People Should Be Allowed to Sue Facebook If It Violates Law on Face Recognition Privacy

Ten years ago, Illinois enacted a law that imposes important protections against companies collecting and storing our biometric information — including using facial recognition— without our knowledge and consent. The law is called the Biometric Information Privacy Act. Although facial recognition was relatively crude when it was passed, the wisdom of Illinois’ decision has been borne out over the last decade, as facial recognition and other biometric collection has developed and spread.

On Monday, the ACLU filed a friend-of-the-court brief in federal appeals court defending the Illinois law against arguments advanced by Facebook trying to remove the law’s pro-privacy teeth. (The brief was filed along with ACLU affiliates in Illinois and California as well as the Electronic Frontier Foundation, Center for Democracy & Technology, and Illinois PIRG).

Under the law, a company may collect a person’s biometric identifiers — like fingerprints or data from a person’s face or iris — only if it first obtains informed consent from that person. In the case now pending in the Ninth Circuit Court of Appeals, Facebook users in Illinois have alleged that the company violated their rights under the law by using facial recognition technology to identify them in digital images uploaded to the site without disclosing its use of facial recognition or obtaining consent.

One of Facebook’s arguments in the case is that people should not have an automatic right to sue when their biometric information has been collected in violation of the law. Rather, they must prove that they have suffered monetary or other damages. As we explain in our brief, however, that runs counter to the Illinois Legislature’s intent, which was to provide strong, enforceable protection against surreptitious collection of sensitive biometric data.

In the decade since passage of the law, the need for its protections has become crystal clear. As we explain in the brief, today:

Retail stores use facial recognition technology to “identify known shoplifters,” and at least some companies are reportedly using such technology to track shoppers in their stores. Employers collect biometrics for time tracking and attendance management, as well as to manage access to company phones, laptops, and cloud storage accounts. Banks have invested in collecting customers’ biometric data, including face scans, fingerprints, iris scans, and voiceprints, to authenticate those customers’ identities. Churches have adopted facial recognition and fingerprint collection technology “to accurately track attendance for various events like Bible studies, worship services and Sunday school.” Many schools now collect fingerprints to manage attendance, cafeteria purchases, library services, and security, and some schools have started installing facial recognition systems to control entry into buildings.

Perhaps most concerning, major technology companies like Amazon have invested heavily in powerful facial recognition systems that they sell access to on the cheap. Amazon says its facial recognition system, called Rekognition, is not only able to store facial recognition images of large numbers of people, but it is also able to “perform real-time face searches against collections with tens of millions of faces” and “detect, analyze, and index up to 100 faces ... in a single image,” such as photographs captured at “crowded events ... [and] department stores.”

mytubethumbplay
%3Ciframe%20allow%3D%22accelerometer%3B%20autoplay%3B%20encrypted-media%3B%20gyroscope%3B%20picture-in-picture%22%20allowfullscreen%3D%22%22%20frameborder%3D%220%22%20height%3D%22315%22%20src%3D%22https%3A%2F%2Fwww.youtube.com%2Fembed%2FlSSZ3-ZIkHU%3Fautoplay%3D1%26version%3D3%22%20thumb%3D%22%2Ffiles%2Fweb18-amazon-face-recognition-560x315.jpg%22%20width%3D%22560%22%3E%3C%2Fiframe%3E
Privacy statement. This embed will serve content from youtube.com.

Using it is cheap, and as we have warned before, without protections, this technology could enable civil rights and civil liberties violations on a massive scale. Indeed, a recent survey conducted by the ACLU revealed that 18 of the top 20 American retail companies refused to say whether they collect facial recognition scans of their customers.

That’s why we support a strong interpretation of the law’s protections. As the district court wrote in its ruling against Facebook in February, “When an online service simply disregards the Illinois procedures, as Facebook is alleged to have done, the right of the individual to maintain her biometric privacy vanishes into thin air.”

Without an enforceable requirement that companies disclose their collection of biometric information and obtain consent, people will have no way to protect themselves against surreptitious corporate surveillance.

Sign up for the ACLU’s Best Reads and get our finest content from the week delivered to your inbox every Saturday.

View comments (7)
Read the Terms of Use

Ms. Gloria Anasyrma

Only unattractive people should be threatened by their bio-metric data being collected. Attractive people should be proud of their good looks.

Anonymous

I feel the same . The face recongition was used to harm me. I suffer from depression and it made it worse. I am now seeking medical help thanks to it. It desteroyed a five year relationship I had. and it violated my privacy . I will definitely seek out an attorney in this matter. I received calls from over seas of people committing sexual acts over video. It was disgusting and volgar. My ex has total control over using my fb for harmful personal deflimation of character. It made my personal life public in a small town I reside in.

Anonymous

I WANT TO SUE ZUCKERFUCK!!!!!!

Anonymous

Dont you think its a little questionable to cite to a no longer operative Lowe's Privacy Policy in your brief after they changed their policy and allegedly practice after your previous article on the topic

Lisa

Privacy issues are paramount.

Anonymous

So then why is fakebook aloud to stop my free speach.

Staci Louise kennedt

I was on a video surveillance and a facial recognition software from Walmart in Oregon and I had been asked by roommate to pick up items he had ordered online and doing so I unknowingly end up picking up something that was bought with a stolen credit card and because of that now every time I go to Walmart there facial recognition software picks me up and I'm immediately flag they're harassed me that the police in the parking lot they have I mean it's ridiculous and it's out of line so I am filing a grievance with a local attorney who's taking my case on pro bono

Stay Informed