law, Senator Al Franken (D-MN) stated that ‘there is nothing inherently right or wrong with [facial recognition technology, but] if we do not stop and carefully consider the way we use [it], it may also be abused in ways that could threaten basic aspects of our privacy and civil liberties.’ Senator Franken noted, for example, that facial recognition technology could be ‘abused to not only identify protesters at political events and rallies, but to target them for selective jailing and prosecution.’”

In this context, it is perhaps worrying that Facebook’s use of facial recognition has so quickly become standard. As the complaint continues:

“Facebook has created, collected and stored over a billion ‘face templates’ (or ‘face prints’) – highly detailed geometric maps of the face – from over a billion individuals, millions of whom reside in the State of Illinois. Facebook creates these templates using sophisticated facial recognition technology that extracts and analyzes data from the points and contours of faces appearing in photos uploaded by their users. Each face template is unique to a particular individual, in the same way that a fingerprint or voiceprint uniquely identifies one and only one person.”

Illinois’ Biometric Information Privacy Act has several requirements that Gullen claims Facebook has not followed. Firstly, subjects must be informed in writing that their “identifier or biometric information” is being collected and stored. Secondly, subjects must be told why their information is being gathered and how long it will be stored for. Thirdly, to comply with the law’s strict rules about consent, the subject must offer a written release, giving permission for the information to be used. None of this, Gullen says, has been done by Facebook – and as there are likely to be tens of thousands of Illinois residents without Facebook accounts who had their photographs uploaded to the site, the lawsuit is seeking compensation on their behalf, as well as a change to Facebook’s policies.

The company has already vowed to defend itself, calling the suit meritless. Only one other state – Texas – currently has similar biometric privacy laws, and none that have been used in this way. It will be interesting to see what the courts make of this – and how, in the future, federal law may broach this difficult topic.