Facebook Keeps Getting Sued Over Face-Recognition Software, And Privacy Groups Say We Should Be Paying More Attention

Who owns your face? Believe it or not, the answer depends on which state you live in, and chances are, you live in one that hasn’t even weighed in yet.

That could soon change. For the fourth time this year, Facebook Inc. was hit with a class-action lawsuit by an Illinois resident who says its face-recognition software violates an unusual state privacy law there. The latest complaint, filed Monday, underscores a quiet but high-stakes legal battle for the social networking giant, one that could reverberate throughout the rest of the U.S. tech industry and much of the private sector.

With almost 1.5 billion active users, Facebook has amassed what probably is the world’s largest private database of “faceprints,” digital scans that contain the unique geometric patterns of its users’ faces. The company says it uses these identifiers to automatically suggest photo tags. When users upload new pictures to the site, an algorithm calculates a numeric value based on a person’s unique facial features. Facebook pitches the feature as just another convenient way to stay connected with friends, but privacy and civil rights advocates say the data generated by face-recognition technology is uniquely sensitive, and requires extra special safeguards as it finds its way into the hands of private companies.

“You can’t turn off your face,” said Alvaro M. Bedoya, founding executive director of Georgetown University’s Center on Privacy & Technology. “Yes, it’s 2015, and yes, we’re tracked in a million different ways, but for most of those forms of tracking, I can still turn it off if I want to.”

Faceprints Are Mostly Unregulated

Currently, there are no comprehensive federal regulations governing the commercial use of biometrics, the category of information technology that includes faceprints. And Bedoya said the government appears to be in no hurry to address the issue.

Earlier this year, the Center on Privacy & Technology was one of a number of privacy-rights groups -- along with the Electronic Frontier Foundation and the American Civil Liberties Union, among others -- that withdrew from discussions on how to craft guidelines for face-recognition technology. After months of negotiations, Bedoya said the groups grew frustrated by tech industry trade associations that would not agree to even the most minimal of protections, including a rule that would require companies to obtain written consent before collecting and storing faceprints on consumers.

“When not a single trade association would agree to that, we just realized we weren’t dealing with people who were there to negotiate,” Bedoya said. “We were there to deal basically with people who wanted to stop the process, or make it something that was watered down.”

But Illinois is different. It’s one of only two states -- the other being Texas -- to regulate biometrics in the private sector. Illinois passed its Biometric Information Privacy Act in 2008, back when Facebook was still in its relative infancy and most companies were not thinking about face-recognition technology.

“I think we were ahead of the curve,” said Mary Dixon, legislative director for the ACLU of Illinois, which advanced the initiative. “I think it’d be hard to pass similar initiatives now given the intense lobby against some of the protections we were able to advance.”

Litigation Faceoff

Illinois’ law went pretty much unnoticed until April of this year, when a high-profile privacy lawyer filed a lawsuit in federal court on behalf of a Facebook user who charges that Facebook is collecting and storing faceprints on its users without obtaining informed written consent, a violation of Illinois' BIPA. The suit is federal because Facebook is based in California and the proposed plaintiff class potentially numbers in the millions. Since then, at least three more federal lawsuits were filed, each making similar claims. The latest suit comes from Frederick William Gullen, an Illinois resident who doesn’t even have a Facebook account, but who insists that Facebook created a template of his face when another user uploaded a photo of him.

“Facebook is actively collecting, storing, and using -- without providing notice, obtaining informed written consent or publishing data retention policies -- the biometrics of its users and unwitting non-users ... Specifically, Facebook has created, collected and stored over a billion ‘face templates’ (or ‘face prints’) -- highly detailed geometric maps of the face -- from over a billion individuals, millions of whom reside in the State of Illinois.”

A Facebook spokeswoman said the lawsuits are without merit and the company will defend itself vigorously against them, but the reality is, the cases could play out in a number of ways given that face recognition is largely untested legal territory.

Dixon and other legal experts familiar with BIPA say Facebook probably will argue that because its faceprints are derived from photographs, they are exempt from BIPA’s consent requirements. Shutterfly Inc., another Internet company being sued in Illinois over facial-recognition technology, is arguing a similar stance. Although BIPA clearly considers scans of “hand or face geometry” to be biometric identifiers, it also says photographs are not. Bedoya said the wording of the law raises a “seeming contradiction” that defendants fighting BIPA lawsuits might be able to exploit.

“The law was written in a way that could have been clearer,” he said.

Facebook points out that users can turn off tag suggestions, but Dixon said BIPA was written to ensure that biometric data collection does not take place without written consent executed by the subject of the biometric identifier. The law also makes it illegal to sell, lease or otherwise profit from a customer’s biometric information, a particular thorn in the side for companies that trade in personal data.

The Facebook and Shutterfly lawsuits will be closely watched as policymakers in other states consider crafting bills governing the use of biometrics. Meanwhile, privacy advocates say we should all be paying attention. As face-recognition technology becomes more pervasive, it will have increasing implications for our lives, both online and off.

“There’s an awful lot at stake here,” Bedoya said. “In the end, do we want to live in a society where everyone is identified all the time the minute they walk out into public? I think most people aren’t ready for that world.”

Fb Complaint

Christopher Zara covers media and culture. News tips? Email me. Follow me on Twitter @christopherzara .